56 lines
2.4 KiB
Text
56 lines
2.4 KiB
Text
# Runtime image for zddc-server.
|
|
#
|
|
# Bundles the conversion toolchain (pandoc + chromium + bubblewrap)
|
|
# AND two wrapper scripts that shadow the real binaries on PATH.
|
|
# When zddc-server exec's "pandoc" or "chromium-browser", it hits
|
|
# /usr/local/bin/pandoc (a symlink to runtime/zddc-sandbox-exec),
|
|
# which:
|
|
#
|
|
# 1. creates a transient cgroup v2 with memory + pids caps,
|
|
# 2. drops the process into that cgroup,
|
|
# 3. wraps the real binary in a bubblewrap sandbox (private
|
|
# namespaces, read-only /usr, fresh tmpfs at /tmp, no network),
|
|
# 4. exec's /usr/bin/<name>.
|
|
#
|
|
# zddc-server's Go code is unaware of any of this — its only contract
|
|
# is "if I exec pandoc with these args, I get pandoc behavior." The
|
|
# isolation strategy lives entirely in the image; an operator who
|
|
# wants firejail / systemd-nspawn / podman-run instead just replaces
|
|
# the wrapper script and the binary code keeps working.
|
|
#
|
|
# Used by helm charts (helm/zddc-server-prod/) as the main-container
|
|
# image. The binary is built by the chart's init container from a
|
|
# pinned git ref and copied into a shared emptyDir; the chart's
|
|
# command is /usr/local/libexec/zddc-cgroup-init /zddc/zddc-server,
|
|
# so the cgroup v2 hierarchy is delegated before zddc-server starts
|
|
# (see runtime/zddc-cgroup-init for the "no internal processes"
|
|
# constraint that requires this indirection).
|
|
#
|
|
# Build:
|
|
# podman build -t zddc-server-runtime:latest \
|
|
# -f zddc/runtime.Containerfile zddc/
|
|
#
|
|
# Publish (example):
|
|
# podman tag zddc-server-runtime:latest \
|
|
# codeberg.org/varasys/zddc-server-runtime:vYYYYMMDD
|
|
# podman push codeberg.org/varasys/zddc-server-runtime:vYYYYMMDD
|
|
#
|
|
# Size: ≈ 1 GB unpacked (chromium dominates).
|
|
FROM docker.io/library/alpine:3
|
|
|
|
RUN apk add --no-cache \
|
|
bubblewrap \
|
|
pandoc-cli \
|
|
chromium \
|
|
font-noto \
|
|
ca-certificates
|
|
|
|
# Wrapper scripts. zddc-cgroup-init runs at container start to
|
|
# prepare cgroup v2 subtree_control delegation; zddc-sandbox-exec
|
|
# is invoked per-conversion via the symlinks below.
|
|
COPY runtime/zddc-cgroup-init /usr/local/libexec/zddc-cgroup-init
|
|
COPY runtime/zddc-sandbox-exec /usr/local/libexec/zddc-sandbox-exec
|
|
RUN chmod 0755 /usr/local/libexec/zddc-cgroup-init \
|
|
/usr/local/libexec/zddc-sandbox-exec \
|
|
&& ln -s /usr/local/libexec/zddc-sandbox-exec /usr/local/bin/pandoc \
|
|
&& ln -s /usr/local/libexec/zddc-sandbox-exec /usr/local/bin/chromium-browser
|