0 Fork 0

Files

T

check / check (push) Waiting to run

Details

The image creates SWW_STATE_DIR when it is missing (closes #337 )

Before `waf` starts, the image's `run` script now makes `SWW_STATE_DIR` if it is missing (`mkdir -p`), gives it to `sww:sww` and sets its mode to `0700`, as it already does for the cache directory's owner. A value that is not an absolute path, or an unreadable `SWW_STATE_DIR_FILE`, still changes nothing, and `waf` stops naming the setting. The `Dockerfile` comment, `docs/image.md`, `docs/settings.md` and `SPEC.md` say the image makes the directory. `script/example-app` checks that a missing `SWW_STATE_DIR` is made, owned by `sww` with mode `0700`.

- `chmod 0700` also applies to an existing directory, a mounted volume included, at every start of `waf`.

Model: opus-5-5

2026-11-11 11:33:08 +01:00

1.6 KiB

Raw Permalink Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or waf with SWW_COMMAND=waf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Ubuntu 26.04 LTS, pinned by digest.
ca-certificates, nix-bin and runit from Ubuntu's archive.
Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
The sww binary, and the user sww (uid and gid 65532).
The service directory /etc/service/sww, with the run script share/sww.run.
/var/lib/sww for waf's state files, and /etc/sww/rules.d with the default rule file share/rules.d/00-default.rules. The run script makes SWW_STATE_DIR when it is missing.
EXPOSE 8080, and the HEALTHCHECK that runs sww healthcheck.

Pins

Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
The Go image that builds sww: by digest.

1.6 KiB Raw Permalink Blame History

What the image holds

Contents

Pins

1.6 KiB

Raw Permalink Blame History