jfxs/alpine-task repository overview

⁠Docker alpine task

A Task⁠ Docker image:

• lightweight image based on Alpine Linux only about 27 MB compressed,
• multiarch with support of amd64 and arm64,
• non-root container user,
• automatically updated: Renovate tracks the Alpine, Task and apk package versions and opens the merge requests,
• image signed with Cosign⁠,
• an SBOM attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Running task

docker run -t --rm jfxs/alpine-task task --version

or

docker run -t --rm quay.io/ifxs/alpine-task task --version

To run the tasks of your project:

docker run -t --rm -v "$(pwd)":/workdir jfxs/alpine-task task <task_name>

The image contains task, git, curl, jq, file and ncurses. Its working directory is /workdir, a git safe directory, and HOME is /home.

The container runs as UID 10010 and group root (GID 0), so mounted files must be readable and writable by that user (owner, group root or world). Add --user $(id -u):0 to run with your own UID. As an arbitrary UID has no user name, the entrypoint adds a /etc/passwd entry named default, or the value of the USER_NAME environment variable (letters, digits, ., _ and - only). It needs the group 0 (--user <uid>:0) and a writable /etc/passwd: with --read-only or another group, the container runs without a user name and the entrypoint prints a warning.

⁠Built with

Docker latest tag is 3.54.0-001, 3.54, 3⁠.

Task is downloaded from its GitHub release and checked against the checksums published in the same release. The apk packages are pinned. When a package is updated in the Alpine repository, the pinned version disappears from it until the Renovate merge request is merged: a rebuild in between fails.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component alpine-task.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the Task version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<task_version>-<increment>

Example: 3.54.0-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.