hadolint

Author: joecorall

.github/workflows/push.yaml

@@ -9,6 +9,10 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - run: shellcheck *.sh
+      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        with:
+          dockerfile: Dockerfile
+          verbose: true
   push:
     needs: [lint]
     uses: libops/.github/.github/workflows/build-push-ghcr.yaml@main

Dockerfile

@@ -1,13 +1,68 @@
-FROM node:24@sha256:aa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9
+FROM node:24-trixie@sha256:1501d5fd51032aa10701a7dcc9e6c72ab1e611a033ffcf08b6d5882e9165f63e
 
 ARG TZ
 ENV TZ="$TZ"
 
-# install go
-WORKDIR /go
-COPY download.sh /usr/local/bin
+RUN mkdir -p /usr/local/share/npm-global && \
+  chown -R node:node /usr/local/share && \
+  mkdir -p /workspace /home/node/.claude && \
+  chown -R node:node /workspace /home/node/.claude
+
+WORKDIR /workspace
+
+USER node
+ENV \
+  NPM_CONFIG_PREFIX=/usr/local/share/npm-global \
+  PATH=$PATH:/usr/local/share/npm-global/bin \
+  SHELL=/bin/bash \
+  EDITOR=vim
+
 ARG \
-  TARGETARCH=amd64 \
+  # renovate: datasource=npm depName=@anthropic-ai/claude-code
+  CLAUDE_CLI_VERSION=v2.0.60 \
+  # renovate: datasource=npm depName=@google/gemini-cli
+  GEMINI_CLI_VERSION=v0.19.4
+
+RUN npm install -g "@anthropic-ai/claude-code@$CLAUDE_CLI_VERSION" && \
+  npm install -g "@google/gemini-cli@$GEMINI_CLI_VERSION"
+
+USER root
+ARG \
+  TARGETARCH \
+  # renovate: datasource=repology depName=debian_13/aggregate
+  AGGREGATE_VERSION=1.6-8 \
+  # renovate: datasource=repology depName=debian_13/bind9
+  BIND9_VERSION=1:9.20.15-1~deb13u1 \
+  # renovate: datasource=repology depName=debian_13/fzf
+  FZF_VERSION=0.60.3-1+b2 \
+  # renovate: datasource=repology depName=debian_13/gh
+  GH_VERSION=2.46.0-3 \
+  # renovate: datasource=repology depName=debian_13/git
+  GIT_VERSION=1:2.47.3-0+deb13u1 \
+  # renovate: datasource=repology depName=debian_13/gnupg2
+  GNUPG2_VERSION=2.4.7-21 \
+  # renovate: datasource=repology depName=debian_13/iproute2
+  IPROUTE2_VERSION=6.15.0-1 \
+  # renovate: datasource=repology depName=debian_13/ipset
+  IPSET_VERSION=7.22-1+b1 \
+  # renovate: datasource=repology depName=debian_13/iptables
+  IPTABLES_VERSION=1.8.11-2 \
+  # renovate: datasource=repology depName=debian_13/jq
+  JQ_VERSION=1.7.1-6+deb13u1 \
+  # renovate: datasource=repology depName=debian_13/less
+  LESS_VERSION=668-1 \
+  # renovate: datasource=repology depName=debian_13/make-dfsg
+  MAKE_VERSION=4.4.1-2 \
+  # renovate: datasource=repology depName=debian_13/man-db
+  MAN_DB_VERSION=2.13.1-1 \
+  # renovate: datasource=repology depName=debian_13/procps
+  PROCPS_VERSION=2:4.0.4-9 \
+  # renovate: datasource=repology depName=debian_13/sudo
+  SUDO_VERSION=1.9.16p2-3 \
+  # renovate: datasource=repology depName=debian_13/unzip
+  UNZIP_VERSION=6.0-29 \
+  # renovate: datasource=repology depName=debian_13/vim
+  VIM_VERSION=2:9.1.1230-2 \
   # renovate: datasource=github-tags depName=golang packageName=golang/go versioning=go-mod-directive
   GO_VERSION=go1.25.3 \
   GO_BASE_URL="https://go.dev/dl/${GO_VERSION}" \
@@ -16,6 +71,27 @@ ARG \
   GO_ARM64=linux-arm64.tar.gz \
   GO_ARM64_SHA256="1d42ebc84999b5e2069f5e31b67d6fc5d67308adad3e178d5a2ee2c9ff2001f5"
 
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  aggregate="${AGGREGATE_VERSION}" \
+  bind9-dnsutils="${BIND9_VERSION}" \
+  fzf="${FZF_VERSION}" \
+  gh="${GH_VERSION}" \
+  git="${GIT_VERSION}" \
+  gnupg2="${GNUPG2_VERSION}" \
+  iproute2="${IPROUTE2_VERSION}" \
+  ipset="${IPSET_VERSION}" \
+  iptables="${IPTABLES_VERSION}" \
+  jq="${JQ_VERSION}" \
+  less="${LESS_VERSION}" \
+  make="${MAKE_VERSION}" \
+  man-db="${MAN_DB_VERSION}" \
+  procps="${PROCPS_VERSION}" \
+  sudo="${SUDO_VERSION}" \
+  unzip="${UNZIP_VERSION}" \
+  vim="${VIM_VERSION}" \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+COPY download.sh /usr/local/bin
 RUN --mount=type=cache,id=base-downloads-${TARGETARCH},sharing=locked,target=/opt/downloads \
   if [ "${TARGETARCH}" = "amd64" ]; \
   then \
@@ -30,82 +106,11 @@ RUN --mount=type=cache,id=base-downloads-${TARGETARCH},sharing=locked,target=/op
   --dest /usr/local ; \
   fi
 
-
-# Install basic development tools and iptables/ipset
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  less \
-  git \
-  procps \
-  sudo \
-  fzf \
-  zsh \
-  man-db \
-  unzip \
-  gnupg2 \
-  gh \
-  iptables \
-  ipset \
-  iproute2 \
-  dnsutils \
-  aggregate \
-  jq \
-  nano \
-  vim \
-  make \
-  && apt-get clean && rm -rf /var/lib/apt/lists/*
-
-# Ensure default node user has access to /usr/local/share
-RUN mkdir -p /usr/local/share/npm-global && \
-  chown -R node:node /usr/local/share && \
-  mkdir -p /workspace /home/node/.claude && \
-  chown -R node:node /workspace /home/node/.claude
-
-WORKDIR /workspace
-
-ARG GIT_DELTA_VERSION=0.18.2
-RUN ARCH=$(dpkg --print-architecture) && \
-  wget --progress=dot:giga "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" && \
-  dpkg -i "git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" && \
-  rm "git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb"
-
-# Set up non-root user
-USER node
-
-# Install global packages
-ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
-ENV PATH=$PATH:/usr/local/share/npm-global/bin
-
-# Set the default shell to zsh rather than sh
-ENV SHELL=/bin/zsh
-
-# Set the default editor and visual
-ENV EDITOR=nano
-ENV VISUAL=nano
-
-# Default powerline10k theme
-ARG ZSH_IN_DOCKER_VERSION=1.2.0
-RUN sh -c "$(wget --progress=dot:giga -O- https://github.com/deluan/zsh-in-docker/releases/download/v${ZSH_IN_DOCKER_VERSION}/zsh-in-docker.sh)" -- \
-  -p git \
-  -p fzf \
-  -a "source /usr/share/doc/fzf/examples/key-bindings.zsh" \
-  -a "source /usr/share/doc/fzf/examples/completion.zsh" \
-  -a "export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \
-  -x
-
-ARG \
-  # renovate: datasource=npm depName=@anthropic-ai/claude-code
-  CLAUDE_CLI_VERSION=v2.0.60 \
-  # renovate: datasource=npm depName=@google/gemini-cli
-  GEMINI_CLI_VERSION=v0.19.4
-RUN npm install -g @anthropic-ai/claude-code@$CLAUDE_CLI_VERSION
-RUN npm install -g @google/gemini-cli@$GEMINI_CLI_VERSION
-
-# Copy and set up firewall script
-COPY init-firewall.sh /usr/local/bin/
-USER root
+COPY --chown=node init-firewall.sh /usr/local/bin/
 RUN chmod +x /usr/local/bin/init-firewall.sh && \
   echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
   chmod 0440 /etc/sudoers.d/node-firewall
+
 USER node
 ENV \
   NODE_OPTIONS="--max-old-space-size=4096" \