deploy/server/backup.Dockerfile

Ref: main v0.0.5   Size: 1.2 KiB   History

# The nightly backup job's image: alpine with sqlite already in it.
#
# The job used to run `apk add --no-cache sqlite` on every execution, which put
# the Alpine CDN on the critical path of the one thing that protects a database
# nobody can rebuild. A transient fetch failure took the night's backup with it,
# and the only trace was a CronJob pod in Error that nothing was watching.
#
# Nothing here is versioned against a release: the job runs one sqlite command
# and does not change when eitri does, so this image carries its own tag and is
# rebuilt only when the base moves.
# 3.24, not the 3.20 the job inherited: 3.20 is past end-of-life, so it receives
# no further security fixes and the image scanner's --ignore-unfixed would then
# quietly pass anything found in it. Bump when this line goes EOL too.
FROM docker.io/library/alpine:3.24

# The base tag lags Alpine's own package repo, so an image built while an
# advisory is open carries the vulnerable package and scan-image refuses it.
# Take the distro's fixes here rather than waiting for the base to be rebuilt.
RUN apk --no-cache upgrade && apk add --no-cache sqlite

# Backups are written to a mounted PVC as root; the job creates /data/backups.
ENTRYPOINT ["/bin/sh", "-c"]