sneak/smallwebwaf
1
0
Fork 0
Code Issues 12 Pull Requests 3 Actions 11 Packages Projects Releases Wiki Activity
Files
a41d61e9adf0ba9743b33a002ebf68a922e1418c
smallwebwaf/docs/image.md
T
clawbot a41d61e9ad
check / check (push) Waiting to run
Details
Install the image's Ubuntu packages from the normal mirrors (closes #190) 
The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone.

Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
2026-11-06 19:15:28 +00:00

1.6 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or servewaf with SMALLWEBWAF_COMMAND=servewaf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu's archive.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
  • The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
  • /var/lib/smallwebwaf for servewaf's state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

  • Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds smallwebwaf: by digest.
Reference in New Issue View Git Blame Copy Permalink