diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index ad4751fc..b14337db 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -15,8 +15,8 @@ jobs: with: fetch-depth: 0 - - name: Generate Docker tag - id: docker_tag + - name: Generate Alpine Docker tag + id: docker_alpine_tag run: | DOCKER_IMAGE=miniflux/miniflux DOCKER_VERSION=dev @@ -29,6 +29,20 @@ jobs: fi echo ::set-output name=tags::${TAGS} + - name: Generate Distroless Docker tag + id: docker_distroless_tag + run: | + DOCKER_IMAGE=miniflux/miniflux + DOCKER_VERSION=dev-distroless + if [ "${{ github.event_name }}" = "schedule" ]; then + DOCKER_VERSION=nightly-distroless + TAGS="${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION}" + elif [[ $GITHUB_REF == refs/tags/* ]]; then + DOCKER_VERSION=${GITHUB_REF#refs/tags/}-distroless + TAGS="${DOCKER_IMAGE}:${DOCKER_VERSION},ghcr.io/${DOCKER_IMAGE}:${DOCKER_VERSION},${DOCKER_IMAGE}:latest-distroless,ghcr.io/${DOCKER_IMAGE}:latest-distroless" + fi + echo ::set-output name=tags::${TAGS} + - name: Set up QEMU uses: docker/setup-qemu-action@v1 @@ -48,11 +62,20 @@ jobs: username: ${{ github.repository_owner }} password: ${{ secrets.CR_PAT }} - - name: Build and push + - name: Build and Push Alpine images uses: docker/build-push-action@v2 with: context: . - file: ./packaging/docker/Dockerfile + file: ./packaging/docker/alpine/Dockerfile platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64 push: true - tags: ${{ steps.docker_tag.outputs.tags }} + tags: ${{ steps.docker_alpine_tag.outputs.tags }} + + - name: Build and Push Distroless images + uses: docker/build-push-action@v2 + with: + context: . + file: ./packaging/docker/distroless/Dockerfile + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ steps.docker_distroless_tag.outputs.tags }} diff --git a/Makefile b/Makefile index ba9c9344..6a2df526 100644 --- a/Makefile +++ b/Makefile @@ -36,6 +36,7 @@ export PGPASSWORD := postgres integration-test \ clean-integration-test \ docker-image \ + docker-image-distroless \ docker-images \ rpm \ debian \ @@ -130,12 +131,15 @@ clean-integration-test: @ psql -U postgres -c 'drop database if exists miniflux_test;' docker-image: - docker build -t $(DOCKER_IMAGE):$(VERSION) -f packaging/docker/Dockerfile . + docker build -t $(DOCKER_IMAGE):$(VERSION) -f packaging/docker/alpine/Dockerfile . + +docker-image-distroless: + docker build -t $(DOCKER_IMAGE):$(VERSION) -f packaging/docker/distroless/Dockerfile . docker-images: docker buildx build \ --platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \ - --file packaging/docker/Dockerfile \ + --file packaging/docker/alpine/Dockerfile \ --tag $(DOCKER_IMAGE):$(VERSION) \ --push . diff --git a/packaging/docker/Dockerfile b/packaging/docker/alpine/Dockerfile similarity index 98% rename from packaging/docker/Dockerfile rename to packaging/docker/alpine/Dockerfile index 040b085b..fdb9c9c6 100644 --- a/packaging/docker/Dockerfile +++ b/packaging/docker/alpine/Dockerfile @@ -2,7 +2,6 @@ FROM golang:alpine AS build RUN apk add --no-cache --update git ADD . /go/src/app WORKDIR /go/src/app -RUN go generate RUN go build \ -o miniflux \ -ldflags="-s -w -X 'miniflux.app/version.Version=`git describe --tags --abbrev=0`' -X 'miniflux.app/version.Commit=`git rev-parse --short HEAD`' -X 'miniflux.app/version.BuildDate=`date +%FT%T%z`'" \ diff --git a/packaging/docker/distroless/Dockerfile b/packaging/docker/distroless/Dockerfile new file mode 100644 index 00000000..9e28b0df --- /dev/null +++ b/packaging/docker/distroless/Dockerfile @@ -0,0 +1,23 @@ +FROM golang:latest AS build +ADD . /go/src/app +WORKDIR /go/src/app +RUN go build \ + -o miniflux \ + -ldflags="-s -w -X 'miniflux.app/version.Version=`git describe --tags --abbrev=0`' -X 'miniflux.app/version.Commit=`git rev-parse --short HEAD`' -X 'miniflux.app/version.BuildDate=`date +%FT%T%z`'" \ + main.go + +FROM gcr.io/distroless/base + +LABEL org.opencontainers.image.title=Miniflux +LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader" +LABEL org.opencontainers.image.vendor="Frédéric Guillot" +LABEL org.opencontainers.image.licenses=Apache-2.0 +LABEL org.opencontainers.image.url=https://miniflux.app +LABEL org.opencontainers.image.source=https://github.com/miniflux/v2 +LABEL org.opencontainers.image.documentation=https://miniflux.app/docs/ + +EXPOSE 8080 +ENV LISTEN_ADDR 0.0.0.0:8080 +COPY --from=build /go/src/app/miniflux /usr/bin/miniflux +USER nonroot:nonroot +CMD ["/usr/bin/miniflux"]