mirror of
https://github.com/getnora-io/nora.git
synced 2026-04-12 19:40:31 +00:00
devitway
c1f6430aa9
- Verify blob digest (SHA256) on upload, reject mismatches (DIGEST_INVALID) - Reject sha512 digests (only sha256 supported) - Add upload session limits: max 100 concurrent, 2GB per session, 30min TTL - Bind upload sessions to repository name (prevent session fixation) - Filter .meta.json from Docker tag list (fix ArgoCD Image Updater recursion) - Fix catalog to show namespaced images (library/alpine instead of library) - Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy - Run containers as non-root user (USER nora) in all 3 Dockerfiles - Add configurable NORA_MAX_UPLOAD_SESSIONS and NORA_MAX_UPLOAD_SESSION_SIZE_MB
26 lines
643 B
Docker
26 lines
643 B
Docker
# syntax=docker/dockerfile:1.4
|
|
# Binary is pre-built by CI (cargo build --release) and passed via context
|
|
FROM alpine:3.20@sha256:a4f4213abb84c497377b8544c81b3564f313746700372ec4fe84653e4fb03805
|
|
|
|
RUN apk add --no-cache ca-certificates \
|
|
&& addgroup -S nora && adduser -S -G nora nora \
|
|
&& mkdir -p /data && chown nora:nora /data
|
|
|
|
COPY --chown=nora:nora nora /usr/local/bin/nora
|
|
|
|
ENV RUST_LOG=info
|
|
ENV NORA_HOST=0.0.0.0
|
|
ENV NORA_PORT=4000
|
|
ENV NORA_STORAGE_MODE=local
|
|
ENV NORA_STORAGE_PATH=/data/storage
|
|
ENV NORA_AUTH_TOKEN_STORAGE=/data/tokens
|
|
|
|
EXPOSE 4000
|
|
|
|
VOLUME ["/data"]
|
|
|
|
USER nora
|
|
|
|
ENTRYPOINT ["/usr/local/bin/nora"]
|
|
CMD ["serve"]
|