cf5ca45ac3
Some checks failed
CI / lint (push) Successful in 33s
Deploy / notebooks (push) Has been skipped
Deploy / zotero (push) Failing after 21s
Deploy / docs (push) Has been skipped
Deploy / api (push) Has been skipped
Deploy / mc (push) Has been skipped
Infra CI / notebooks (push) Failing after 50s
Infra CI / zotero (push) Successful in 25s
Infra CI / docs (push) Successful in 15s
Infra CI / api (push) Successful in 39s
Infra CI / mc (push) Successful in 14s
Package Supply Chain / pkg-supply-chain (push) Failing after 1m11s
Deploy / report (push) Successful in 19s
CI / test (push) Successful in 22m44s
Renovate's pip and dockerfile managers don't see bare `ARG *_VERSION=` pins (marimo cloned from a git tag, yq/otel-cli from GitHub releases), so they silently went stale — the marimo one was 3 minor versions behind and broke acodb_explorer's charts. - Annotate each such pin with a `# renovate: datasource=… depName=…` comment and add a Renovate customManager that reads them, so Renovate now opens bump PRs for MARIMO/YQ/OTEL_CLI versions automatically. - Add dev/scripts/check_freshness.py: the on-demand/CI counterpart that reads the same annotations, reports which pins are behind upstream, and exits nonzero if any are stale. All three currently fresh.
82 lines
4.0 KiB
Docker
82 lines
4.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM ghcr.io/selkies-project/nvidia-egl-desktop:latest
|
|
|
|
USER root
|
|
|
|
# Security patches: upgrade all OS packages + remove vulnerable binaries
|
|
# we don't need in a Zotero-only container.
|
|
# ipp-usb — IPP-over-USB printer daemon (Go stdlib CVEs)
|
|
# yq — vulnerable base copy removed here, then REPLACED below with a
|
|
# current static binary. kasmvnc-entrypoint.sh requires yq to
|
|
# render kasmvnc.yaml; purging it outright left the kasmvnc
|
|
# supervisor program FATAL on every fresh container (blank :21).
|
|
# firefox — base image browser; Zotero ships its own (expat CVEs)
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get purge -y --auto-remove ipp-usb firefox yq 2>/dev/null || true \
|
|
&& rm -f /usr/sbin/ipp-usb /usr/bin/yq \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Zotero
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
ca-certificates \
|
|
&& curl -sL https://raw.githubusercontent.com/retorquere/zotero-deb/master/install.sh | bash \
|
|
&& apt-get update && apt-get install -y --no-install-recommends \
|
|
zotero \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Reinstall yq as a current static binary (replaces the vulnerable base copy
|
|
# purged above). KasmVNC's entrypoint hard-depends on it (mikefarah v4 syntax);
|
|
# a recent release carries the patched Go stdlib that motivated the removal.
|
|
# renovate: datasource=github-releases depName=mikefarah/yq extractVersion=^v(?<version>.+)$
|
|
ARG YQ_VERSION=4.53.3
|
|
RUN arch="$(dpkg --print-architecture)" \
|
|
&& curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${arch}" -o /usr/bin/yq \
|
|
&& chmod +x /usr/bin/yq \
|
|
&& yq --version
|
|
|
|
# Patch Python packages with known CVEs from base image
|
|
RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"
|
|
|
|
# Create desktop shortcut for Zotero
|
|
RUN mkdir -p /home/ubuntu/Desktop \
|
|
&& cp /usr/share/applications/zotero.desktop /home/ubuntu/Desktop/ \
|
|
&& chmod +x /home/ubuntu/Desktop/zotero.desktop \
|
|
&& chown -R ubuntu:ubuntu /home/ubuntu/Desktop
|
|
|
|
# Desktop-bridge watchdog + healthcheck deps.
|
|
# x11-utils → xdpyinfo (probe X reachability of :20/:21)
|
|
# procps → pgrep (detect kasmxproxy / plasmashell)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
x11-utils \
|
|
procps \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# otel-cli: enables OTLP span emission from the bridge watchdog. Dormant by
|
|
# default (the guard only emits when OTEL_EXPORTER_OTLP_ENDPOINT is set and
|
|
# this container is attached to the `observability` network — see compose.yml).
|
|
# Best-effort install so a release-asset hiccup never breaks the image build.
|
|
# renovate: datasource=github-releases depName=equinix-labs/otel-cli extractVersion=^v(?<version>.+)$
|
|
ARG OTEL_CLI_VERSION=0.4.5
|
|
RUN arch="$(dpkg --print-architecture | sed -e 's/amd64/amd64/' -e 's/arm64/arm64/')" \
|
|
&& curl -fsSL "https://github.com/equinix-labs/otel-cli/releases/download/v${OTEL_CLI_VERSION}/otel-cli_${OTEL_CLI_VERSION}_linux_${arch}.tar.gz" \
|
|
-o /tmp/otel-cli.tgz \
|
|
&& tar -xzf /tmp/otel-cli.tgz -C /usr/local/bin otel-cli \
|
|
&& chmod +x /usr/local/bin/otel-cli \
|
|
&& rm -f /tmp/otel-cli.tgz \
|
|
|| echo 'WARN: otel-cli install failed; OTLP tracing will be unavailable'
|
|
|
|
# Desktop-bridge watchdog (fixes the kasmxproxy startup race) + healthcheck.
|
|
COPY infra/images/zotero/kasmxproxy-guard.sh /usr/local/bin/kasmxproxy-guard.sh
|
|
COPY infra/images/zotero/zotero-healthcheck.sh /usr/local/bin/zotero-healthcheck
|
|
COPY infra/images/zotero/kasmxproxy-guard.conf /etc/supervisor/conf.d/kasmxproxy-guard.conf
|
|
RUN chmod +x /usr/local/bin/kasmxproxy-guard.sh /usr/local/bin/zotero-healthcheck
|
|
|
|
# Detect a blank desktop (dead :20->:21 bridge), which container/nginx/Xvnc
|
|
# liveness all miss. Compose overrides interval/start_period as needed.
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=180s --retries=5 \
|
|
CMD /usr/local/bin/zotero-healthcheck
|
|
|
|
USER ubuntu
|