2054143219
Some checks failed
CI / skinny-install (aco) (push) Failing after 8s
CI / skinny-install (api) (push) Failing after 7s
CI / skinny-install (bcda) (push) Failing after 7s
CI / skinny-install (bib) (push) Failing after 7s
CI / skinny-install (bls) (push) Failing after 8s
CI / skinny-install (ccw) (push) Failing after 8s
CI / skinny-install (cli) (push) Failing after 7s
CI / skinny-install (cms) (push) Failing after 7s
CI / skinny-install (conf) (push) Failing after 8s
CI / skinny-install (pfs) (push) Failing after 8s
CI / skinny-install (rex) (push) Failing after 7s
CI / lint-test (push) Has been cancelled
Infra CI / notebooks (push) Failing after 6s
Infra CI / zotero (push) Failing after 7s
Infra CI / docs (push) Successful in 39s
Infra CI / api (push) Successful in 9s
Infra CI / mc (push) Successful in 6s
Deploy / build-scan-report (push) Has been cancelled
- Add CI backend switching section to README with backend table, switch instructions, secret mapping, and workflow descriptions - Update project layout section to reflect P24 tree reorg (infra/, assets/, cloud/) - Fix stale references: styles/ → assets/, .woodpecker/ → .gitea/ - Fix gen_config.py --help to list all 3 backends (gitea|github|woodpecker) - Add dist-upgrade + CVE commentary to zotero Dockerfile; Go stdlib CVEs (CVE-2024-24790, CVE-2025-68121) are in base image static binaries — tracked by weekly harden.yml --no-cache rebuilds
34 lines
1.2 KiB
Docker
34 lines
1.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM ghcr.io/selkies-project/nvidia-egl-desktop:latest
|
|
|
|
USER root
|
|
|
|
# System-level security patches — pulls latest fixes for all OS packages.
|
|
# Go stdlib CVEs (CVE-2024-24790, CVE-2025-68121) are in static binaries
|
|
# from the base image; they resolve when upstream rebuilds with patched Go.
|
|
# The harden.yml weekly --no-cache rebuild ensures we track upstream fixes.
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get dist-upgrade -y \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Zotero
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
ca-certificates \
|
|
&& curl -sL https://raw.githubusercontent.com/retorquere/zotero-deb/master/install.sh | bash \
|
|
&& apt-get update && apt-get install -y --no-install-recommends \
|
|
zotero \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Patch Python packages with known CVEs from base image
|
|
RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"
|
|
|
|
# Create desktop shortcut for Zotero
|
|
RUN mkdir -p /home/ubuntu/Desktop \
|
|
&& cp /usr/share/applications/zotero.desktop /home/ubuntu/Desktop/ \
|
|
&& chmod +x /home/ubuntu/Desktop/zotero.desktop \
|
|
&& chown -R ubuntu:ubuntu /home/ubuntu/Desktop
|
|
|
|
USER ubuntu
|