mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-24 14:29:07 +02:00
Maycon Santos
c051ca8f87
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys Eight eMudhra intermediate CA private keys were compromised and browsers blocked them on 2026-10-17. Our binaries were built with go1.26.7, which accepts chains through those intermediates whenever the trust store still holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on every platform, regardless of the trust store. The UBI base still ships the root and Red Hat has no fixed package yet, so the UBI images blocklist it with p11-kit. The ingest image, the UI server image and the pinned Chainguard digests also carried the root and move to bases that no longer do. * [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22, which drops emSign ECC Root CA - G3 and AAA Certificate Services. The current ubi9-minimal image carries it, so pin that digest and remove the p11-kit blocklist step. * [misc] Pin upload-server images by digest only and restore go.mod comment
46 lines
1.6 KiB
Plaintext
46 lines
1.6 KiB
Plaintext
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
|
|
|
|
ARG TARGETPLATFORM
|
|
ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
|
|
ARG VERSION=dev
|
|
ARG RELEASE=1
|
|
|
|
LABEL name="netbird-rootless" \
|
|
maintainer="NetBird <dev@netbird.io>" \
|
|
vendor="NetBird GmbH" \
|
|
version="${VERSION}" \
|
|
release="${RELEASE}" \
|
|
summary="NetBird Rootless Client" \
|
|
description="NetBird connects devices through an encrypted overlay using userspace networking without a TUN device or network administration capabilities."
|
|
|
|
RUN microdnf install -y bash ca-certificates && microdnf clean all
|
|
|
|
COPY --chmod=0555 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
|
|
COPY --chmod=0555 ${NETBIRD_BINARY} /usr/local/bin/netbird
|
|
COPY licenses/ /licenses/
|
|
# Only application storage is group-writable for arbitrary non-root UIDs.
|
|
# Runtime-created credentials keep the client's restrictive file modes.
|
|
RUN mkdir -p /var/lib/netbird && \
|
|
chown 1000:0 /var/lib/netbird && \
|
|
chmod 0770 /var/lib/netbird && \
|
|
chmod -R a+rX /licenses
|
|
|
|
WORKDIR /var/lib/netbird
|
|
USER 1000:0
|
|
|
|
ENV \
|
|
HOME="/var/lib/netbird" \
|
|
NETBIRD_BIN="/usr/local/bin/netbird" \
|
|
NB_USE_NETSTACK_MODE="true" \
|
|
NB_ENABLE_NETSTACK_LOCAL_FORWARDING="true" \
|
|
NB_CONFIG="/var/lib/netbird/config.json" \
|
|
NB_STATE_DIR="/var/lib/netbird" \
|
|
NB_DAEMON_ADDR="unix:///var/lib/netbird/netbird.sock" \
|
|
NB_LOG_FILE="console,/var/lib/netbird/client.log" \
|
|
NB_DISABLE_DNS="true" \
|
|
NB_ENABLE_CAPTURE="false" \
|
|
NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
|
|
|
|
STOPSIGNAL SIGTERM
|
|
ENTRYPOINT ["/usr/local/bin/netbird-entrypoint.sh"]
|