diff options
| author | Adam Soltys <[email protected]> | 2026-10-21 05:58:15 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-10-21 05:58:15 -0700 |
| commit | ad6ebbb9f5803b92b22b8803b491df19d7cf433b (patch) | |
| tree | 67136224a5407c07a2dfdd4e52c644ce0571b771 /docker/base.Dockerfile | |
| parent | 2a7cf2cf3692c0a958056b74c9a9b319c14a3605 (diff) | |
| download | coinos-server-ad6ebbb9f5803b92b22b8803b491df19d7cf433b.tar.gz coinos-server-ad6ebbb9f5803b92b22b8803b491df19d7cf433b.zip | |
base: take emSign ECC Root CA - G3 out of bun's built-in root store
Bun compiles Mozilla's roots into its binary and NODE_USE_SYSTEM_CA only
adds to them, so the fixed Debian ca-certificates doesn't reach fetch/tls.
docker/bun-distrust.ts overwrites the root's DER in place with a same-length
self-signed placeholder (key discarded) at image build time. Drop it once a
bun release removes the root itself.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Diffstat (limited to 'docker/base.Dockerfile')
| -rw-r--r-- | docker/base.Dockerfile | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docker/base.Dockerfile b/docker/base.Dockerfile index af323af9..594b0d70 100644 --- a/docker/base.Dockerfile +++ b/docker/base.Dockerfile @@ -1,3 +1,4 @@ +# docker build -f docker/base.Dockerfile -t ghcr.io/coinos/base docker/ FROM debian:trixie-slim ARG BUN_VERSION=1.4.3 @@ -16,5 +17,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ /usr/share/doc /usr/share/man /usr/share/locale \ /usr/share/info /var/log/* /tmp/* +COPY bun-distrust.ts /tmp/ +RUN cp /usr/local/bin/bun /tmp/bun \ + && /tmp/bun /tmp/bun-distrust.ts /usr/local/bin/bun \ + && rm /tmp/bun /tmp/bun-distrust.ts + RUN groupadd -g 1000 bun && useradd -u 1000 -g bun -m -s /bin/sh bun WORKDIR /home/bun/app |