Update release.yml

.github/dependabot.yml

@@ -1,21 +1,16 @@
 # Docs: <https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/customizing-dependency-updates>
 
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    reviewers:
-      - "tarampampam"
-    assignees:
-      - "tarampampam"
 
-  - package-ecosystem: "docker"
+updates:
-    directory: "/"
+  - package-ecosystem: github-actions
-    schedule:
+    directory: /
-      interval: "weekly"
+    schedule: {interval: monthly}
-    reviewers:
+    reviewers: [tarampampam]
-      - "tarampampam"
+    assignees: [tarampampam]
-    assignees:
+
-      - "tarampampam"
+  - package-ecosystem: docker
+    directory: /
+    schedule: {interval: monthly}
+    reviewers: [tarampampam]
+    assignees: [tarampampam]

.github/workflows/release.yml

@@ -12,27 +12,31 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v2
 
-      - name: Docker login in default registry
+      - uses: gacts/github-slug@v1
-        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_LOGIN }}" --password-stdin &> /dev/null
+        id: slug
 
-      - name: Docker login in ghcr.io # Auth docs: <https://git.io/JLDaw>
+      - uses: docker/setup-buildx-action@v1
-        run: echo "${{ secrets.GHCR_PASSWORD }}" | docker login ghcr.io -u tarampampam --password-stdin
 
-      - name: Generate image tag value
+      - name: Login to default Container Registry
-        id: tag
+        uses: docker/login-action@v1 # Action page: <https://github.com/docker/login-action>
-        run: echo "::set-output name=value::`echo ${GITHUB_REF##*/} | sed -e 's/^[vV ]*//'`" # `/refs/tags/v1.2.3` -> `1.2.3`
+        with:
+          username: ${{ secrets.DOCKER_LOGIN }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build image
+      - name: Login to GitHub Container Registry
-        run: |
+        uses: docker/login-action@v1 # Action page: <https://github.com/docker/login-action>
-          docker build \
+        with:
-            --tag "tarampampam/3proxy:${{ steps.tag.outputs.value }}" \
+          registry: ghcr.io
-            --tag "tarampampam/3proxy:latest" \
+          username: ${{ github.actor }}
-            --tag "ghcr.io/tarampampam/3proxy:${{ steps.tag.outputs.value }}" \
+          password: ${{ secrets.GHCR_PASSWORD }}
-            --tag "ghcr.io/tarampampam/3proxy:latest" \
-            -f ./Dockerfile .
 
-      - name: Push into default registry
+      - uses: docker/build-push-action@v2 # Action page: <https://github.com/docker/build-push-action>
-        run: docker push "tarampampam/3proxy:${{ steps.tag.outputs.value }}" && docker push "tarampampam/3proxy:latest"
+        with:
-
+          context: .
-      - name: Push into ghcr.io
+          file: Dockerfile
-        run: docker push "ghcr.io/tarampampam/3proxy:${{ steps.tag.outputs.value }}" && docker push "ghcr.io/tarampampam/3proxy:latest"
+          push: true
+          tags: |
+            tarampampam/3proxy:${{ steps.slug.outputs.version-semantic }}
+            tarampampam/3proxy:latest
+            ghcr.io/${{ github.actor }}/3proxy:${{ steps.slug.outputs.version-semantic }}
+            ghcr.io/${{ github.actor }}/3proxy:latest

.github/workflows/tests.yml

@@ -2,13 +2,23 @@ name: tests
 
 on:
   push:
-    branches:
+    branches: [master, main]
-      - master
+    tags-ignore: ['**']
-    tags-ignore:
+  pull_request: {}
-      - '**'
-  pull_request:
 
 jobs: # Docs: <https://git.io/JvxXE>
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Check for GitLeaks
+        uses: zricethezav/gitleaks-action@v1.6.0 # Action page: <https://github.com/zricethezav/gitleaks-action>
+
   build-image:
     name: Build docker image
     runs-on: ubuntu-20.04
@@ -20,7 +30,7 @@ jobs: # Docs: <https://git.io/JvxXE>
         run: docker build -f ./Dockerfile --tag 3proxy:local .
 
       - name: Scan image
-        uses: anchore/scan-action@v2 # action page: <https://github.com/anchore/scan-action>
+        uses: anchore/scan-action@v3 # action page: <https://github.com/anchore/scan-action>
         with:
           image: 3proxy:local
           fail-build: true
@@ -34,6 +44,29 @@ jobs: # Docs: <https://git.io/JvxXE>
         with:
           name: docker-image
           path: ./docker-image.tar
+          retention-days: 1
+
+  scan-image:
+    name: Scan docker image
+    runs-on: ubuntu-20.04
+    needs: [build-image]
+    steps:
+      - name: Download built docker image
+        uses: actions/download-artifact@v2
+        with:
+          name: docker-image
+          path: .artifact
+
+      - name: Prepare image to run
+        working-directory: .artifact
+        run: docker load < docker-image.tar
+
+      - name: Scan image
+        uses: anchore/scan-action@v3 # action page: <https://github.com/anchore/scan-action>
+        with:
+          image: 3proxy:local
+          fail-build: true
+          severity-cutoff: low # negligible, low, medium, high or critical
 
   try-to-use:
     name: Build and use docker image (auth ${{ matrix.auth }})

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this package will be documented in this file.
 
 The format is based on [Keep a Changelog][keepachangelog] and this project adheres to [Semantic Versioning][semver].
 
+## v1.5.0
+
+### Fixed
+
+- Docker image building optimized
+
+### Added
+
+- Healthcheck in the dockerfile
+
 ## v1.4.0
 
 ### Changed

Dockerfile

@@ -1,5 +1,5 @@
 # Image page: <https://hub.docker.com/_/gcc>
-FROM gcc:11.1.0 as builder
+FROM gcc:11.2.0 as builder
 
 # e.g.: `docker build --build-arg "VERSION=0.9.4" .`
 ARG VERSION="0.9.4"
@@ -34,39 +34,29 @@ RUN set -x \
     && strip ./bin/SSLPlugin.ld.so
 
 # Prepare filesystem for 3proxy running
-FROM busybox:1.33.1-glibc as buffer
+FROM busybox:1.34.0-glibc as buffer
+
+# create a directory for the future root filesystem
+WORKDIR /tmp/rootfs
+
+# prepare the root filesystem
+RUN set -x \
+    && mkdir -p ./etc ./bin ./usr/local/3proxy/libexec ./etc/3proxy \
+    && echo '3proxy:x:10001:10001::/nonexistent:/sbin/nologin' > ./etc/passwd \
+    && echo '3proxy:x:10001:' > ./etc/group \
+    && wget -O ./bin/dumb-init "https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_x86_64" \
+    && chmod +x ./bin/dumb-init
 
 # Copy binaries
-COPY --from=builder /lib/x86_64-linux-gnu/libdl.so.* /lib/
+COPY --from=builder /lib/x86_64-linux-gnu/libdl.so.* ./lib/
-COPY --from=builder /tmp/3proxy/bin/3proxy /bin/
+COPY --from=builder /tmp/3proxy/bin/3proxy ./bin/3proxy
-COPY --from=builder /tmp/3proxy/bin/*.ld.so /usr/local/3proxy/libexec/
+COPY --from=builder /tmp/3proxy/bin/*.ld.so ./usr/local/3proxy/libexec/
+COPY 3proxy.cfg ./etc/3proxy/3proxy.cfg
+COPY docker-entrypoint.sh ./docker-entrypoint.sh
 
-# Create unprivileged user
+RUN chown -R 10001:10001 ./etc/3proxy
-RUN set -x \
-    && adduser \
-        --disabled-password \
-        --gecos "" \
-        --home /nonexistent \
-        --shell /sbin/nologin \
-        --no-create-home \
-        --uid 10001 \
-        3proxy
 
-# Prepare files and directories
+FROM busybox:1.34.0-glibc
-RUN set -x \
-    && chown -R 10001:10001 /usr/local/3proxy \
-    && chmod -R 550 /usr/local/3proxy \
-    && chmod -R 555 /usr/local/3proxy/libexec \
-    && chown -R root /usr/local/3proxy/libexec \
-    && mkdir /etc/3proxy \
-    && chown -R 10001:10001 /etc/3proxy
-
-# Copy our config and entrypoint script
-COPY 3proxy.cfg /etc/3proxy/3proxy.cfg
-COPY docker-entrypoint.sh /docker-entrypoint.sh
-
-# Split all buffered layers into one
-FROM scratch
 
 LABEL \
     org.opencontainers.image.title="3proxy" \
@@ -77,11 +67,15 @@ LABEL \
     org.opencontainers.image.licenses="WTFPL"
 
 # Import from builder
-COPY --from=buffer / /
+COPY --from=buffer /tmp/rootfs /
 
 # Use an unprivileged user
 USER 3proxy:3proxy
 
-ENTRYPOINT ["/docker-entrypoint.sh"]
+# Docs: <https://docs.docker.com/engine/reference/builder/#healthcheck>
+HEALTHCHECK --interval=5s --timeout=2s --retries=2 --start-period=2s CMD \
+    netstat -ltn | grep 3128 && netstat -ltn | grep 1080
 
-CMD ["/bin/3proxy", "/etc/3proxy/3proxy.cfg"]
+ENTRYPOINT ["/bin/dumb-init", "--"]
+
+CMD ["/docker-entrypoint.sh", "/bin/3proxy", "/etc/3proxy/3proxy.cfg"]