mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-24 14:29:07 +02:00
Maycon Santos
c051ca8f87
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys Eight eMudhra intermediate CA private keys were compromised and browsers blocked them on 2026-10-17. Our binaries were built with go1.26.7, which accepts chains through those intermediates whenever the trust store still holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on every platform, regardless of the trust store. The UBI base still ships the root and Red Hat has no fixed package yet, so the UBI images blocklist it with p11-kit. The ingest image, the UI server image and the pinned Chainguard digests also carried the root and move to bases that no longer do. * [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22, which drops emSign ECC Root CA - G3 and AAA Certificate Services. The current ubi9-minimal image carries it, so pin that digest and remove the p11-kit blocklist step. * [misc] Pin upload-server images by digest only and restore go.mod comment
38 lines
1.6 KiB
Docker
38 lines
1.6 KiB
Docker
# Multistage build for nblink, used in e2e tests. The release image
|
|
# (client/Dockerfile-nblink) packages a goreleaser artifact, so this compiles
|
|
# from source the way Dockerfile.client does for the agent, while keeping the
|
|
# release image's runtime shape: distroless, non-root, numeric UID.
|
|
#
|
|
# The runtime stage deliberately grants nothing. nblink's claim is that it
|
|
# needs no TUN device and no capabilities, so an image or a container request
|
|
# that quietly hands it NET_ADMIN would make the suite prove the opposite of
|
|
# what it is for.
|
|
|
|
FROM golang:1.26.10-bookworm AS builder
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod go mod download
|
|
COPY . .
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=linux go build -o /out/nblink ./client/link/cmd/nblink \
|
|
&& mkdir -p /out/state/nblink && chmod 770 /out/state/nblink
|
|
|
|
FROM gcr.io/distroless/static-debian13:nonroot
|
|
|
|
# Same state directory as the release image, so a volume mounted over it
|
|
# starts out owned by 65532:0 and the identity-persistence case runs against
|
|
# the ownership the release image ships.
|
|
COPY --from=builder --chown=65532:0 /out/state/ /var/lib/
|
|
|
|
# Numeric, as in the release image: the runtime may substitute its own UID and
|
|
# there is no passwd entry to look up.
|
|
USER 65532:0
|
|
|
|
# No NB_STATE_DIR by default. State stays in memory and each run registers a
|
|
# fresh peer; the persistence case sets it explicitly with a volume.
|
|
ENV NB_LOG_LEVEL=info
|
|
|
|
COPY --from=builder /out/nblink /usr/local/bin/nblink
|
|
ENTRYPOINT ["/usr/local/bin/nblink"]
|