clawbot
a41d61e9ad
check / check (push) Waiting to run
The image's `ca-certificates`, `nix-bin` and `runit` now come from Ubuntu's archive instead of a dated snapshot, whose service had failed image builds. apt fetches them over plain HTTP and checks each against the archive's signed package lists, so no CA certificates are borrowed from the Go image. The README, `SPEC.md` and `docs/image.md` say so; the amd64-only limit, which came from the removed hash check, is gone. Rule cut against: `REPO_POLICIES.md` pins every external reference by hash; sneak's ruling at sneak/prompts#72 (comment) allows Ubuntu's own package index. Model: deepseek-v4-pro (implementation), opus-5-5 (rework)
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned. The image
|
|
runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
|
|
"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
|
|
is pinned that way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu's archive.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
|
|
- The service directory `/etc/service/smallwebwaf`, with the `run` script
|
|
`share/smallwebwaf.run`.
|
|
- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
|
|
`/etc/smallwebwaf/rules.d` with the default rule file
|
|
`share/rules.d/00-default.rules`.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages are not pinned: they come from the live archive, whose
|
|
packages change with every update.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at its last commit
|
|
(`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
|
|
build writes.
|
|
- The Go image that builds `smallwebwaf`: by digest.
|