Skip to content

Commit

Permalink
Rebase to 3.21, enable non-root operation
Browse files Browse the repository at this point in the history
  • Loading branch information
thespad committed Dec 19, 2024
1 parent 45b8665 commit 3f62d4c
Show file tree
Hide file tree
Showing 9 changed files with 88 additions and 28 deletions.
33 changes: 25 additions & 8 deletions .github/workflows/external_trigger.yml
Original file line number Diff line number Diff line change
Expand Up @@ -48,13 +48,30 @@ jobs:
--header "Accept: application/vnd.oci.image.index.v1+json" \
--header "Authorization: Bearer ${token}" \
"https://ghcr.io/v2/${image}/manifests/${tag}")
multidigest=$(jq -r ".manifests[] | select(.platform.architecture == \"amd64\").digest?" <<< "${multidigest}")
digest=$(curl -s \
--header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
--header "Accept: application/vnd.oci.image.manifest.v1+json" \
--header "Authorization: Bearer ${token}" \
"https://ghcr.io/v2/${image}/manifests/${multidigest}" \
| jq -r '.config.digest')
if jq -e '.layers // empty' <<< "${multidigest}" >/dev/null 2>&1; then
# If there's a layer element it's a single-arch manifest so just get that digest
digest=$(jq -r '.config.digest' <<< "${multidigest}")
else
# Otherwise it's multi-arch or has manifest annotations
if jq -e '.manifests[]?.annotations // empty' <<< "${multidigest}" >/dev/null 2>&1; then
# Check for manifest annotations and delete if found
multidigest=$(jq 'del(.manifests[] | select(.annotations))' <<< "${multidigest}")
fi
if [[ $(jq '.manifests | length' <<< "${multidigest}") -gt 1 ]]; then
# If there's still more than one digest, it's multi-arch
multidigest=$(jq -r ".manifests[] | select(.platform.architecture == \"amd64\").digest?" <<< "${multidigest}")
else
# Otherwise it's single arch
multidigest=$(jq -r ".manifests[].digest?" <<< "${multidigest}")
fi
if digest=$(curl -s \
--header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
--header "Accept: application/vnd.oci.image.manifest.v1+json" \
--header "Authorization: Bearer ${token}" \
"https://ghcr.io/v2/${image}/manifests/${multidigest}"); then
digest=$(jq -r '.config.digest' <<< "${digest}");
fi
fi
image_info=$(curl -sL \
--header "Authorization: Bearer ${token}" \
"https://ghcr.io/v2/${image}/blobs/${digest}")
Expand Down Expand Up @@ -92,7 +109,7 @@ jobs:
else
printf "\n## Trigger new build\n\n" >> $GITHUB_STEP_SUMMARY
echo "New version \`${EXT_RELEASE}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
if "${artifacts_found}" == "true" ]]; then
if [[ "${artifacts_found}" == "true" ]]; then
echo "All artifacts seem to be uploaded." >> $GITHUB_STEP_SUMMARY
fi
response=$(curl -iX POST \
Expand Down
27 changes: 22 additions & 5 deletions .github/workflows/package_trigger_scheduler.yml
Original file line number Diff line number Diff line change
Expand Up @@ -27,17 +27,26 @@ jobs:
fi
printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
JENKINS_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-hishtory-server/${br}/jenkins-vars.yml)
if [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
if ! curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-hishtory-server/${br}/Jenkinsfile >/dev/null 2>&1; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> No Jenkinsfile found. Branch is either deprecated or is an early dev branch." >> $GITHUB_STEP_SUMMARY
skipped_branches="${skipped_branches}${br} "
elif [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
echo "Branch appears to be live; checking workflow." >> $GITHUB_STEP_SUMMARY
if [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
README_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-hishtory-server/${br}/readme-vars.yml)
if [[ $(yq -r '.project_deprecation_status' <<< "${README_VARS}") == "true" ]]; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> Branch appears to be deprecated; skipping trigger." >> $GITHUB_STEP_SUMMARY
skipped_branches="${skipped_branches}${br} "
elif [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> Skipping branch ${br} due to \`skip_package_check\` being set in \`jenkins-vars.yml\`." >> $GITHUB_STEP_SUMMARY
skipped_branches="${skipped_branches}${br} "
elif grep -q "^hishtory-server_${br}" <<< "${SKIP_PACKAGE_TRIGGER}"; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> Github organizational variable \`SKIP_PACKAGE_TRIGGER\` contains \`hishtory-server_${br}\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
skipped_branches="${skipped_branches}${br} "
elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-hishtory-server/job/${br}/lastBuild/api/json | jq -r '.building') == "true" ]; then
elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-hishtory-server/job/${br}/lastBuild/api/json | jq -r '.building' 2>/dev/null) == "true" ]; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> There already seems to be an active build on Jenkins; skipping package trigger for ${br}" >> $GITHUB_STEP_SUMMARY
skipped_branches="${skipped_branches}${br} "
Expand All @@ -49,18 +58,26 @@ jobs:
response=$(curl -iX POST \
https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-hishtory-server/job/${br}/buildWithParameters?PACKAGE_CHECK=true \
--user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
if [[ -z "${response}" ]]; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> Jenkins build could not be triggered. Skipping branch."
continue
fi
echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
sleep 10
buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
buildurl="${buildurl%$'\r'}"
echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
curl -iX POST \
if ! curl -ifX POST \
"${buildurl}submitDescription" \
--user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
--data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
--data-urlencode "Submit=Submit"
--data-urlencode "Submit=Submit"; then
echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
echo "> Unable to change the Jenkins job description."
fi
sleep 20
fi
else
Expand Down
7 changes: 5 additions & 2 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ RUN \
unset GOPATH; go mod download && \
unset GOPATH; go build -o /server -ldflags "-X main.ReleaseVersion=v0.`cat VERSION`" backend/server/server.go

FROM ghcr.io/linuxserver/baseimage-alpine:3.20
FROM ghcr.io/linuxserver/baseimage-alpine:3.21

# set version label
ARG BUILD_DATE
Expand All @@ -32,7 +32,10 @@ ARG HISHTORY_RELEASE
LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
LABEL maintainer="thespad"

RUN printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version
RUN \
apk add --no-cache \
postgresql16-client && \
printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version

COPY --from=builder /server /app/server

Expand Down
7 changes: 5 additions & 2 deletions Dockerfile.aarch64
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ RUN \
unset GOPATH; go mod download && \
unset GOPATH; go build -o /server -ldflags "-X main.ReleaseVersion=v0.`cat VERSION`" backend/server/server.go

FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.20
FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.21

# set version label
ARG BUILD_DATE
Expand All @@ -32,7 +32,10 @@ ARG HISHTORY_RELEASE
LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
LABEL maintainer="thespad"

RUN printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version
RUN \
apk add --no-cache \
postgresql16-client && \
printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version

COPY --from=builder /server /app/server

Expand Down
20 changes: 13 additions & 7 deletions Jenkinsfile
Original file line number Diff line number Diff line change
Expand Up @@ -579,7 +579,7 @@ pipeline {
--label \"org.opencontainers.image.title=Hishtory-server\" \
--label \"org.opencontainers.image.description=[hiSHtory](https://github.com/ddworken/hishtory) is a better shell history. It stores your shell history in context (what directory you ran the command in, whether it succeeded or failed, how long it took, etc). This is all stored locally and end-to-end encrypted for syncing to to all your other computers.\" \
--no-cache --pull -t ${IMAGE}:${META_TAG} --platform=linux/amd64 \
--provenance=false --sbom=false --builder=container --load \
--provenance=true --sbom=true --builder=container --load \
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
sh '''#! /bin/bash
set -e
Expand Down Expand Up @@ -608,7 +608,9 @@ pipeline {
for i in "${CACHE[@]}"; do
docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
done
wait
for p in $(jobs -p); do
wait "$p" || { echo "job $p failed" >&2; exit 1; }
done
fi
'''
}
Expand Down Expand Up @@ -643,7 +645,7 @@ pipeline {
--label \"org.opencontainers.image.title=Hishtory-server\" \
--label \"org.opencontainers.image.description=[hiSHtory](https://github.com/ddworken/hishtory) is a better shell history. It stores your shell history in context (what directory you ran the command in, whether it succeeded or failed, how long it took, etc). This is all stored locally and end-to-end encrypted for syncing to to all your other computers.\" \
--no-cache --pull -t ${IMAGE}:amd64-${META_TAG} --platform=linux/amd64 \
--provenance=false --sbom=false --builder=container --load \
--provenance=true --sbom=true --builder=container --load \
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
sh '''#! /bin/bash
set -e
Expand Down Expand Up @@ -672,7 +674,9 @@ pipeline {
for i in "${CACHE[@]}"; do
docker push ${i}:amd64-${COMMIT_SHA}-${BUILD_NUMBER} &
done
wait
for p in $(jobs -p); do
wait "$p" || { echo "job $p failed" >&2; exit 1; }
done
fi
'''
}
Expand Down Expand Up @@ -700,7 +704,7 @@ pipeline {
--label \"org.opencontainers.image.title=Hishtory-server\" \
--label \"org.opencontainers.image.description=[hiSHtory](https://github.com/ddworken/hishtory) is a better shell history. It stores your shell history in context (what directory you ran the command in, whether it succeeded or failed, how long it took, etc). This is all stored locally and end-to-end encrypted for syncing to to all your other computers.\" \
--no-cache --pull -f Dockerfile.aarch64 -t ${IMAGE}:arm64v8-${META_TAG} --platform=linux/arm64 \
--provenance=false --sbom=false --builder=container --load \
--provenance=true --sbom=true --builder=container --load \
--build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
sh '''#! /bin/bash
set -e
Expand Down Expand Up @@ -729,7 +733,9 @@ pipeline {
for i in "${CACHE[@]}"; do
docker push ${i}:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER} &
done
wait
for p in $(jobs -p); do
wait "$p" || { echo "job $p failed" >&2; exit 1; }
done
fi
'''
}
Expand Down Expand Up @@ -971,7 +977,7 @@ pipeline {
echo '{"tag_name":"'${META_TAG}'",\
"target_commitish": "main",\
"name": "'${META_TAG}'",\
"body": "**CI Report:**\\n\\n'${CI_URL:-N/A}'\\n\\n**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**'${EXT_REPO}' Changes:**\\n\\n' > start
"body": "**CI Report:**\\n\\n'${CI_URL:-N/A}'\\n\\n**LinuxServer Changes:**\\n\\n'${LS_RELEASE_NOTES}'\\n\\n**Remote Changes:**\\n\\n' > start
printf '","draft": false,"prerelease": false}' >> releasebody.json
paste -d'\\0' start releasebody.json > releasebody.json.done
curl -H "Authorization: token ${GITHUB_TOKEN}" -X POST https://api.github.com/repos/${LS_USER}/${LS_REPO}/releases -d @releasebody.json.done'''
Expand Down
6 changes: 6 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,10 @@ See the [project readme](https://github.com/ddworken/hishtory/blob/master/README

This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).

## Non-Root Operation

This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).

## Usage

To help you get started creating a container from this image you can either use docker-compose or the docker cli.
Expand Down Expand Up @@ -120,6 +124,7 @@ Containers are configured using parameters passed at runtime (such as those abov
| `-e HISHTORY_POSTGRES_DB=postgresql://${HISHTORY_DB_USER}:${HISHTORY_DB_PASS}@hishtory-db:5432/hishtory?sslmode=disable` | Postgres DB [Connection URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING). Special characters must be [URL encoded](https://en.wikipedia.org/wiki/URL_encoding). |
| `-e HISHTORY_SQLITE_DB=/config/hishtory.db` | SQLite database path. Needs to be a mounted volume for persistence. Don't set at the same time as HISHTORY_POSTGRES_DB. |
| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |

## Environment variables from files (Docker secrets)

Expand Down Expand Up @@ -283,6 +288,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

## Versions

* **19.12.24:** - Rebase to Alpine 3.21.
* **26.08.24:** - Bump to go 1.23
* **24.05.24:** - Rebase to Alpine 3.20.
* **31.01.24:** - Rebase to Alpine 3.19.
Expand Down
2 changes: 2 additions & 0 deletions readme-vars.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ opt_param_env_vars:
- {env_var: "HISHTORY_POSTGRES_DB", env_value: "postgresql://${HISHTORY_DB_USER}:${HISHTORY_DB_PASS}@hishtory-db:5432/hishtory?sslmode=disable", desc: "Postgres DB [Connection URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING). Special characters must be [URL encoded](https://en.wikipedia.org/wiki/URL_encoding)."}
- {env_var: "HISHTORY_SQLITE_DB", env_value: "/config/hishtory.db", desc: "SQLite database path. Needs to be a mounted volume for persistence. Don't set at the same time as HISHTORY_POSTGRES_DB."}
readonly_supported: true
nonroot_supported: true
app_setup_block_enabled: true
app_setup_block: |
After you have installed hishtory on your machine, add `export HISHTORY_SERVER=http://1.2.3.4:8080` (with your server details) to your shellrc. Then run `hishtory init` (or `hishtory init ${SECRET_KEY}`) to initialise hishtory against your local server.
Expand Down Expand Up @@ -70,6 +71,7 @@ init_diagram: |
"hishtory-server:latest" <- Base Images
# changelog
changelogs:
- {date: "19.12.24:", desc: "Rebase to Alpine 3.21."}
- {date: "26.08.24:", desc: "Bump to go 1.23"}
- {date: "24.05.24:", desc: "Rebase to Alpine 3.20."}
- {date: "31.01.24:", desc: "Rebase to Alpine 3.19."}
Expand Down
2 changes: 1 addition & 1 deletion root/etc/s6-overlay/s6-rc.d/init-hishtory-config/run
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ if [[ -n ${HISHTORY_POSTGRES_DB} ]]; then
DBPORT=$(echo "${HISHTORY_POSTGRES_DB}" | awk -F '@' '{print $NF}' | awk -F ':' '{print $2}' | awk -F '/' '{print $1}')
echo "Waiting for DB ${DBHOST} to become available on port ${DBPORT}..."
while :; do
if nc -w 1 -z "$DBHOST" "$DBPORT" > /dev/null 2>&1; then
if pg_isready -h "${DBHOST}" -p "${DBPORT}" -q; then
exit 0
fi
sleep 3
Expand Down
12 changes: 9 additions & 3 deletions root/etc/s6-overlay/s6-rc.d/svc-hishtory/run
Original file line number Diff line number Diff line change
@@ -1,6 +1,12 @@
#!/usr/bin/with-contenv bash
# shellcheck shell=bash

exec \
s6-notifyoncheck -d -n 300 -w 1000 \
s6-setuidgid abc /app/server
if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
exec \
s6-notifyoncheck -d -n 300 -w 1000 \
s6-setuidgid abc /app/server
else
exec \
s6-notifyoncheck -d -n 300 -w 1000 \
/app/server
fi

0 comments on commit 3f62d4c

Please sign in to comment.