sneak/smallwebwaf
1
0
Fork 0
Code Issues 5 Pull Requests 1 Actions 14 Packages Projects Releases Wiki Activity
Files
a62909dbf4db9ca8dafbf5636ede4dfee9f73777
smallwebwaf/docs/image.md
T
sneak 23908b0e33
check / check (push) Waiting to run
Details
SPEC: false statements fixed, repeats removed, dropped requirements restored 
The bounds sentence, the blocklist URL sentence, the deny list sentence,
the limit action's scope and the observe mode sentence now say what the
code does. Each of the twenty-one requirements the fourth review found
twice is stated once, with a link from the other place. The request id
header, redirect_uri's case, change 4's reason and the live archive's
InRelease files are back. The biased thresholds are defined where they
are introduced. The docs files apply the fifth README review's findings
and stay identical to the README branch.

Model: fable-5-1
2026-10-22 22:35:29 +00:00

1.8 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu, from the snapshot of its archive at 20261001T000000Z.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
  • The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
  • /var/lib/smallwebwaf for the state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

  • Ubuntu's packages: the snapshot service, --snapshot 20261001T000000Z on both apt-get update and apt-get install. The SHA-256 hash of each of the snapshot's InRelease files is named in the Dockerfile and checked after apt-get update. The hashes are the amd64 archive's.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds smallwebwaf: by digest.
Reference in New Issue View Git Blame Copy Permalink