jfxs/alpine-squid repository overview

⁠jfxs / alpine-squid

A Squid⁠ (proxy) Docker image:

• lightweight image based on Alpine Linux, less than 15 MB,
• multiarch with support of amd64 and arm64,
• non-root container user,
• automatically updated by Renovate⁠ (Alpine base image and squid package),
• image signed with Cosign⁠,
• an SBOM attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Running Squid

docker run -d --rm --name squid -p 3128:3128 jfxs/alpine-squid

or

docker run -d --rm --name squid -p 3128:3128 quay.io/ifxs/alpine-squid

The proxy listens on the port 3128 (IPv4 and IPv6) as the user 10010. Any other UID can be used if the group is 0 (for example --user 12345:0). The root filesystem can be read-only:

docker run -d --rm --name squid -p 3128:3128 --read-only jfxs/alpine-squid

The configuration of Squid is the default one, with some additions:

/etc/squid/squid.conf

# Include a folder of config files
include /etc/squid/conf.d/*.conf

/etc/squid/conf.d/squid-docker.conf

# Allow from all hosts (the predefined "all" ACL)
http_access allow all
# Specific configuration for Docker usage
pid_filename none
logfile_rotate 0
access_log stdio:/dev/stdout
cache_log stdio:/dev/stderr

/!\ There is no filtering access to Squid.

⁠Built with

Docker latest tag is 7.6-r0-001, 7.6-r0, 7⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component alpine-squid.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the squid apk package version used (including the Alpine revision, e.g. 7.6-r0),
• a dash
• an increment to differentiate build with the same version starting at 001

<squid_version>-<increment>

Example: 7.6-r0-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.