feat: initial commit

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Generate Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/bake-action@v4
+        env:
+          REGISTRY: ghcr.io/${{ github.repository }}
+        with:
+          files: |
+            ./docker-bake.hcl
+            ${{ steps.meta.outputs.bake-file-labels }}
+          push: true

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Pascal Mathis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1 @@
+# SnapServ Container Images

base-ubuntu/Dockerfile

@@ -0,0 +1,37 @@
+FROM public.ecr.aws/ubuntu/ubuntu:22.04
+ARG S6_OVERLAY_VERSION="3.1.6.2"
+ENV DEBIAN_FRONTEND="noninteractive"
+
+RUN true \
+    && apt-get update -y \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        gnupg \
+        lsb-release \
+        xz-utils \
+    && rm -rf /var/lib/apt/lists/* \
+    && true
+
+RUN true \
+    && curl -sSLfo /tmp/s6-overlay-noarch.tar.xz "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz" \
+    && curl -sSLfo /tmp/s6-overlay-arch.tar.xz "https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-$(arch).tar.xz" \
+    && tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \
+    && tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz \
+    && rm -f /tmp/s6-overlay-noarch.tar.xz /tmp/s6-overlay-arch.tar.xz \
+    && true
+
+COPY rootfs/ /
+
+RUN true \
+    && groupadd -g 10000 app \
+    && useradd -u 10000 -g app -d /home/app -s /bin/false app \
+    && chmod +x /usr/local/bin/add-ppa-repo \
+    && true
+
+ENV S6_BEHAVIOUR_IF_STAGE2_FAILS="2"
+ENV S6_LOGGING="0"
+ENV S6_VERBOSITY="1"
+
+ENTRYPOINT [ "/init" ]

base-ubuntu/rootfs/usr/local/bin/add-ppa-repo

@@ -0,0 +1,9 @@
+#!/bin/bash
+readonly PPA_NAME="${1}"
+readonly PPA_KEY="${2}"
+readonly PPA_LIST_FILE="/etc/apt/sources.list.d/${PPA_NAME//\//-}.list"
+
+echo "deb https://ppa.launchpadcontent.net/${PPA_NAME}/ubuntu $(lsb_release -sc) main" >"${PPA_LIST_FILE}"
+echo "deb-src https://ppa.launchpadcontent.net/${PPA_NAME}/ubuntu $(lsb_release -sc) main" >>"${PPA_LIST_FILE}"
+cat "${PPA_LIST_FILE}"
+apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "${PPA_KEY}"

dev.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'
+
+SCRIPT_PATH="$(cd "$(dirname "$0")" &>/dev/null; pwd -P)"
+declare -r SCRIPT_PATH
+declare -r IMAGE_REGISTRY="${IMAGE_PREFIX:-localhost/snapserv/container}"
+declare -r IMAGE_ARCH="${IMAGE_ARCH:-linux/arm64}"
+
+main() {
+    # Change to script directory
+    cd "${SCRIPT_PATH}"
+
+    # Build container images
+    export REGISTRY="${IMAGE_REGISTRY}"
+    docker buildx bake --load --set="*.platform=${IMAGE_ARCH}"
+    docker image ls | grep "${IMAGE_REGISTRY}/"
+
+    # If an argument was specified, run the image
+    if [[ $# -gt 0 ]]; then
+        local -r image="$1"; shift
+        docker run \
+            --interactive --rm --tty \
+            --platform "${IMAGE_ARCH}" \
+            --read-only \
+            --tmpfs /run:exec \
+            --tmpfs /tmp \
+            -e "S6_KILL_GRACETIME=0" \
+            -e "S6_READ_ONLY_ROOT=1" \
+            -p 8080:8080 \
+            "${IMAGE_REGISTRY}/${image}:latest" "$@"
+    fi
+}
+
+main "$@"

docker-bake.hcl

@@ -0,0 +1,43 @@
+variable "REGISTRY" {
+    default = "localhost/snapserv/container"
+}
+
+group "default" {
+    targets = [
+        "base-ubuntu",
+        "nginx",
+    ]
+}
+
+target "docker-metadata-action" {}
+
+target "template-base" {
+    inherits = ["docker-metadata-action"]
+    dockerfile = "Dockerfile"
+    platforms = [
+        "linux/amd64",
+        "linux/arm64",
+    ]
+}
+
+target "template" {
+    inherits = ["template-base"]
+    contexts = {
+        "base-ubuntu" = "target:base-ubuntu"
+    }
+}
+
+target "base-ubuntu" {
+    inherits = ["template-base"]
+    context = "./base-ubuntu/"
+    tags = [
+        "${REGISTRY}/base-ubuntu:latest",
+        "${REGISTRY}/base-ubuntu:22.04",
+    ]
+}
+
+target "nginx" {
+    inherits = ["template"]
+    context = "./nginx/"
+    tags = ["${REGISTRY}/nginx:latest"]
+}

nginx/Dockerfile

@@ -0,0 +1,29 @@
+FROM base-ubuntu
+
+RUN true \
+    && add-ppa-repo ondrej/nginx-mainline 14AA40EC0831756756D7F66C4F4EA0AAE5267A6C \
+    && apt-get update -y \
+    && apt-get install -y --no-install-recommends \
+        nginx \
+    && rm -rf /var/lib/apt/lists/* \
+    && true
+
+RUN true \
+    && install -d -o app -g app -m 0755 /var/tmp/nginx \
+    && find /etc/nginx -mindepth 1 -not \( \
+            -name 'mime.types' -o \
+            -name 'modules-available' -o \
+            -name 'modules-enabled' \
+        \) -exec rm -rf {} + \
+    && install -d -o root -g root -m 0755 \
+        /etc/nginx/conf.d \
+        /etc/nginx/vhost.d \
+    && true
+
+COPY rootfs/ /
+
+USER app
+EXPOSE 8080/tcp
+VOLUME [ "/var/tmp/nginx" ]
+
+CMD [ "/usr/sbin/nginx", "-e", "stderr", "-g", "daemon off;" ]

nginx/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,28 @@
+worker_processes auto;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    sendfile on;
+    tcp_nopush on;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    access_log /dev/stdout;
+    gzip on;
+
+    client_body_temp_path /var/tmp/nginx/client-body;
+    fastcgi_temp_path /var/tmp/nginx/fastcgi-temp;
+    proxy_temp_path /var/tmp/nginx/proxy-temp;
+    scgi_temp_path /var/tmp/nginx/scgi-temp;
+    uwsgi_temp_path /var/tmp/nginx/uwsgi-temp;
+
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/vhost.conf;
+}

nginx/rootfs/etc/nginx/vhost.conf

@@ -0,0 +1,22 @@
+server {
+    listen 8080 default_server;
+    listen [::]:8080 default_server;
+    server_name _;
+
+    root /var/www/html;
+    index index.html index.htm;
+    charset utf-8;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt { access_log off; log_not_found off; }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+
+    include /etc/nginx/vhost.d/*.conf;
+}

nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx-prepare/type

@@ -0,0 +1 @@
+oneshot

nginx/rootfs/etc/s6-overlay/s6-rc.d/nginx-prepare/up

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+elglob -0 FILES /var/tmp/nginx/*
+rm -rf -- $(FILES)