sneak
23908b0e33
check / check (push) Waiting to run
The bounds sentence, the blocklist URL sentence, the deny list sentence, the limit action's scope and the observe mode sentence now say what the code does. Each of the twenty-one requirements the fourth review found twice is stated once, with a link from the other place. The request id header, redirect_uri's case, change 4's reason and the live archive's InRelease files are back. The biased thresholds are defined where they are introduced. The docs files apply the fifth README review's findings and stay identical to the README branch. Model: fable-5-1
38 lines
1.8 KiB
Markdown
38 lines
1.8 KiB
Markdown
# What the image holds
|
|
|
|
The contents of the `smallwebwaf` image, and how each part is pinned.
|
|
"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
|
|
is pinned that way.
|
|
|
|
## Contents
|
|
|
|
- Ubuntu 26.04 LTS, pinned by digest.
|
|
- `ca-certificates`, `nix-bin` and `runit` from Ubuntu, from the snapshot of its
|
|
archive at `20261001T000000Z`.
|
|
- Nix, with nixpkgs `nixos-26.05.11045.774debe7a0d1` set up for root as
|
|
`nixpkgs`. No Nix daemon; `build-users-group =` in `/etc/nix/nix.conf`. Root's
|
|
Nix profile, `/nix/var/nix/profiles/default/bin`, last on the `PATH`.
|
|
Unpacked, nixpkgs takes about 500 MiB.
|
|
- `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
|
|
at a fixed commit hash.
|
|
- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
|
|
- The service directory `/etc/service/smallwebwaf`, with the `run` script
|
|
`share/smallwebwaf.run`.
|
|
- `/var/lib/smallwebwaf` for the state files, and `/etc/smallwebwaf/rules.d`
|
|
with the default rule file `share/rules.d/00-default.rules`.
|
|
- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
|
|
|
|
## Pins
|
|
|
|
- Ubuntu's packages: the snapshot service, `--snapshot 20261001T000000Z` on both
|
|
`apt-get update` and `apt-get install`. The SHA-256 hash of each of the
|
|
snapshot's `InRelease` files is named in the `Dockerfile` and checked after
|
|
`apt-get update`. The hashes are the amd64 archive's.
|
|
- nixpkgs: the release file `nixexprs.tar.xz` of
|
|
`nixos-26.05.11045.774debe7a0d1` on `releases.nixos.org`, named with its
|
|
SHA-256 hash.
|
|
- `runsvinit`: the archived repository, unchanged since 2015, at its last commit
|
|
(`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
|
|
build writes.
|
|
- The Go image that builds `smallwebwaf`: by digest.
|