mirror of
https://github.com/tommytran732/Matrix.to-Docker
synced 2024-11-09 12:41:34 -05:00
Compare commits
6 Commits
fb7ad7854d
...
e9ec74f560
Author | SHA1 | Date | |
---|---|---|---|
e9ec74f560 | |||
b4e847e1f3 | |||
fc7a19b977 | |||
13cc98f1c7 | |||
ffd6a10253 | |||
37eb92672d |
33
.github/workflows/build.yml
vendored
33
.github/workflows/build.yml
vendored
@ -27,18 +27,18 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install cosign
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: sigstore/cosign-installer@main
|
||||
uses: sigstore/cosign-installer@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Login to registry
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v2
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.repository_owner }}
|
||||
@ -46,7 +46,7 @@ jobs:
|
||||
|
||||
- name: Set Docker metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v4
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
@ -54,7 +54,7 @@ jobs:
|
||||
|
||||
- name: Build and push Docker image
|
||||
id: build-and-push
|
||||
uses: docker/build-push-action@v3
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: ${{ github.event_name != 'pull_request' }}
|
||||
@ -65,5 +65,24 @@ jobs:
|
||||
if: ${{ github.event_name != 'pull_request' }}
|
||||
run: cosign sign ${TAGS} -y
|
||||
env:
|
||||
COSIGN_EXPERIMENTAL: "true"
|
||||
TAGS: ${{ steps.meta.outputs.tags }}
|
||||
|
||||
scan:
|
||||
name: Scan current image & report results
|
||||
needs: build
|
||||
runs-on: "ubuntu-latest"
|
||||
steps:
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'ghcr.io/tommytran732/matrix.to'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
|
||||
vuln-type: "os,library"
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
27
.github/workflows/scan.yml
vendored
Normal file
27
.github/workflows/scan.yml
vendored
Normal file
@ -0,0 +1,27 @@
|
||||
name: Scan
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
# Scan the image regularly (once a day)
|
||||
- cron: '0 23 * * *'
|
||||
|
||||
jobs:
|
||||
scan:
|
||||
name: Scan current image & report results
|
||||
runs-on: "ubuntu-latest"
|
||||
steps:
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'ghcr.io/tommytran732/matrix.to'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
|
||||
vuln-type: "os,library"
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
26
Dockerfile
26
Dockerfile
@ -1,3 +1,25 @@
|
||||
ARG HARDENED_MALLOC_VERSION=2024052100
|
||||
|
||||
### Build Hardened Malloc
|
||||
FROM alpine:latest as hmalloc-builder
|
||||
|
||||
ARG HARDENED_MALLOC_VERSION
|
||||
ARG CONFIG_NATIVE=false
|
||||
ARG VARIANT=default
|
||||
|
||||
RUN apk -U upgrade \
|
||||
&& apk --no-cache add build-base git gnupg openssh-keygen
|
||||
|
||||
RUN cd /tmp \
|
||||
&& git clone --depth 1 --branch ${HARDENED_MALLOC_VERSION} https://github.com/GrapheneOS/hardened_malloc \
|
||||
&& cd hardened_malloc \
|
||||
&& wget -q https://grapheneos.org/allowed_signers -O grapheneos_allowed_signers \
|
||||
&& git config gpg.ssh.allowedSignersFile grapheneos_allowed_signers \
|
||||
&& git verify-tag $(git describe --tags) \
|
||||
&& make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}
|
||||
|
||||
### Build Production
|
||||
|
||||
FROM node:alpine
|
||||
|
||||
LABEL maintainer="Thien Tran contact@tommytran.io"
|
||||
@ -24,6 +46,10 @@ RUN git apply /home/matrix-to/matrix.to/element.patch \
|
||||
&& yarn \
|
||||
&& yarn build
|
||||
|
||||
COPY --from=hmalloc-builder /tmp/hardened_malloc/out/libhardened_malloc.so /usr/local/lib/
|
||||
|
||||
ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
|
||||
|
||||
EXPOSE 5000
|
||||
|
||||
ENTRYPOINT ["yarn", "start"]
|
||||
|
@ -1,5 +1,7 @@
|
||||
# Matrix.to-Docker
|
||||
|
||||
![Build, scan & push](https://github.com/tommytran732/Matrix.to-Docker/actions/workflows/build.yml/badge.svg)
|
||||
|
||||
Matrix.to is a simple url redirection service for the Matrix.org ecosystem which lets users share links to matrix entities without being tied to a specific app. Stylistically it serves as a landing page for rooms and communities.
|
||||
|
||||
This is my own Docker image building from [the official repository](https://github.com/matrix-org/matrix.to).
|
||||
@ -9,3 +11,4 @@ This is my own Docker image building from [the official repository](https://gith
|
||||
- Don't trust random images: build yourself if you can.
|
||||
- Default Element instance is changed from [Element.io](https://app.element.io) to [ArcticFoxes.net](https://element.arcticfoxes.net)
|
||||
- The Dockerfile builds from the main branch, as releases do not come out frequently.
|
||||
- The image comes with the [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc) built from the latest tag.
|
||||
|
Loading…
Reference in New Issue
Block a user