sneak/smallwebwaf
1
0
Fork 0
Code Issues 10 Pull Requests 3 Actions Packages Projects Releases Wiki Activity
Files
dfb29481600a7c9c56b2de45fd67b0ffdc6d8bd6
smallwebwaf/docs/image.md
T
sneak dfb2948160
check / check (push) Successful in 3m29s
Details
Install the image's Ubuntu packages from the normal mirrors (closes #190) 
The final image stage now apt-gets ca-certificates, nix-bin and runit
from the archive the image's own sources name, with no snapshot and no
hash check of the package lists. The borrowed CA bundle is dropped: the
archive is reached over plain HTTP, so the install needs none. The Ubuntu
base image stays pinned by digest, and every other pin is kept. SPEC.md
and docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro
2026-11-05 20:27:15 +00:00

1.7 KiB
Raw Blame History

What the image holds

The contents of the smallwebwaf image, and how each part is pinned. The image runs rproxy by default, or servewaf with SMALLWEBWAF_COMMAND=servewaf. "Deployment" in SPEC.md says why each part is there and why it is pinned that way.

Contents

  • Ubuntu 26.04 LTS, pinned by digest.
  • ca-certificates, nix-bin and runit from Ubuntu's normal mirrors, the live archive, not a dated snapshot.
  • Nix, with nixpkgs nixos-26.05.11045.774debe7a0d1 set up for root as nixpkgs. No Nix daemon; build-users-group = in /etc/nix/nix.conf. Root's Nix profile, /nix/var/nix/profiles/default/bin, last on the PATH. Unpacked, nixpkgs takes about 500 MiB.
  • runsvinit as the entrypoint, built from github.com/peterbourgon/runsvinit at a fixed commit hash.
  • The smallwebwaf binary, and the user smallwebwaf (uid and gid 65532).
  • The service directory /etc/service/smallwebwaf, with the run script share/smallwebwaf.run.
  • /var/lib/smallwebwaf for servewaf's state files, and /etc/smallwebwaf/rules.d with the default rule file share/rules.d/00-default.rules.
  • EXPOSE 8080, and the HEALTHCHECK that runs smallwebwaf healthcheck.

Pins

  • Ubuntu's packages are not pinned: they come from the live archive, whose packages change with every update.
  • nixpkgs: the release file nixexprs.tar.xz of nixos-26.05.11045.774debe7a0d1 on releases.nixos.org, named with its SHA-256 hash.
  • runsvinit: the archived repository, unchanged since 2015, at its last commit (b4b2c78, eight commits after v2.0.0), by commit hash, with a go.mod the build writes.
  • The Go image that builds smallwebwaf: by digest.
Reference in New Issue View Git Blame Copy Permalink