mirror of
https://github.com/distribution/distribution.git
synced 2026-10-28 10:15:27 +08:00
Pujitha Paladugu
a22d72fb43
Motivation: the Dockerfiles pin GO_VERSION=1.26.8, so release and edge
images are built with a Go toolchain that predates the 1.26.9 and 1.26.10
security releases (including a mime/multipart memory limit bypass and
crypto/x509 intermediate certificate distrust). Rebuilds still produce
go1.26.8 binaries because of the pin.
Approach: bump the GO_VERSION ARG from 1.26.8 to 1.26.10 in Dockerfile and
dockerfiles/{docs,git,lint,vendor}.Dockerfile, as was done for the previous
bump. The CI matrix in build.yml uses 1.26.x and needs no change. No source
changes. This does not cut a patch release; that is a maintainer decision.
Validation: Docker is not available on this machine, so I did not build the
images. I confirmed the golang:1.26.10-alpine tag exists on Docker Hub and
grepped that no other 1.26.8 pin remains. The change only alters a base
image tag; no Go code or tests are affected.
Report: https://github.com/distribution/distribution/issues/5040
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5-5 (via Claude Code)
46 lines
1.4 KiB
Docker
46 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# GO_VERSION sets the version of the golang base image to use.
|
|
# It must be a supported tag in the docker.io/library/golang image repository.
|
|
ARG GO_VERSION=1.26.10
|
|
|
|
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
|
|
# It must be a supported tag in the docker.io/library/alpine image repository
|
|
# that's also available as alpine image variant for the Golang version used.
|
|
ARG ALPINE_VERSION=3.24
|
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
|
|
RUN apk add --no-cache git
|
|
|
|
FROM base AS hugo
|
|
ARG HUGO_VERSION=0.136.5
|
|
RUN --mount=type=cache,target=/go/mod/pkg \
|
|
go install github.com/gohugoio/hugo@v${HUGO_VERSION}
|
|
|
|
FROM base AS build-base
|
|
COPY --from=hugo $GOPATH/bin/hugo /bin/hugo
|
|
WORKDIR /src
|
|
|
|
FROM build-base AS build
|
|
RUN --mount=type=bind,rw,source=docs,target=. \
|
|
hugo --gc --minify --destination /out
|
|
|
|
FROM build-base AS server
|
|
COPY docs .
|
|
ENTRYPOINT [ "hugo", "server", "--bind", "0.0.0.0" ]
|
|
EXPOSE 1313
|
|
|
|
FROM scratch AS out
|
|
COPY --from=build /out /
|
|
|
|
FROM wjdp/htmltest:v0.17.0 AS test
|
|
# Copy the site to a public/distribution subdirectory
|
|
# This is a workaround for a limitation in htmltest, see:
|
|
# https://github.com/wjdp/htmltest/issues/45
|
|
WORKDIR /test/public/distribution
|
|
COPY --from=build /out .
|
|
WORKDIR /test
|
|
ADD docs/.htmltest.yml .htmltest.yml
|
|
RUN --mount=type=cache,target=tmp/.htmltest \
|
|
htmltest
|