sneak/smallwebwaf
1
0
Fork 0
Code Issues 16 Pull Requests 4 Actions 8 Packages Projects Releases Wiki Activity
Files
2e05402fb4309778399a75e2496aa0453210465c
smallwebwaf/docs/image.md
T
sneak 2e05402fb4
check / check (push) Waiting to run
Details
Install the image's Ubuntu packages from the normal mirrors (closes #190) 
The final image stage now apt-gets ca-certificates, nix-bin and runit
from Ubuntu's archive, with no snapshot and no hash check of the package
lists. The borrowed CA bundle is dropped: apt fetches the packages over
plain HTTP and checks each one against the archive's signed package
lists, so the install needs none. The Ubuntu base image stays pinned by
digest, and every other pin is kept. README.md, SPEC.md and
docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
2026-11-06 18:13:57 +00:00

1.6 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or servewaf with SMALLWEBWAF_COMMAND=servewaf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu's archive.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
  • The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
  • /var/lib/smallwebwaf for servewaf's state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

  • Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds smallwebwaf: by digest.
Reference in New Issue View Git Blame Copy Permalink