9176399f50
- Enabled GitLab Container Registry on its own subdomain via NPM/mkcert - Built minimal ssh-alpine image (Alpine + OpenSSH, key-only auth) - Docker-outside-of-Docker build pipeline reusing the host socket, no DinD - Forced --pull --no-cache builds so scheduled rebuilds pick up real upstream updates - Biweekly Pipeline Schedule (cron: 0 3 */14 * *) - Registry cleanup policy to prevent unbounded tag growth - Documented the Tailscale/Pi-hole DNS conflict and other gotchas hit along the way
18 lines
628 B
Docker
18 lines
628 B
Docker
FROM alpine:3.20
|
|
|
|
RUN apk add --no-cache openssh-server && \
|
|
ssh-keygen -A && \
|
|
adduser -D -s /bin/ash ciuser && \
|
|
mkdir -p /home/ciuser/.ssh && \
|
|
chmod 700 /home/ciuser/.ssh && \
|
|
chown -R ciuser:ciuser /home/ciuser/.ssh
|
|
|
|
# Disable root login and password auth by default — key-based only.
|
|
# Override at container runtime if a specific pipeline job genuinely needs
|
|
# password auth (it shouldn't).
|
|
RUN sed -i 's/#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
|
|
sed -i 's/#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
|
|
EXPOSE 22
|
|
CMD ["/usr/sbin/sshd", "-D"]
|