clawbot
697c2225d9
check / check (push) Waiting to run
Before `waf` starts, the image's `run` script now makes `SWW_STATE_DIR` if it is missing (`mkdir -p`), gives it to `sww:sww` and sets its mode to `0700`, as it already does for the cache directory's owner. A value that is not an absolute path, or an unreadable `SWW_STATE_DIR_FILE`, still changes nothing, and `waf` stops naming the setting. The `Dockerfile` comment, `docs/image.md`, `docs/settings.md` and `SPEC.md` say the image makes the directory. `script/example-app` checks that a missing `SWW_STATE_DIR` is made, owned by `sww` with mode `0700`. - `chmod 0700` also applies to an existing directory, a mounted volume included, at every start of `waf`. Model: opus-5-5
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned. The image
|
|
runs `rproxy` by default, or `waf` with `SWW_COMMAND=waf`. "Deployment" in
|
|
[`SPEC.md`](../SPEC.md) says why each part is there and why it is pinned that
|
|
way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `sww` binary, and the user `sww` (uid and gid 65532).
|
|
- The service directory `/etc/service/sww`, with the `run` script
|
|
`share/sww.run`.
|
|
- `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
|
|
default rule file `share/rules.d/00-default.rules`. The `run` script makes
|
|
`SWW_STATE_DIR` when it is missing.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages are not pinned: they come from the live archive, whose
|
|
packages change with every update.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at its last commit
|
|
(`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
|
|
build writes.
|
|
- The Go image that builds `sww`: by digest.
|