titan/soteria
3
0
Fork 0
Code Issues 85 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

ci: scope credential umask and preserve nonroot execution

Browse Source
This commit is contained in:
codex 2026-10-04 06:42:38 -05:00
parent e9f24b1053
commit 4743b678fc
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile.runtime
View File

@ -1,6 +1,6 @@
# Jenkins compiles on its scratch PVC; image assembly needs no toolchain layers. # Jenkins compiles on its scratch PVC; image assembly needs no toolchain layers.
FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
COPY soteria /soteria COPY --chown=65532:65532 soteria /soteria
USER 65532:65532 USER 65532:65532
EXPOSE 8080 EXPOSE 8080
ENTRYPOINT ["/soteria"] ENTRYPOINT ["/soteria"]

4
Jenkinsfile vendored
View File

@ -573,6 +573,7 @@ PY
mkdir -p build/image internal/server/ui-dist mkdir -p build/image internal/server/ui-dist
cp -R web/dist/. internal/server/ui-dist/ cp -R web/dist/. internal/server/ui-dist/
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -p 2 -buildvcs=false -trimpath -ldflags="-s -w" -o build/image/soteria ./cmd/soteria CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -p 2 -buildvcs=false -trimpath -ldflags="-s -w" -o build/image/soteria ./cmd/soteria
chmod 0755 build/image/soteria
cp Dockerfile.runtime build/image/Dockerfile cp Dockerfile.runtime build/image/Dockerfile
''' '''
} }
@ -589,9 +590,8 @@ PY
set -eu set -eu
set +x set +x
VERSION_TAG=$(cut -d= -f2 build.env) VERSION_TAG=$(cut -d= -f2 build.env)
umask 077
auth=$(printf '%s:%s' "${HARBOR_USERNAME}" "${HARBOR_PASSWORD}" | base64 | tr -d '\\n') auth=$(printf '%s:%s' "${HARBOR_USERNAME}" "${HARBOR_PASSWORD}" | base64 | tr -d '\\n')
printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\\n' "${auth}" > /kaniko/.docker/config.json (umask 077; printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\\n' "${auth}" > /kaniko/.docker/config.json)
trap 'rm -f /kaniko/.docker/config.json' EXIT trap 'rm -f /kaniko/.docker/config.json' EXIT
/kaniko/executor \ /kaniko/executor \
--context "${WORKSPACE}/build/image" \ --context "${WORKSPACE}/build/image" \