smallwebwaf/docs/image.md

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or discriminator with SWW_COMMAND=discriminator. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

• Ubuntu 26.04 LTS, pinned by digest.
• ca-certificates, nix-bin and runit from Ubuntu's archive.
• Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
• runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
• The sww binary, and the user sww (uid and gid 65532).
• The service directory /etc/service/sww, with the run script share/sww.run.
• /var/lib/sww for discriminator's state files, and /etc/sww/rules.d with the default rule file share/rules.d/00-default.rules.
• EXPOSE 8080, and the HEALTHCHECK that runs sww healthcheck.

Pins

• Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
• nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
• runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
• The Go image that builds sww: by digest.