@@ -18,7 +18,7 @@ LABEL maintainer="All Things Linux IRC Infrastructure" \
1818 org.opencontainers.image.licenses="GPL-3.0" \
1919 org.opencontainers.image.vendor="All Things Linux"
2020
21- # 🔒 SECURITY: Configure non-interactive environment
21+ # SECURITY: Configure non-interactive environment
2222ENV DEBIAN_FRONTEND=noninteractive \
2323 DEBCONF_NONINTERACTIVE_SEEN=true \
2424 # Define versions as environment variables for better caching
@@ -31,6 +31,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
3131# 🚀 OPTIMIZATION: Single layer package installation with enhanced security
3232# 🔒 SECURITY: Use specific package versions and verify GPG keys
3333# 📦 EFFICIENCY: Combined operations to minimize layers
34+
3435# hadolint ignore=DL3008,DL3009,DL3015
3536RUN set -eux; \
3637 # Update package lists
@@ -39,41 +40,32 @@ RUN set -eux; \
3940 apt-get upgrade -y --no-install-recommends; \
4041 # Install all dependencies in one command to reduce layers
4142 apt-get install -y --no-install-recommends \
42- # 🔧 Core build tools and compilers (essential)
4343 build-essential \
4444 gcc \
4545 g++ \
4646 make \
47- # 🐛 Debugging tools (development only)
4847 gdb \
49- # 🌍 Internationalization support
5048 gettext \
51- # 🔐 Cryptography and security libraries
5249 libargon2-dev \
5350 libc-ares-dev \
5451 libcurl4-openssl-dev \
5552 libpcre2-dev \
5653 libssl-dev \
5754 libsodium-dev \
58- # 🛠️ Build system tools
5955 pkg-config \
6056 autoconf \
6157 automake \
6258 libtool \
63- # 📥 Download utilities
6459 wget \
6560 curl \
6661 ca-certificates \
67- # 📚 Version control
6862 git \
69- # 🎯 Atheme-specific dependencies
7063 libidn2-dev \
7164 nettle-dev \
7265 libqrencode-dev \
7366 libperl-dev \
74- # 🧹 System utilities for cleanup
7567 procps && \
76- # 🧽 AGGRESSIVE CLEANUP: Remove all unnecessary files to minimize size
68+ # AGGRESSIVE CLEANUP: Remove all unnecessary files to minimize size
7769 apt-get clean && \
7870 apt-get autoremove -y && \
7971 rm -rf /var/cache/apt/archives/* \
@@ -88,11 +80,11 @@ RUN set -eux; \
8880# ================================================================================
8981# BUILDER STAGE - Optimized compilation with security hardening
9082# ================================================================================
91- # 🚀 OPTIMIZATION: Separate stage for compilation, discarded in final image
83+ # OPTIMIZATION: Separate stage for compilation, discarded in final image
9284FROM base AS builder
9385
94- # 🔒 SECURITY: Create dedicated build user (never build as root)
95- # 📦 EFFICIENCY: Combined user/directory creation in single layer
86+ # SECURITY: Create dedicated build user (never build as root)
87+ # EFFICIENCY: Combined user/directory creation in single layer
9688RUN set -eux; \
9789 groupadd --system --gid 1001 builder; \
9890 useradd --create-home --system --uid 1001 --gid builder builder; \
@@ -226,7 +218,7 @@ RUN ./configure \
226218# OPTIMIZATION: Only includes runtime dependencies, ~50% smaller than builder
227219FROM debian:bookworm-slim AS runtime
228220
229- # 🔒 SECURITY: Minimal runtime environment
221+ # SECURITY: Minimal runtime environment
230222ENV DEBIAN_FRONTEND=noninteractive \
231223 # Disable core dumps for security
232224 DAEMON_UID=1001 \
@@ -268,16 +260,16 @@ RUN set -eux; \
268260# ================================================================================
269261# COPY COMPILED BINARIES - Transfer only essential files from builder
270262# ================================================================================
271- # 🚀 OPTIMIZATION: Copy only what we need, minimizing image size
272- # 🔒 SECURITY: Maintain proper ownership throughout
263+ # OPTIMIZATION: Copy only what we need, minimizing image size
264+ # SECURITY: Maintain proper ownership throughout
273265COPY --from=builder --chown=ircd:ircd /usr/local/atheme /usr/local/atheme
274266COPY --from=builder --chown=ircd:ircd /usr/local/unrealircd /usr/local/unrealircd
275267
276268# ================================================================================
277269# SETUP SCRIPTS AND PERMISSIONS - Optimized single layer
278270# ================================================================================
279- # 🚀 OPTIMIZATION: Combine all setup operations in single layer
280- # 🔒 SECURITY: Minimal privileges, proper ownership
271+ # OPTIMIZATION: Combine all setup operations in single layer
272+ # SECURITY: Minimal privileges, proper ownership
281273RUN set -eux; \
282274 # Copy all management scripts
283275 mkdir -p /opt/irc/scripts; \
@@ -295,7 +287,7 @@ RUN set -eux; \
295287 # Clean up any temporary files
296288 rm -rf /tmp/* /var/tmp/* 2>/dev/null || true
297289
298- # 🔒 SECURITY: Switch to non-root user immediately
290+ # SECURITY: Switch to non-root user immediately
299291USER ircd:ircd
300292
301293# 📍 Set working directory
@@ -315,20 +307,20 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
315307# ================================================================================
316308# ENVIRONMENT CONFIGURATION - Optimized runtime environment
317309# ================================================================================
318- # 🚀 OPTIMIZATION: Group related environment variables
310+ # OPTIMIZATION: Group related environment variables
319311ENV ATHEME_CONF="/usr/local/atheme/etc/atheme.conf" \
320312 ATHEME_DATA="/usr/local/atheme/var" \
321313 ATHEME_MODULES="/usr/local/atheme/modules" \
322314 # UnrealIRCd configuration paths
323315 UNREALIRCD_CONTRIB="/usr/local/unrealircd/contrib" \
324316 UNREALIRCD_MODULES="/usr/local/unrealircd/modules" \
325- # 🔒 SECURITY: Disable core dumps and set restrictive umask
317+ # SECURITY: Disable core dumps and set restrictive umask
326318 UMASK=0027 \
327319 # Performance: Set timezone to UTC for consistency
328320 TZ=UTC
329321
330322# ================================================================================
331323# STARTUP COMMAND - Optimized service launcher
332324# ================================================================================
333- # 🚀 OPTIMIZATION: Use exec for proper signal handling
325+ # OPTIMIZATION: Use exec for proper signal handling
334326CMD ["exec" , "/usr/local/bin/start-services" , "start" ]
0 commit comments