Nonroot image with bash

.github/dependabot.yaml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+    - package-ecosystem: "docker"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+      labels:
+          - "dependencies"
+      commit-message:
+          prefix: "build"
+          include: "scope"
+
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+      labels:
+          - "dependencies"
+      commit-message:
+          prefix: "build"
+          include: "scope"

.github/workflows/release.yml → .github/workflows/release.yaml

@@ -2,8 +2,10 @@ name: Release
 
 on:
   push:
+    branches:
+      - main
     tags:
-      - 'v*'
+      - "v[0-9]+.[0-9]+.[0-9]+**"
 
 env:
   REGISTRY: ghcr.io
@@ -16,21 +18,23 @@ jobs:
     steps:
       - name: Extract metadata (tags, labels) and establish version
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=semver,pattern={{version}}
+            type=ref,event=branch
+            type=ref,event=pr
 
       - name: Log in to the container registry (${{ env.REGISTRY }})
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           push: true
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/test.yaml

@@ -1,7 +1,6 @@
 name: Test
 
-on:
-  pull_request: { }
+on: push
 
 env:
   REGISTRY: ghcr.io
@@ -17,14 +16,14 @@ jobs:
     steps:
       - name: Extract metadata (tags, labels) and establish version
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=ref,event=pr
 
       - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           push: false
           tags: ${{ steps.meta.outputs.tags }}

Dockerfile

@@ -1,18 +1,59 @@
 FROM busybox as warchaeology
-RUN wget -O - https://github.com/nlnwa/warchaeology/releases/download/v1.1.0/warchaeology_Linux_x86_64.tar.gz | tar xvz && chmod +x warc
 
+ARG WARCHAEOLOGY_VERSION=1.1.0
 
-FROM ghcr.io/nlnwa/jhove-warc-report-parser:0.1.2 as jwrp
+RUN wget https://github.com/nlnwa/warchaeology/releases/download/v${WARCHAEOLOGY_VERSION}/checksums.txt
+RUN wget https://github.com/nlnwa/warchaeology/releases/download/v${WARCHAEOLOGY_VERSION}/warchaeology_Linux_x86_64.tar.gz
+RUN grep warchaeology_Linux_x86_64.tar.gz < checksums.txt | sha256sum -c -
+RUN tar xvzf warchaeology_Linux_x86_64.tar.gz && chmod +x warc
 
 
-FROM python:3.11-alpine
+FROM python:3.12-slim-bookworm
+
 LABEL maintainer="marius.beck@nb.no"
 
-RUN apk add --no-cache jq curl gettext git tree
-RUN pip install warctools
-COPY --from=warchaeology /warc /usr/local/bin/warc
-COPY --from=jwrp /jhove-warc-report-parser /usr/local/bin/jhove-warc-report-parser
+# Install dependencies
+RUN apt-get update -y \
+&& apt-get install -y yq xq jq gettext tree bash-completion \
+&& apt-get clean \
+&& rm -rf /var/lib/apt/lists/*
+
+# Create a non-root user
+RUN useradd --create-home --shell /bin/bash nonroot
+USER nonroot
+WORKDIR /home/nonroot
+RUN echo "\n\
+echo \n\
+echo '                                  :-==-.'\n\
+echo '                                .%@@@@@#='\n\ 
+echo '                                #@@@@+'\n\
+echo '                                @@@@#'\n\
+echo '                                %@@@#'\n\ 
+echo '                               -@@@@@.'\n\ 
+echo '                            :+%@@@@@@*'\n\
+echo '                        -+%@@@@@@@@@@@'\n\
+echo '                    :+%@@@@@@@@@@@@@@@-'\n\
+echo '                 -*@@@@@@@@@@@@@#.@@@@:'\n\
+echo '              -*@@@@@@@@@@@@@@%= :@@@%'\n\
+echo '           :*@@@@@@@@@@@@@@%+: .+@@@%.'\n\
+echo '        .=%@@@@@@@@@@@%*=: .-+%@@@@*'\n\
+echo '    .-*%@@@@@@@@##*+===+*#@@@@@@@+.'\n\  
+echo ' .+%@%%%@@@@@@@@@@@@@@@@@@@@@@*-'\n\ 
+echo '          :=+*#%@@@@@@@@@@#-.'\n\    
+echo '                      .=#@@+'\n\
+echo \
+" >> /home/nonroot/.bashrc
+
+# Set the locale (needed for python)
+ENV LANG=C.UTF-8
+# Add local bin to path
+ENV PATH=/home/nonroot/.local/bin:$PATH
+
+# Install warctools
+RUN pip --no-cache-dir install --user warctools
 
-WORKDIR /veidemann
+# Install warchaeology
+COPY --from=warchaeology /warc .local/bin/warc
+COPY --from=warchaeology /completions/warc.bash .local/share/bash-completion/completions/warc
 
-CMD ["/bin/sh"]
+ENTRYPOINT ["/bin/bash"]