├── images ├── alpine-base │ ├── examples │ │ └── go │ │ │ ├── go.mod │ │ │ ├── hello.go │ │ │ └── Dockerfile │ ├── configs │ │ └── latest.apko.yaml │ ├── tests │ │ ├── 01-echo.sh │ │ └── main.tf │ ├── README.md │ └── main.tf ├── static │ ├── examples │ │ ├── main.go │ │ ├── hello.c │ │ ├── Dockerfile.c │ │ ├── Dockerfile.golang │ │ └── Dockerfile.rust │ ├── configs │ │ └── alpine.apko.yaml │ ├── tests │ │ ├── main.tf │ │ └── 01-multi-dockerfile-build.sh │ ├── alpine.tf │ └── main.tf ├── musl-dynamic │ ├── examples │ │ ├── hello.c │ │ └── Dockerfile.c │ ├── configs │ │ └── latest.apko.yaml │ ├── README.md │ ├── tests │ │ ├── main.tf │ │ └── 01-dockerfile-c-build.sh │ └── main.tf ├── gcc-musl │ ├── examples │ │ └── hello │ │ │ └── main.c │ ├── tests │ │ ├── 01-version.sh │ │ └── main.tf │ ├── configs │ │ └── latest.apko.yaml │ ├── DEVELOPMENT.md │ ├── main.tf │ └── README.md ├── sdk │ ├── mount │ │ └── entrypoint.sh │ ├── tests │ │ ├── main.tf │ │ └── 01-has-all-tools.sh │ ├── main.tf │ ├── configs │ │ └── latest.apko.yaml │ └── README.md ├── apko │ ├── README.md │ └── main.tf ├── busybox │ ├── tests │ │ ├── main.tf │ │ └── runs.sh │ ├── alpine.tf │ ├── main.tf │ └── config │ │ └── alpine │ │ └── main.tf ├── spdx-tools │ ├── configs │ │ └── latest.apko.yaml │ └── main.tf └── git │ ├── tests │ ├── repo-clone.sh │ └── main.tf │ ├── alpine.tf │ ├── main.tf │ └── config │ └── main.tf ├── CODEOWNERS ├── .gitignore ├── .github ├── dependabot.yaml └── workflows │ ├── presubmit-build.yaml │ ├── release.yaml │ └── .build.yaml ├── tflib ├── version-tags │ └── main.tf └── publisher │ └── main.tf ├── README.md ├── main.tf └── LICENSE /images/alpine-base/examples/go/go.mod: -------------------------------------------------------------------------------- 1 | module example 2 | 3 | go 1.18 4 | -------------------------------------------------------------------------------- /CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Require review by repo owners of changes to CODEOWNERS 2 | CODEOWNERS @wolfi-dev/wolfi-owners 3 | 4 | -------------------------------------------------------------------------------- /images/static/examples/main.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import "fmt" 4 | 5 | func main() { 6 | fmt.Println("Hello!") 7 | } 8 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | **/.terraform* 2 | **/terraform* 3 | **/melange.rsa* 4 | **/packages/ 5 | **/*.tar 6 | **/*.cdx 7 | **/*.spdx.json 8 | -------------------------------------------------------------------------------- /images/static/examples/hello.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main() { 4 | printf("Hello!\n"); 5 | return 0; 6 | } 7 | -------------------------------------------------------------------------------- /images/alpine-base/examples/go/hello.go: -------------------------------------------------------------------------------- 1 | package main 2 | 3 | import "fmt" 4 | 5 | func main() { 6 | fmt.Println("Hello!") 7 | } 8 | -------------------------------------------------------------------------------- /images/musl-dynamic/examples/hello.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main() { 4 | printf("Hello!\n"); 5 | return 0; 6 | } 7 | -------------------------------------------------------------------------------- /images/gcc-musl/examples/hello/main.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main() { 4 | printf("Hello World!\n"); 5 | return 0; 6 | } 7 | -------------------------------------------------------------------------------- /images/sdk/mount/entrypoint.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -e 2 | printf "\nWelcome to the development environment!\n\n\n" 3 | export PS1="[sdk] ❯ " 4 | export GOPATH="/root/.cache/go" 5 | export CGO_ENABLED=0 6 | bash -i 7 | -------------------------------------------------------------------------------- /images/alpine-base/configs/latest.apko.yaml: -------------------------------------------------------------------------------- 1 | contents: 2 | packages: 3 | - alpine-baselayout-data 4 | - alpine-release==3 # TODO(#33): unlock this 5 | - apk-tools 6 | - busybox 7 | - libc-utils 8 | -------------------------------------------------------------------------------- /images/alpine-base/tests/01-echo.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail 4 | 5 | IMAGE_NAME=${IMAGE_NAME:-"ghcr.io/wolfi-dev/alpine-base"} 6 | 7 | docker run ${IMAGE_NAME} echo "hello" 8 | -------------------------------------------------------------------------------- /images/musl-dynamic/configs/latest.apko.yaml: -------------------------------------------------------------------------------- 1 | contents: 2 | packages: 3 | - alpine-baselayout-data 4 | - alpine-release==3 # TODO(#33): unlock this 5 | - ca-certificates-bundle 6 | - musl==1 # TODO(#33): unlock this 7 | -------------------------------------------------------------------------------- /images/apko/README.md: -------------------------------------------------------------------------------- 1 | # sdk 2 | 3 | Development image for [apko](https://github.com/chainguard-dev/apko). 4 | 5 | ## Get It! 6 | 7 | The image is available on `ghcr.io`: 8 | 9 | ``` 10 | docker pull ghcr.io/wolfi-dev/apko:latest 11 | ``` 12 | -------------------------------------------------------------------------------- /images/static/configs/alpine.apko.yaml: -------------------------------------------------------------------------------- 1 | contents: 2 | packages: 3 | - tzdata 4 | 5 | accounts: 6 | groups: 7 | - groupname: nonroot 8 | gid: 65532 9 | users: 10 | - username: nonroot 11 | uid: 65532 12 | gid: 65532 13 | run-as: 65532 14 | -------------------------------------------------------------------------------- /images/musl-dynamic/examples/Dockerfile.c: -------------------------------------------------------------------------------- 1 | ARG BASE=ghcr.io/wolfi-dev/musl-dynamic 2 | 3 | FROM ghcr.io/wolfi-dev/gcc-musl as build 4 | 5 | COPY hello.c /work/hello.c 6 | RUN cc hello.c -o hello 7 | 8 | FROM $BASE 9 | 10 | COPY --from=build /work/hello /hello 11 | CMD ["/hello"] 12 | -------------------------------------------------------------------------------- /images/static/examples/Dockerfile.c: -------------------------------------------------------------------------------- 1 | ARG BASE=cgr.dev/chainguard/static 2 | 3 | FROM cgr.dev/chainguard/gcc-glibc as build 4 | 5 | COPY hello.c /hello.c 6 | RUN cc -static /hello.c -o /hello 7 | 8 | FROM $BASE 9 | 10 | COPY --from=build /hello /usr/local/bin/ 11 | CMD ["hello"] 12 | -------------------------------------------------------------------------------- /images/static/examples/Dockerfile.golang: -------------------------------------------------------------------------------- 1 | ARG BASE=cgr.dev/chainguard/static 2 | 3 | FROM cgr.dev/chainguard/go as build 4 | 5 | COPY main.go /main.go 6 | RUN CGO_ENABLED=0 go build -o /hello /main.go 7 | 8 | FROM $BASE 9 | COPY --from=build /hello /usr/local/bin/ 10 | CMD ["hello"] 11 | -------------------------------------------------------------------------------- /images/gcc-musl/tests/01-version.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail -x 4 | 5 | if [[ "${IMAGE_NAME}" == "" ]]; then 6 | echo "Must set IMAGE_NAME environment variable. Exiting." 7 | exit 1 8 | fi 9 | 10 | docker run --rm $IMAGE_NAME --version 11 | -------------------------------------------------------------------------------- /.github/dependabot.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | version: 2 3 | updates: 4 | - package-ecosystem: "github-actions" 5 | directory: "/" 6 | schedule: 7 | interval: "daily" 8 | open-pull-requests-limit: 10 9 | - package-ecosystem: terraform 10 | directory: "/" 11 | schedule: 12 | interval: "daily" 13 | -------------------------------------------------------------------------------- /images/musl-dynamic/README.md: -------------------------------------------------------------------------------- 1 | ``` 2 | docker pull ghcr.io/wolfi-dev/musl-dynamic:latest 3 | ``` 4 | # Usage 5 | 6 | See the [examples/](https://github.com/chainguard-images/images/tree/main/images/musl-dynamic/examples) directory for 7 | an example C program and associated Dockerfile 8 | that can be used with this image. 9 | -------------------------------------------------------------------------------- /images/alpine-base/examples/go/Dockerfile: -------------------------------------------------------------------------------- 1 | ARG BASE=ghcr.io/wolfi-dev/alpine-base 2 | 3 | FROM golang:1.18@sha256:50c889275d26f816b5314fc99f55425fa76b18fcaf16af255f5d57f09e1f48da as build 4 | WORKDIR /go/src/app 5 | COPY . . 6 | RUN go build -o /go/bin/app 7 | 8 | FROM $BASE 9 | COPY --from=build /go/bin/app / 10 | CMD ["/app"] 11 | -------------------------------------------------------------------------------- /images/static/examples/Dockerfile.rust: -------------------------------------------------------------------------------- 1 | ARG BASE=cgr.dev/chainguard/static 2 | 3 | FROM cgr.dev/chainguard/rust as build 4 | 5 | RUN echo 'fn main() { println!("Hello"); }' > hello.rs 6 | RUN rustc -C target-feature=+crt-static hello.rs 7 | 8 | FROM $BASE 9 | 10 | COPY --from=build /work/hello /usr/local/bin/ 11 | CMD ["hello"] 12 | -------------------------------------------------------------------------------- /images/busybox/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "runs" { 12 | digest = var.digest 13 | script = "${path.module}/runs.sh" 14 | } 15 | -------------------------------------------------------------------------------- /images/alpine-base/README.md: -------------------------------------------------------------------------------- 1 | Alpine base image built with [apko](https://github.com/chainguard-dev/apko). Uses packages from the [Alpine distribution](https://www.alpinelinux.org/). 2 | 3 | ``` 4 | docker run ghcr.io/wolfi-dev/alpine-base echo "hello" 5 | ``` 6 | 7 | See the [examples/](./examples/) directory for how 8 | to use this as a base image. 9 | -------------------------------------------------------------------------------- /images/alpine-base/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "echo" { 12 | digest = var.digest 13 | script = "${path.module}/01-echo.sh" 14 | } 15 | -------------------------------------------------------------------------------- /images/gcc-musl/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "echo" { 12 | digest = var.digest 13 | script = "${path.module}/01-version.sh" 14 | } 15 | -------------------------------------------------------------------------------- /images/sdk/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "echo" { 12 | digest = var.digest 13 | script = "${path.module}/01-has-all-tools.sh" 14 | } 15 | -------------------------------------------------------------------------------- /images/musl-dynamic/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "echo" { 12 | digest = var.digest 13 | script = "${path.module}/01-dockerfile-c-build.sh" 14 | } 15 | -------------------------------------------------------------------------------- /images/static/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | data "oci_exec_test" "version" { 12 | digest = var.digest 13 | script = "./01-multi-dockerfile-build.sh" 14 | working_dir = path.module 15 | } 16 | -------------------------------------------------------------------------------- /images/gcc-musl/configs/latest.apko.yaml: -------------------------------------------------------------------------------- 1 | contents: 2 | packages: 3 | - ca-certificates-bundle 4 | - alpine-baselayout-data 5 | - alpine-release==3 6 | - gcc 7 | - musl-dev==1 8 | - busybox 9 | 10 | paths: 11 | - path: /work 12 | type: directory 13 | permissions: 0o777 14 | 15 | work-dir: /work 16 | 17 | entrypoint: 18 | command: /usr/bin/gcc 19 | cmd: --help 20 | -------------------------------------------------------------------------------- /images/spdx-tools/configs/latest.apko.yaml: -------------------------------------------------------------------------------- 1 | contents: 2 | packages: 3 | - busybox 4 | - spdx-tools-java 5 | 6 | environment: 7 | LANG: en_US.UTF-8 8 | JAVA_HOME: /usr/lib/jvm/default-jvm 9 | 10 | accounts: 11 | groups: 12 | - gid: 65532 13 | groupname: nonroot 14 | users: 15 | - uid: 65532 16 | gid: 65532 17 | username: nonroot 18 | run-as: "65532" 19 | 20 | entrypoint: 21 | command: /usr/bin/tools-java 22 | -------------------------------------------------------------------------------- /images/musl-dynamic/tests/01-dockerfile-c-build.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail -x 4 | 5 | if [[ "${IMAGE_NAME}" == "" ]]; then 6 | echo "Must set IMAGE_NAME environment variable. Exiting." 7 | exit 1 8 | fi 9 | 10 | cd "$(dirname ${BASH_SOURCE[0]})/.." 11 | 12 | docker build --build-arg BASE="${IMAGE_NAME}" --tag smoke-test --file examples/Dockerfile.c examples 13 | docker run --rm smoke-test 14 | -------------------------------------------------------------------------------- /tflib/version-tags/main.tf: -------------------------------------------------------------------------------- 1 | variable "config" { 2 | description = "The resolved apko configuration." 3 | } 4 | 5 | variable "package" { 6 | type = string 7 | description = "The name of the package from which to extract version tags." 8 | } 9 | 10 | output "tag_list" { 11 | value = [ 12 | for x in var.config.contents.packages : regexall("(((([a-z0-9]+)(?:[.][a-z0-9]+)?)(?:[.][a-z0-9]+)?)(?:[-][a-z0-9]+)?)", trimprefix(x, "${var.package}=")) if startswith(x, "${var.package}=") 13 | ][0][0] 14 | } 15 | -------------------------------------------------------------------------------- /images/static/alpine.tf: -------------------------------------------------------------------------------- 1 | module "alpine" { 2 | providers = { 3 | apko = apko.alpine 4 | } 5 | source = "chainguard-dev/apko/publisher" 6 | version = "0.0.17" 7 | 8 | target_repository = var.target_repository 9 | config = file("${path.module}/configs/alpine.apko.yaml") 10 | extra_packages = [] # Override the default, which includes `wolfi-baselayout` 11 | check_sbom = false 12 | } 13 | 14 | module "test-alpine" { 15 | source = "./tests" 16 | digest = module.alpine.image_ref 17 | } 18 | -------------------------------------------------------------------------------- /images/busybox/alpine.tf: -------------------------------------------------------------------------------- 1 | module "alpine" { source = "./config/alpine" } 2 | 3 | module "latest-alpine" { 4 | providers = { apko = apko.alpine } 5 | 6 | source = "chainguard-dev/apko/publisher" 7 | version = "0.0.17" 8 | 9 | target_repository = var.target_repository 10 | config = module.alpine.config 11 | # Override the module's default wolfi packages that conflict with alpine 12 | extra_packages = [] 13 | } 14 | 15 | module "test-latest-alpine" { 16 | source = "./tests" 17 | digest = module.latest-alpine.image_ref 18 | } 19 | -------------------------------------------------------------------------------- /images/static/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | apko = { 5 | source = "chainguard-dev/apko" 6 | configuration_aliases = [apko.alpine] 7 | } 8 | } 9 | } 10 | 11 | variable "target_repository" { 12 | description = "The docker repo into which the image and attestations should be published." 13 | } 14 | 15 | resource "oci_tag" "alpine" { 16 | depends_on = [module.test-alpine] 17 | digest_ref = module.alpine.image_ref 18 | tag = "alpine" 19 | } 20 | -------------------------------------------------------------------------------- /images/busybox/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | apko = { 5 | source = "chainguard-dev/apko" 6 | configuration_aliases = [apko.alpine] 7 | } 8 | } 9 | } 10 | 11 | variable "target_repository" { 12 | description = "The docker repo into which the image and attestations should be published." 13 | } 14 | 15 | resource "oci_tag" "alpine" { 16 | depends_on = [module.test-latest-alpine] 17 | digest_ref = module.latest-alpine.image_ref 18 | tag = "alpine" 19 | } 20 | -------------------------------------------------------------------------------- /images/git/tests/repo-clone.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail -x 4 | 5 | CLONE_URL=${CLONE_URL:-"https://github.com/chainguard-images/.github.git"} 6 | 7 | CLONEDIR="$(mktemp -d)" 8 | chmod go+wrx "${CLONEDIR}" 9 | 10 | # TODO: re-enable this delete. After performing the clone 11 | # in some cases, this results in a "permission denied" error 12 | # trap "rm -rf ${CLONEDIR}" EXIT 13 | 14 | # Try cloning a repo and check for README.md 15 | pushd "${CLONEDIR}" 16 | docker run --rm -v "${PWD}":/w -w /w $IMAGE_NAME clone --depth 1 $CLONE_URL . 17 | popd 18 | find "${CLONEDIR}/README.md" && echo "Smoketest passed." 19 | -------------------------------------------------------------------------------- /images/static/tests/01-multi-dockerfile-build.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail -x 4 | 5 | cd "$(dirname ${BASH_SOURCE[0]})/.." 6 | 7 | # Using registry.local:5000 as the BASE arg in `docker build` fails with 8 | # current versions of docker that use containerd under the hood. 9 | # Pre-pulling it uses docker's heuristics for allowing insecure registries. 10 | docker pull ${IMAGE_NAME} 11 | 12 | for lang in c golang rust; do 13 | docker build --build-arg BASE=${IMAGE_NAME} --tag smoke-test-${lang}-${FREE_PORT} --file examples/Dockerfile.${lang} examples 14 | docker run --rm smoke-test-${lang}-${FREE_PORT} 15 | done 16 | -------------------------------------------------------------------------------- /images/gcc-musl/DEVELOPMENT.md: -------------------------------------------------------------------------------- 1 | # gcc-musl Development 2 | 3 | This doc covers building the gcc-musl image locally with apko, and using it with Docker. 4 | 5 | ## Building -musl Locally 6 | 7 | First build the image first using apko: 8 | ``` 9 | apko build apko.yaml gcc-musl:devel gcc-musl.tar 10 | ``` 11 | 12 | Next, load the image from the tarball: 13 | ``` 14 | docker load < gcc-musl.tar 15 | ``` 16 | 17 | Try building something: 18 | ``` 19 | docker run --rm -v "${PWD}:/work" -w /work/examples/hello \ 20 | gcc-musl:devel main.c -o /work/hello 21 | ``` 22 | 23 | Finally, try running it: 24 | ``` 25 | docker run --rm -v "${PWD}:/work" --entrypoint /work/hello \ 26 | gcc-musl:devel 27 | ``` 28 | -------------------------------------------------------------------------------- /images/git/tests/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | } 5 | } 6 | 7 | variable "digest" { 8 | description = "The image digest to run tests over." 9 | } 10 | 11 | variable "check-dev" { 12 | default = false 13 | } 14 | 15 | data "oci_exec_test" "version" { 16 | digest = var.digest 17 | script = "docker run --rm $IMAGE_NAME --version" 18 | } 19 | 20 | data "oci_exec_test" "submodule" { 21 | count = var.check-dev ? 1 : 0 22 | 23 | digest = var.digest 24 | script = "docker run --rm $IMAGE_NAME submodule -h" 25 | } 26 | 27 | data "oci_exec_test" "clone" { 28 | digest = var.digest 29 | script = "${path.module}/repo-clone.sh" 30 | } 31 | -------------------------------------------------------------------------------- /images/spdx-tools/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | apko = { source = "chainguard-dev/apko" } 4 | oci = { source = "chainguard-dev/oci" } 5 | } 6 | } 7 | 8 | variable "target_repository" { 9 | description = "The docker repo into which the image and attestations should be published." 10 | } 11 | 12 | module "latest" { 13 | source = "chainguard-dev/apko/publisher" 14 | version = "0.0.17" 15 | 16 | target_repository = var.target_repository 17 | config = file("${path.module}/configs/latest.apko.yaml") 18 | check_sbom = true 19 | } 20 | 21 | resource "oci_tag" "version-tags" { 22 | digest_ref = module.latest.image_ref 23 | tag = "latest" 24 | } 25 | -------------------------------------------------------------------------------- /images/busybox/config/alpine/main.tf: -------------------------------------------------------------------------------- 1 | variable "extra_packages" { 2 | description = "Extra packages to install." 3 | type = list(string) 4 | default = [] 5 | } 6 | 7 | output "config" { 8 | value = jsonencode({ 9 | contents = { 10 | packages = concat([ 11 | "busybox", 12 | "ssl_client", # ssl_client allows the busybox wget applet to use https. 13 | ], var.extra_packages) 14 | } 15 | accounts = { 16 | groups = [{ 17 | groupname = "nonroot" 18 | gid = 65532 19 | }] 20 | users = [{ 21 | username = "nonroot" 22 | uid = 65532 23 | gid = 65532 24 | }] 25 | run-as = 65532 26 | } 27 | }) 28 | } 29 | -------------------------------------------------------------------------------- /images/git/alpine.tf: -------------------------------------------------------------------------------- 1 | module "alpine" { 2 | for_each = local.accounts 3 | source = "./config" 4 | root = each.key == "root" 5 | extra_repositories = ["https://dl-cdn.alpinelinux.org/alpine/edge/community"] 6 | } 7 | 8 | module "latest-alpine" { 9 | providers = { 10 | apko = apko.alpine 11 | } 12 | for_each = local.accounts 13 | source = "chainguard-dev/apko/publisher" 14 | version = "0.0.17" 15 | 16 | target_repository = var.target_repository 17 | config = module.alpine[each.key].config 18 | extra_packages = [] // Don't add wolfi-baselayout 19 | } 20 | 21 | module "test-latest-alpine" { 22 | for_each = local.accounts 23 | source = "./tests" 24 | digest = module.latest-alpine[each.key].image_ref 25 | } 26 | -------------------------------------------------------------------------------- /images/git/main.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | oci = { source = "chainguard-dev/oci" } 4 | apko = { 5 | source = "chainguard-dev/apko" 6 | configuration_aliases = [apko.alpine] 7 | } 8 | } 9 | } 10 | 11 | locals { 12 | accounts = toset(["nonroot", "root"]) 13 | } 14 | 15 | variable "target_repository" { 16 | description = "The docker repo into which the image and attestations should be published." 17 | } 18 | 19 | resource "oci_tag" "alpine" { 20 | depends_on = [module.test-latest-alpine] 21 | digest_ref = module.latest-alpine["nonroot"].image_ref 22 | tag = "alpine" 23 | } 24 | 25 | resource "oci_tag" "alpine-root" { 26 | depends_on = [module.test-latest-alpine] 27 | digest_ref = module.latest-alpine["root"].image_ref 28 | tag = "alpine-root" 29 | } 30 | -------------------------------------------------------------------------------- /images/busybox/tests/runs.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -o errexit -o nounset -o errtrace -o pipefail -x 4 | 5 | docker run --rm $IMAGE_NAME ls >/dev/null 6 | 7 | # The image runs as nonroot by default. 8 | docker run --rm --entrypoint '' $IMAGE_NAME whoami | grep "^nonroot$" 9 | 10 | # The image contains many common utilities (some in /usr/bin and some in /bin) 11 | for cmd in awk basename cat chmod chown cp cut date dirname du echo egrep expr find grep head id ln ls mkdir mktemp mv printf pwd rm rmdir sed sh sort tail tar tee test touch tr uname uniq wc xargs; do 12 | docker run --rm $IMAGE_NAME which $cmd | grep "/bin/$cmd$" 13 | done 14 | 15 | # The image can be used as a base image. 16 | cat <