Reorganize repository

Polarix-Containers · Sep 9, 2024 · aabb140 · aabb140
1 parent f3b8a1a
commit aabb140
Show file tree

Hide file tree

Showing 8 changed files with 60 additions and 26 deletions.
diff --git a/.github/workflows/build-slim.yml b/.github/workflows/build-slim.yml
@@ -5,9 +5,9 @@ on:
   push:
     branches:
       - slim
-    # Ignore Markdown files
-    paths-ignore:
-      - '**.md'
+    paths:
+      - '.github/workflows/build-slim.yml'
+      - 'mainline-slim/**'
   schedule:
     # Build the image daily
     - cron: '15 0 * * *'
@@ -57,7 +57,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@v6
         with:
-          context: .
+          context: mainline-slim
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -85,7 +85,7 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: trivy-results.sarif
-          category: trivy
+          category: trivy-slim
 
   grype:
     name: Scan current image with Grype
@@ -106,4 +106,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
-          category: grype
+          category: grype-slim
diff --git a/.github/workflows/build-unprivileged-slim.yml b/.github/workflows/build-unprivileged-slim.yml
@@ -4,10 +4,10 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - unprivileged-slim
-    # Ignore Markdown files
-    paths-ignore:
-      - '**.md'
+      - main
+    paths:
+      - '.github/workflows/build-unprivileged-slim.yml'
+      - 'mainline-unprivileged-slim/**'
   schedule:
     # Build the image daily
     - cron: '15 0 * * *'
@@ -57,7 +57,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@v6
         with:
-          context: .
+          context: mainline-unprivileged-slim
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -85,7 +85,7 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: trivy-results.sarif
-          category: trivy
+          category: trivy-unprivileged-slim
 
   grype:
     name: Scan current image with Grype
@@ -97,7 +97,7 @@ jobs:
     steps:
       - name: Run Grype vulnerability scanner
         uses: anchore/scan-action@v4
-        id: grype
+        id: grype-unprivileged-slim
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG }}
           fail-build: false
@@ -106,4 +106,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
-          category: grype
+          category: grype-unprivileged-slim
diff --git a/.github/workflows/build-unprivileged.yml b/.github/workflows/build-unprivileged.yml
@@ -4,10 +4,10 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - unprivileged
-    # Ignore Markdown files
-    paths-ignore:
-      - '**.md'
+      - main
+    paths:
+      - '.github/workflows/build-unprivileged.yml'
+      - 'mainline-unprivileged/**'
   schedule:
     # Build the image daily
     - cron: '15 0 * * *'
@@ -57,7 +57,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@v6
         with:
-          context: .
+          context: mainline-unprivileged
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -85,7 +85,7 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: trivy-results.sarif
-          category: trivy
+          category: trivy-unprivileged
 
   grype:
     name: Scan current image with Grype
@@ -97,7 +97,7 @@ jobs:
     steps:
       - name: Run Grype vulnerability scanner
         uses: anchore/scan-action@v4
-        id: grype
+        id: grype-unprivileged
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG }}
           fail-build: false
@@ -106,4 +106,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
-          category: grype
+          category: grype-unprivileged
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -5,9 +5,9 @@ on:
   push:
     branches:
       - main
-    # Ignore Markdown files
-    paths-ignore:
-      - '**.md'
+    paths:
+      - '.github/workflows/build.yml'
+      - 'mainline/**'
   schedule:
     # Build the image daily
     - cron: '15 0 * * *'
@@ -57,7 +57,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@v6
         with:
-          context: .
+          context: mainline
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

diff --git a/mainline-slim/Dockerfile b/mainline-slim/Dockerfile
@@ -0,0 +1,10 @@
+FROM nginx:mainline-alpine-slim
+
+LABEL maintainer="Thien Tran [email protected]"
+
+RUN apk -U upgrade \
+    && apk add libstdc++ \
+    && rm -rf /var/cache/apk/*
+
+COPY --from=ghcr.io/polarix-containers/hardened_malloc:latest /install /usr/local/lib/
+ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
diff --git a/mainline-unprivileged-slim/Dockerfile b/mainline-unprivileged-slim/Dockerfile
@@ -0,0 +1,14 @@
+FROM ghcr.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
+
+LABEL maintainer="Thien Tran [email protected]"
+
+USER root
+
+RUN apk -U upgrade \
+    && apk add libstdc++ \
+    && rm -rf /var/cache/apk/*
+
+COPY --from=ghcr.io/polarix-containers/hardened_malloc:latest /install /usr/local/lib/
+ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
+
+USER $UID
diff --git a/mainline-unprivileged/Dockerfile b/mainline-unprivileged/Dockerfile
@@ -0,0 +1,10 @@
+FROM nginx:mainline-alpine
+
+LABEL maintainer="Thien Tran [email protected]"
+
+RUN apk -U upgrade \
+    && apk add libstdc++ \
+    && rm -rf /var/cache/apk/*
+
+COPY --from=ghcr.io/polarix-containers/hardened_malloc:latest /install /usr/local/lib/
+ENV LD_PRELOAD="/usr/local/lib/libhardened_malloc.so"
diff --git a/Dockerfile → mainline/Dockerfile b/Dockerfile → mainline/Dockerfile