mirror of
https://github.com/tommytran732/Matrix.to-Docker
synced 2024-11-09 12:41:34 -05:00
Compare commits
6 Commits
fb7ad7854d
...
e9ec74f560
Author | SHA1 | Date | |
---|---|---|---|
e9ec74f560 | |||
b4e847e1f3 | |||
fc7a19b977 | |||
13cc98f1c7 | |||
ffd6a10253 | |||
37eb92672d |
33
.github/workflows/build.yml
vendored
33
.github/workflows/build.yml
vendored
@ -27,18 +27,18 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v2
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Install cosign
|
- name: Install cosign
|
||||||
if: github.event_name != 'pull_request'
|
if: github.event_name != 'pull_request'
|
||||||
uses: sigstore/cosign-installer@main
|
uses: sigstore/cosign-installer@v3
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
- name: Set up Docker Buildx
|
||||||
uses: docker/setup-buildx-action@v2
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
- name: Login to registry
|
- name: Login to registry
|
||||||
if: github.event_name != 'pull_request'
|
if: github.event_name != 'pull_request'
|
||||||
uses: docker/login-action@v2
|
uses: docker/login-action@v3
|
||||||
with:
|
with:
|
||||||
registry: ${{ env.REGISTRY }}
|
registry: ${{ env.REGISTRY }}
|
||||||
username: ${{ github.repository_owner }}
|
username: ${{ github.repository_owner }}
|
||||||
@ -46,7 +46,7 @@ jobs:
|
|||||||
|
|
||||||
- name: Set Docker metadata
|
- name: Set Docker metadata
|
||||||
id: meta
|
id: meta
|
||||||
uses: docker/metadata-action@v4
|
uses: docker/metadata-action@v5
|
||||||
with:
|
with:
|
||||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||||
tags: |
|
tags: |
|
||||||
@ -54,7 +54,7 @@ jobs:
|
|||||||
|
|
||||||
- name: Build and push Docker image
|
- name: Build and push Docker image
|
||||||
id: build-and-push
|
id: build-and-push
|
||||||
uses: docker/build-push-action@v3
|
uses: docker/build-push-action@v5
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
push: ${{ github.event_name != 'pull_request' }}
|
push: ${{ github.event_name != 'pull_request' }}
|
||||||
@ -65,5 +65,24 @@ jobs:
|
|||||||
if: ${{ github.event_name != 'pull_request' }}
|
if: ${{ github.event_name != 'pull_request' }}
|
||||||
run: cosign sign ${TAGS} -y
|
run: cosign sign ${TAGS} -y
|
||||||
env:
|
env:
|
||||||
COSIGN_EXPERIMENTAL: "true"
|
|
||||||
TAGS: ${{ steps.meta.outputs.tags }}
|
TAGS: ${{ steps.meta.outputs.tags }}
|
||||||
|
|
||||||
|
scan:
|
||||||
|
name: Scan current image & report results
|
||||||
|
needs: build
|
||||||
|
runs-on: "ubuntu-latest"
|
||||||
|
steps:
|
||||||
|
- name: Run Trivy vulnerability scanner
|
||||||
|
uses: aquasecurity/trivy-action@master
|
||||||
|
with:
|
||||||
|
image-ref: 'ghcr.io/tommytran732/matrix.to'
|
||||||
|
format: 'template'
|
||||||
|
template: '@/contrib/sarif.tpl'
|
||||||
|
output: 'trivy-results.sarif'
|
||||||
|
severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
|
||||||
|
vuln-type: "os,library"
|
||||||
|
|
||||||
|
- name: Upload Trivy scan results to GitHub Security tab
|
||||||
|
uses: github/codeql-action/upload-sarif@v3
|
||||||
|
with:
|
||||||
|
sarif_file: 'trivy-results.sarif'
|
27
.github/workflows/scan.yml
vendored
Normal file
27
.github/workflows/scan.yml
vendored
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
name: Scan
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
schedule:
|
||||||
|
# Scan the image regularly (once a day)
|
||||||
|
- cron: '0 23 * * *'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
scan:
|
||||||
|
name: Scan current image & report results
|
||||||
|
runs-on: "ubuntu-latest"
|
||||||
|
steps:
|
||||||
|
- name: Run Trivy vulnerability scanner
|
||||||
|
uses: aquasecurity/trivy-action@master
|
||||||
|
with:
|
||||||
|
image-ref: 'ghcr.io/tommytran732/matrix.to'
|
||||||
|
format: 'template'
|
||||||
|
template: '@/contrib/sarif.tpl'
|
||||||
|
output: 'trivy-results.sarif'
|
||||||
|
severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
|
||||||
|
vuln-type: "os,library"
|
||||||
|
|
||||||
|
- name: Upload Trivy scan results to GitHub Security tab
|
||||||
|
uses: github/codeql-action/upload-sarif@v3
|
||||||
|
with:
|
||||||
|
sarif_file: 'trivy-results.sarif'
|
36
Dockerfile
36
Dockerfile
@ -1,3 +1,25 @@
|
|||||||
|
ARG HARDENED_MALLOC_VERSION=2024052100
|
||||||
|
|
||||||
|
### Build Hardened Malloc
|
||||||
|
FROM alpine:latest as hmalloc-builder
|
||||||
|
|
||||||
|
ARG HARDENED_MALLOC_VERSION
|
||||||
|
ARG CONFIG_NATIVE=false
|
||||||
|
ARG VARIANT=default
|
||||||
|
|
||||||
|
RUN apk -U upgrade \
|
||||||
|
&& apk --no-cache add build-base git gnupg openssh-keygen
|
||||||
|
|
||||||
|
RUN cd /tmp \
|
||||||
|
&& git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
|
||||||
|
&& cd hardened_malloc \
|
||||||
|
&& wget -q https://grapheneos.org/allowed_signers -O grapheneos_allowed_signers \
|
||||||
|
&& git config gpg.ssh.allowedSignersFile grapheneos_allowed_signers \
|
||||||
|
&& git verify-tag $(git describe --tags) \
|
||||||
|
&& make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
|
||||||
|
|
||||||
|
### Build Production
|
||||||
|
|
||||||
FROM node:alpine
|
FROM node:alpine
|
||||||
|
|
||||||
LABEL maintainer="Thien Tran contact@tommytran.io"
|
LABEL maintainer="Thien Tran contact@tommytran.io"
|
||||||
@ -6,8 +28,8 @@ ARG UID=992
|
|||||||
ARG GID=992
|
ARG GID=992
|
||||||
|
|
||||||
RUN apk -U upgrade \
|
RUN apk -U upgrade \
|
||||||
&& apk --no-cache add git \
|
&& apk --no-cache add git \
|
||||||
&& adduser -g ${GID} -u ${UID} --disabled-password --gecos "" matrix-to
|
&& adduser -g ${GID} -u ${UID} --disabled-password --gecos "" matrix-to
|
||||||
|
|
||||||
USER matrix-to
|
USER matrix-to
|
||||||
|
|
||||||
@ -20,9 +42,13 @@ COPY element.patch /home/matrix-to/matrix.to
|
|||||||
WORKDIR /home/matrix-to/matrix.to
|
WORKDIR /home/matrix-to/matrix.to
|
||||||
|
|
||||||
RUN git apply /home/matrix-to/matrix.to/element.patch \
|
RUN git apply /home/matrix-to/matrix.to/element.patch \
|
||||||
&& rm -rf .git \
|
&& rm -rf .git \
|
||||||
&& yarn \
|
&& yarn \
|
||||||
&& yarn build
|
&& yarn build
|
||||||
|
|
||||||
|
COPY --from=hmalloc-builder /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
|
||||||
|
|
||||||
|
ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
|
||||||
|
|
||||||
EXPOSE 5000
|
EXPOSE 5000
|
||||||
|
|
||||||
|
@ -1,5 +1,7 @@
|
|||||||
# Matrix.to-Docker
|
# Matrix.to-Docker
|
||||||
|
|
||||||
|
![Build, scan & push](https://github.com/tommytran732/Matrix.to-Docker/actions/workflows/build.yml/badge.svg)
|
||||||
|
|
||||||
Matrix.to is a simple url redirection service for the Matrix.org ecosystem which lets users share links to matrix entities without being tied to a specific app. Stylistically it serves as a landing page for rooms and communities.
|
Matrix.to is a simple url redirection service for the Matrix.org ecosystem which lets users share links to matrix entities without being tied to a specific app. Stylistically it serves as a landing page for rooms and communities.
|
||||||
|
|
||||||
This is my own Docker image building from [the official repository](https://github.com/matrix-org/matrix.to).
|
This is my own Docker image building from [the official repository](https://github.com/matrix-org/matrix.to).
|
||||||
@ -9,3 +11,4 @@ This is my own Docker image building from [the official repository](https://gith
|
|||||||
- Don't trust random images: build yourself if you can.
|
- Don't trust random images: build yourself if you can.
|
||||||
- Default Element instance is changed from [Element.io](https://app.element.io) to [ArcticFoxes.net](https://element.arcticfoxes.net)
|
- Default Element instance is changed from [Element.io](https://app.element.io) to [ArcticFoxes.net](https://element.arcticfoxes.net)
|
||||||
- The Dockerfile builds from the main branch, as releases do not come out frequently.
|
- The Dockerfile builds from the main branch, as releases do not come out frequently.
|
||||||
|
- The image comes with the [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) built from the latest tag.
|
||||||
|
Loading…
Reference in New Issue
Block a user