sneak/smallwebwaf
1
0
Fork 0
Code Issues 10 Pull Requests 3 Actions Packages Projects Releases Wiki Activity
Files
3c354d57699a73407cd1b984a4fd5d0c28901a1f
smallwebwaf/docs/image.md
T
clawbot 344ce13c96
check / check (push) Failing after 14m44s
Details
rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165) 
`smallwebwaf` with no command now prints the commands and exits with status 2.
The image runs rproxy, or servewaf with SMALLWEBWAF_COMMAND=servewaf. The
passing-on code, its settings and its log fields and metric go. internal/proxy
keeps the checks, answers, reports and own endpoints; its tests run through the
real rproxy. The documents describe the pair.

Judgement call: clients.json keeps token_refused, since state files refuse unknown fields.
Deviation: script/gitea-requests sets SWWAF_LOG_REQUEST_HEADERS, to label requests.
Partially verified: make example-app and make gitea-requests never built the image, as Ubuntu's snapshot service answered 5xx.

Model: opus-5-5
2026-11-05 13:15:05 +01:00

1.8 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or servewaf with SMALLWEBWAF_COMMAND=servewaf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu, from the snapshot of its archive at 20261001T000000Z.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
  • The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
  • /var/lib/smallwebwaf for servewaf's state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

  • Ubuntu's packages: the snapshot service, --snapshot 20261001T000000Z on both apt-get update and apt-get install. The SHA-256 hash of each of the snapshot's InRelease files is named in the Dockerfile and checked after apt-get update. The hashes are the amd64 archive's.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds smallwebwaf: by digest.
Reference in New Issue View Git Blame Copy Permalink