mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-24 14:29:07 +02:00
Maycon Santos
c051ca8f87
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys Eight eMudhra intermediate CA private keys were compromised and browsers blocked them on 2026-10-17. Our binaries were built with go1.26.7, which accepts chains through those intermediates whenever the trust store still holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on every platform, regardless of the trust store. The UBI base still ships the root and Red Hat has no fixed package yet, so the UBI images blocklist it with p11-kit. The ingest image, the UI server image and the pinned Chainguard digests also carried the root and move to bases that no longer do. * [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22, which drops emSign ECC Root CA - G3 and AAA Certificate Services. The current ubi9-minimal image carries it, so pin that digest and remove the p11-kit blocklist step. * [misc] Pin upload-server images by digest only and restore go.mod comment
29 lines
1.4 KiB
Docker
29 lines
1.4 KiB
Docker
# Multistage build for the NetBird client used in e2e tests. The repo has no
|
|
# source-building client Dockerfile (client/Dockerfile packages a goreleaser
|
|
# artifact), so this mirrors its alpine runtime + entrypoint while compiling the
|
|
# CGO-free client inline. BuildKit cache mounts keep rebuilds incremental.
|
|
|
|
FROM golang:1.26.10-bookworm AS builder
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod go mod download
|
|
COPY . .
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=linux go build -o /out/netbird ./client
|
|
|
|
FROM alpine:3.24
|
|
RUN apk add --no-cache bash ca-certificates ip6tables iproute2 iptables
|
|
ENV NETBIRD_BIN="/usr/local/bin/netbird" \
|
|
NB_LOG_FILE="console,/var/log/netbird/client.log" \
|
|
NB_DAEMON_ADDR="unix:///var/run/netbird.sock" \
|
|
NB_ENABLE_CAPTURE="false" \
|
|
NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
|
|
ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
|
|
# --chmod because the build context is not always a git checkout. A suite in
|
|
# another module builds from this module's extracted copy in the module cache,
|
|
# where every file is 0444 — the cache drops the executable bit git records — and
|
|
# a bare COPY then produces an entrypoint the runtime cannot exec.
|
|
COPY --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
|
|
COPY --from=builder /out/netbird /usr/local/bin/netbird
|