openso/postgres-maintenance
Watch
1
0
Fork
You've already forked postgres-maintenance
 0
Code Issues Pull requests Packages 1 Activity Actions

Build Supercronic from source on golang 1.26.10 and rewrite README #1

Merged
MHE merged 2 commits from review-readme-reference-projects into main 2026-11-01 13:44:16 +01:00
Conversation 0 Commits 2 Files changed 6 +186 -40
MHE commented 2026-11-01 13:34:36 +01:00
Owner
Copy link

Summary

Build Supercronic v0.2.43 from source with Go 1.26.10 in a separate build stage, instead of downloading the upstream release binary (built with Go 1.25.7, which fails the image scan on fixed HIGH standard-library findings).

Changes

  • Dockerfile
    • New supercronic build stage on golang:1.26.10-alpine3.24. It fetches the v0.2.43 source tarball, verifies its SHA-256, pins golang.org/x/sys to v0.49.0, and builds a static binary with CGO_ENABLED=0.
    • Base stage copies the binary from the build stage and checks that supercronic -version reports v0.2.43.
    • Removes the runtime curl and ca-certificates packages and the download step.
    • Removes /usr/local/bin/gosu from the base image, which is built with Go 1.24.6 and is unused (the entrypoint does not drop privileges).
  • AGENTS.md: records the Go 1.26.10 rebuild of the Supercronic tag.
  • README.md: rewritten to document the image: runtime modes (physical restore, logical restore, scheduled backups), environment variables, a Compose example using Docker secrets and a read-only root filesystem, the pinned contents, and the build and versioning process.

Why

The image scan flags fixed HIGH vulnerabilities in the Go standard library shipped inside the upstream Supercronic binary. Rebuilding the same tag with a patched Go toolchain clears those findings without changing Supercronic's behavior. Removing curl, ca-certificates, and gosu reduces the attack surface and the number of pinned packages to maintain.

## Summary Build Supercronic `v0.2.43` from source with Go `1.26.10` in a separate build stage, instead of downloading the upstream release binary (built with Go 1.25.7, which fails the image scan on fixed HIGH standard-library findings). ## Changes - **Dockerfile** - New `supercronic` build stage on `golang:1.26.10-alpine3.24`. It fetches the `v0.2.43` source tarball, verifies its SHA-256, pins `golang.org/x/sys` to `v0.49.0`, and builds a static binary with `CGO_ENABLED=0`. - Base stage copies the binary from the build stage and checks that `supercronic -version` reports `v0.2.43`. - Removes the runtime `curl` and `ca-certificates` packages and the download step. - Removes `/usr/local/bin/gosu` from the base image, which is built with Go 1.24.6 and is unused (the entrypoint does not drop privileges). - **AGENTS.md**: records the Go `1.26.10` rebuild of the Supercronic tag. - **README.md**: rewritten to document the image: runtime modes (physical restore, logical restore, scheduled backups), environment variables, a Compose example using Docker secrets and a read-only root filesystem, the pinned contents, and the build and versioning process. ## Why The image scan flags fixed HIGH vulnerabilities in the Go standard library shipped inside the upstream Supercronic binary. Rebuilding the same tag with a patched Go toolchain clears those findings without changing Supercronic's behavior. Removing `curl`, `ca-certificates`, and `gosu` reduces the attack surface and the number of pinned packages to maintain.
Build supercronic from source with Go 1.26.10 and update docs
Some checks failed
ci / compose (pull_request) Successful in 12s
Details
ci / shellcheck (pull_request) Failing after 3s
Details
ci / conventions (pull_request) Failing after 2s
Details
ci / image (pull_request) Successful in 56s
Details
b687ad60d8
Fix shellcheck directives and guard RESTORE_DIR cleanup
All checks were successful
ci / compose (pull_request) Successful in 12s
Details
ci / shellcheck (pull_request) Successful in 3s
Details
ci / conventions (pull_request) Successful in 2s
Details
ci / image (pull_request) Successful in 34s
Details
95e0321584
MHE merged commit 5f129ad009 into main 2026-11-01 13:44:16 +01:00
MHE deleted branch review-readme-reference-projects 2026-11-01 13:44:34 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/postgres-maintenance!1
No description provided.