jakman85andClaude Opus 5.5
310deb0f7d
Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched. - platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined, read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it). No Kyverno exception: every applied policy matches app-namespace=true only. - Each Containerfile names its shipped stage and ends in a `verify` stage holding every former `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now. - images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes. Fails loudly when the builder secrets are absent or buildkitd is unreachable. - infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>
16 lines
989 B
Bash
16 lines
989 B
Bash
# platform/buildkit/versions.env — the CI side of the builder. Sourced by
|
|
# .gitea/workflows/scripts/images.sh. NOT a Kubernetes resource (kustomization.yaml omits it).
|
|
#
|
|
# The CLIENT. CI drives the daemon with `buildx` (remote driver) rather than bare `buildctl`
|
|
# because the image pipeline needs `bake`'s `target:` contexts: on a pull request agent-runner is
|
|
# built FROM the toolbox built in the same run, which never exists in any registry.
|
|
# Pinned with the sha256 from the release's own checksums.txt
|
|
# (https://github.com/docker/buildx/releases/download/v0.38.1/checksums.txt); the pipeline
|
|
# refuses a download that does not match. Bump BOTH lines together.
|
|
BUILDX_VERSION=0.38.1
|
|
BUILDX_SHA256=e25d5cd675092bb5d1d03632fdc46cdf3fede7b514dc5f023a105e00d3ce5ad4
|
|
|
|
# The DAEMON's address and the name its certificate carries (platform/buildkit/certificates.yaml).
|
|
BUILDKIT_HOST=tcp://buildkitd.buildkit.svc.cluster.local:1234
|
|
BUILDKIT_SERVERNAME=buildkitd.buildkit.svc.cluster.local
|