From 714ca5a3d81f50b9fcb97ebf7cc86a8b65338ac8 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 25 Oct 2026 13:00:37 +0000 Subject: [PATCH 1/6] Update dependency tianon/gosu to v1.20 Signed-off-by: milkmaker --- data/Dockerfiles/dovecot/Dockerfile | 2 +- data/Dockerfiles/sogo/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile index f1152c8a1..3065223c1 100644 --- a/data/Dockerfiles/dovecot/Dockerfile +++ b/data/Dockerfiles/dovecot/Dockerfile @@ -3,7 +3,7 @@ FROM alpine:3.21 LABEL maintainer="The Infrastructure Company GmbH " # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ -ARG GOSU_VERSION=1.19 +ARG GOSU_VERSION=1.20 ENV LANG=C.UTF-8 ENV LC_ALL=C.UTF-8 diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile index 997831303..d55a98901 100644 --- a/data/Dockerfiles/sogo/Dockerfile +++ b/data/Dockerfiles/sogo/Dockerfile @@ -17,7 +17,7 @@ ARG SOPE_VERSION=SOPE-5.12.12 # Security patches to apply (space-separated commit hashes) ARG SOGO_SECURITY_PATCHES="" # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ -ARG GOSU_VERSION=1.19 +ARG GOSU_VERSION=1.20 ENV LC_ALL=C # Install dependencies, build SOPE and SOGo, then clean up (all in one layer to minimize image size) From 0445f85d7d7403e3ebbe5e8f553d24128c31aa7f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 00:27:59 +0000 Subject: [PATCH 2/6] Update redis Docker tag to v7.4.12 Signed-off-by: milkmaker --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7a5220108..59c91062a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -42,7 +42,7 @@ services: - mysql redis-mailcow: - image: redis:7.4.11-alpine + image: redis:7.4.12-alpine entrypoint: ["/bin/sh","/redis-conf.sh"] volumes: - redis-vol-1:/data/ From 503e64fe85fbd0d27cbc160a9be67ba5ef1ef7c3 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 28 Oct 2026 08:49:57 +0100 Subject: [PATCH 3/6] [ACME][Dockerapi][Netfilter][Watchdog] Update base to Alpine 3.24 --- data/Dockerfiles/acme/Dockerfile | 2 +- data/Dockerfiles/dockerapi/Dockerfile | 2 +- data/Dockerfiles/netfilter/Dockerfile | 2 +- data/Dockerfiles/watchdog/Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/acme/Dockerfile b/data/Dockerfiles/acme/Dockerfile index 193ca7e00..0d5d6a3f2 100644 --- a/data/Dockerfiles/acme/Dockerfile +++ b/data/Dockerfiles/acme/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/dockerapi/Dockerfile b/data/Dockerfiles/dockerapi/Dockerfile index c27f6154b..88c0aa9d0 100644 --- a/data/Dockerfiles/dockerapi/Dockerfile +++ b/data/Dockerfiles/dockerapi/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/netfilter/Dockerfile b/data/Dockerfiles/netfilter/Dockerfile index 70cd49c1a..a3230998a 100644 --- a/data/Dockerfiles/netfilter/Dockerfile +++ b/data/Dockerfiles/netfilter/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/watchdog/Dockerfile b/data/Dockerfiles/watchdog/Dockerfile index 54854ea1a..c3b1d54e8 100644 --- a/data/Dockerfiles/watchdog/Dockerfile +++ b/data/Dockerfiles/watchdog/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " From 8aaf68ffb59eac2ad31cbde958f424d33eae0ce6 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 28 Oct 2026 08:50:42 +0100 Subject: [PATCH 4/6] [Unbound] Update to 1.26.2, base Alpine 3.24 --- data/Dockerfiles/unbound/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/unbound/Dockerfile b/data/Dockerfiles/unbound/Dockerfile index 321158e07..a0bd33279 100644 --- a/data/Dockerfiles/unbound/Dockerfile +++ b/data/Dockerfiles/unbound/Dockerfile @@ -1,10 +1,10 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " # install unbound from alpine:edge to get security patches # minimum version is pinned -RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main "unbound>=1.26.1-r0" +RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main "unbound>=1.26.2-r0" # install other packages from regular alpine stable repo RUN apk add --update --no-cache \ From 4884ed0cbf3cffbf18cee79fc630a81beeeccd33 Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 28 Oct 2026 08:51:33 +0100 Subject: [PATCH 5/6] [Olefy] Update base to Alpine 3.24, fix event loop for Python 3.14 --- data/Dockerfiles/olefy/Dockerfile | 2 +- data/Dockerfiles/olefy/olefy.py | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/olefy/Dockerfile b/data/Dockerfiles/olefy/Dockerfile index 845b125f6..0a2b31fb6 100644 --- a/data/Dockerfiles/olefy/Dockerfile +++ b/data/Dockerfiles/olefy/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.21 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/olefy/olefy.py b/data/Dockerfiles/olefy/olefy.py index 7c6880929..a03667e7d 100644 --- a/data/Dockerfiles/olefy/olefy.py +++ b/data/Dockerfiles/olefy/olefy.py @@ -67,7 +67,7 @@ logger.debug('olefy listen address string: {} (type {})'.format(olefy_listen_add if not olefy_listen_addr_string: olefy_listen_addr = "" else: - addr_re = re.compile('[\[" \]]') + addr_re = re.compile(r'[\[" \]]') olefy_listen_addr = addr_re.sub('', olefy_listen_addr_string.replace("'", "")).split(',') # log runtime variables @@ -206,8 +206,9 @@ class AIO(asyncio.Protocol): self.transport.close() -# start the listeners -loop = asyncio.get_event_loop() +# start the listeners, Python >= 3.14 no longer creates a loop in get_event_loop() +loop = asyncio.new_event_loop() +asyncio.set_event_loop(loop) # each client connection will create a new protocol instance coro = loop.create_server(AIO, olefy_listen_addr, olefy_listen_port) server = loop.run_until_complete(coro) From af5d0e3d29fbc26465bfcbc2b98152c3b9a19edf Mon Sep 17 00:00:00 2001 From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com> Date: Wed, 28 Oct 2026 09:00:45 +0100 Subject: [PATCH 6/6] [Dovecot] Update base to Alpine 3.24, build Dovecot 2.3 from Alpine 3.21 packaging --- data/Dockerfiles/dovecot/Dockerfile | 54 ++++++++++++++++++++++------- data/Dockerfiles/dovecot/client.cnf | 3 ++ 2 files changed, 45 insertions(+), 12 deletions(-) create mode 100644 data/Dockerfiles/dovecot/client.cnf diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile index f1152c8a1..b7c6e9403 100644 --- a/data/Dockerfiles/dovecot/Dockerfile +++ b/data/Dockerfiles/dovecot/Dockerfile @@ -1,4 +1,36 @@ -FROM alpine:3.21 +# Alpine >= 3.22 only ships Dovecot 2.4, Dovecot 2.3 is built from the Alpine 3.21 packaging +FROM alpine:3.24 AS builder + +# Last commit of the aports 3.21-stable branch +ARG APORTS_COMMIT=55126a11a4b9dcd14de3068e3348e9951d144ca6 + +RUN apk add --no-cache alpine-sdk git \ + && git init -q /aports \ + && cd /aports \ + && git remote add origin https://github.com/alpinelinux/aports.git \ + && git sparse-checkout set main/dovecot community/dovecot-fts-flatcurve \ + && git fetch -q --depth 1 --filter=blob:none origin ${APORTS_COMMIT} \ + && git checkout -q FETCH_HEAD \ + && abuild-keygen -a -n \ + && cp /root/.abuild/*.rsa.pub /etc/apk/keys/ \ + && apk update \ + && cd /aports/main/dovecot \ + # newer gettext does not overwrite the shipped config.rpath without -f + && sed -i 's/autoreconf -vi/autoreconf -fvi/' APKBUILD \ + && abuild -F -r \ + # flatcurve must be built against the Dovecot 2.3 headers + && apk add --no-cache /root/packages/main/*/dovecot-2*.apk /root/packages/main/*/dovecot-dev-*.apk \ + && cd /aports/community/dovecot-fts-flatcurve \ + && abuild -F -r \ + && mkdir /packages \ + && cp /root/.abuild/*.rsa.pub /packages/ \ + && for pkg in dovecot dovecot-dev dovecot-lmtpd dovecot-lua dovecot-ldap dovecot-mysql dovecot-sql \ + dovecot-submissiond dovecot-pigeonhole-plugin dovecot-pop3d dovecot-fts-flatcurve; do \ + cp /root/packages/*/*/${pkg}-[0-9]*.apk /packages/; \ + done + + +FROM alpine:3.24 LABEL maintainer="The Infrastructure Company GmbH " @@ -7,6 +39,10 @@ ARG GOSU_VERSION=1.19 ENV LANG=C.UTF-8 ENV LC_ALL=C.UTF-8 +# MariaDB Connector/C >= 3.4 refuses DB servers without TLS, this covers Perl DBI, client.cnf covers Dovecot +ENV MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 + +COPY --from=builder /packages /tmp/packages # Add groups and users before installing Dovecot to not break compatibility RUN addgroup -g 5000 vmail \ @@ -18,6 +54,7 @@ RUN addgroup -g 5000 vmail \ && adduser -D -u 5000 -G vmail -h /var/vmail vmail \ && adduser -D -G dovecot -u 401 -h /dev/null -s /sbin/nologin dovecot \ && adduser -D -G dovenull -u 402 -h /dev/null -s /sbin/nologin dovenull \ + && cp /tmp/packages/*.rsa.pub /etc/apk/keys/ \ && apk add --no-cache --update \ bash \ bind-tools \ @@ -99,22 +136,15 @@ RUN addgroup -g 5000 vmail \ supervisor \ tzdata \ wget \ - dovecot \ - dovecot-dev \ - dovecot-lmtpd \ - dovecot-lua \ - dovecot-ldap \ - dovecot-mysql \ - dovecot-sql \ - dovecot-submissiond \ - dovecot-pigeonhole-plugin \ - dovecot-pop3d \ - dovecot-fts-flatcurve \ + /tmp/packages/*.apk \ + && rm -rf /tmp/packages \ && arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) \ && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$arch" \ && chmod +x /usr/local/bin/gosu \ && gosu nobody true +# Dovecot's MySQL driver reads [client] from /etc/my.cnf, Connector/C ignores the !includedir there +COPY client.cnf /etc/my.cnf COPY trim_logs.sh /usr/local/bin/trim_logs.sh COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf diff --git a/data/Dockerfiles/dovecot/client.cnf b/data/Dockerfiles/dovecot/client.cnf new file mode 100644 index 000000000..f078f3cbe --- /dev/null +++ b/data/Dockerfiles/dovecot/client.cnf @@ -0,0 +1,3 @@ +[client] +ssl = false +ssl-verify-server-cert = false