diff --git a/data/Dockerfiles/acme/Dockerfile b/data/Dockerfiles/acme/Dockerfile index 193ca7e00..0d5d6a3f2 100644 --- a/data/Dockerfiles/acme/Dockerfile +++ b/data/Dockerfiles/acme/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/dockerapi/Dockerfile b/data/Dockerfiles/dockerapi/Dockerfile index c27f6154b..88c0aa9d0 100644 --- a/data/Dockerfiles/dockerapi/Dockerfile +++ b/data/Dockerfiles/dockerapi/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile index f1152c8a1..b7c6e9403 100644 --- a/data/Dockerfiles/dovecot/Dockerfile +++ b/data/Dockerfiles/dovecot/Dockerfile @@ -1,4 +1,36 @@ -FROM alpine:3.21 +# Alpine >= 3.22 only ships Dovecot 2.4, Dovecot 2.3 is built from the Alpine 3.21 packaging +FROM alpine:3.24 AS builder + +# Last commit of the aports 3.21-stable branch +ARG APORTS_COMMIT=55126a11a4b9dcd14de3068e3348e9951d144ca6 + +RUN apk add --no-cache alpine-sdk git \ + && git init -q /aports \ + && cd /aports \ + && git remote add origin https://github.com/alpinelinux/aports.git \ + && git sparse-checkout set main/dovecot community/dovecot-fts-flatcurve \ + && git fetch -q --depth 1 --filter=blob:none origin ${APORTS_COMMIT} \ + && git checkout -q FETCH_HEAD \ + && abuild-keygen -a -n \ + && cp /root/.abuild/*.rsa.pub /etc/apk/keys/ \ + && apk update \ + && cd /aports/main/dovecot \ + # newer gettext does not overwrite the shipped config.rpath without -f + && sed -i 's/autoreconf -vi/autoreconf -fvi/' APKBUILD \ + && abuild -F -r \ + # flatcurve must be built against the Dovecot 2.3 headers + && apk add --no-cache /root/packages/main/*/dovecot-2*.apk /root/packages/main/*/dovecot-dev-*.apk \ + && cd /aports/community/dovecot-fts-flatcurve \ + && abuild -F -r \ + && mkdir /packages \ + && cp /root/.abuild/*.rsa.pub /packages/ \ + && for pkg in dovecot dovecot-dev dovecot-lmtpd dovecot-lua dovecot-ldap dovecot-mysql dovecot-sql \ + dovecot-submissiond dovecot-pigeonhole-plugin dovecot-pop3d dovecot-fts-flatcurve; do \ + cp /root/packages/*/*/${pkg}-[0-9]*.apk /packages/; \ + done + + +FROM alpine:3.24 LABEL maintainer="The Infrastructure Company GmbH " @@ -7,6 +39,10 @@ ARG GOSU_VERSION=1.19 ENV LANG=C.UTF-8 ENV LC_ALL=C.UTF-8 +# MariaDB Connector/C >= 3.4 refuses DB servers without TLS, this covers Perl DBI, client.cnf covers Dovecot +ENV MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 + +COPY --from=builder /packages /tmp/packages # Add groups and users before installing Dovecot to not break compatibility RUN addgroup -g 5000 vmail \ @@ -18,6 +54,7 @@ RUN addgroup -g 5000 vmail \ && adduser -D -u 5000 -G vmail -h /var/vmail vmail \ && adduser -D -G dovecot -u 401 -h /dev/null -s /sbin/nologin dovecot \ && adduser -D -G dovenull -u 402 -h /dev/null -s /sbin/nologin dovenull \ + && cp /tmp/packages/*.rsa.pub /etc/apk/keys/ \ && apk add --no-cache --update \ bash \ bind-tools \ @@ -99,22 +136,15 @@ RUN addgroup -g 5000 vmail \ supervisor \ tzdata \ wget \ - dovecot \ - dovecot-dev \ - dovecot-lmtpd \ - dovecot-lua \ - dovecot-ldap \ - dovecot-mysql \ - dovecot-sql \ - dovecot-submissiond \ - dovecot-pigeonhole-plugin \ - dovecot-pop3d \ - dovecot-fts-flatcurve \ + /tmp/packages/*.apk \ + && rm -rf /tmp/packages \ && arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) \ && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$arch" \ && chmod +x /usr/local/bin/gosu \ && gosu nobody true +# Dovecot's MySQL driver reads [client] from /etc/my.cnf, Connector/C ignores the !includedir there +COPY client.cnf /etc/my.cnf COPY trim_logs.sh /usr/local/bin/trim_logs.sh COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf diff --git a/data/Dockerfiles/dovecot/client.cnf b/data/Dockerfiles/dovecot/client.cnf new file mode 100644 index 000000000..f078f3cbe --- /dev/null +++ b/data/Dockerfiles/dovecot/client.cnf @@ -0,0 +1,3 @@ +[client] +ssl = false +ssl-verify-server-cert = false diff --git a/data/Dockerfiles/netfilter/Dockerfile b/data/Dockerfiles/netfilter/Dockerfile index 70cd49c1a..a3230998a 100644 --- a/data/Dockerfiles/netfilter/Dockerfile +++ b/data/Dockerfiles/netfilter/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/olefy/Dockerfile b/data/Dockerfiles/olefy/Dockerfile index 845b125f6..0a2b31fb6 100644 --- a/data/Dockerfiles/olefy/Dockerfile +++ b/data/Dockerfiles/olefy/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.21 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " diff --git a/data/Dockerfiles/olefy/olefy.py b/data/Dockerfiles/olefy/olefy.py index 7c6880929..a03667e7d 100644 --- a/data/Dockerfiles/olefy/olefy.py +++ b/data/Dockerfiles/olefy/olefy.py @@ -67,7 +67,7 @@ logger.debug('olefy listen address string: {} (type {})'.format(olefy_listen_add if not olefy_listen_addr_string: olefy_listen_addr = "" else: - addr_re = re.compile('[\[" \]]') + addr_re = re.compile(r'[\[" \]]') olefy_listen_addr = addr_re.sub('', olefy_listen_addr_string.replace("'", "")).split(',') # log runtime variables @@ -206,8 +206,9 @@ class AIO(asyncio.Protocol): self.transport.close() -# start the listeners -loop = asyncio.get_event_loop() +# start the listeners, Python >= 3.14 no longer creates a loop in get_event_loop() +loop = asyncio.new_event_loop() +asyncio.set_event_loop(loop) # each client connection will create a new protocol instance coro = loop.create_server(AIO, olefy_listen_addr, olefy_listen_port) server = loop.run_until_complete(coro) diff --git a/data/Dockerfiles/unbound/Dockerfile b/data/Dockerfiles/unbound/Dockerfile index 321158e07..a0bd33279 100644 --- a/data/Dockerfiles/unbound/Dockerfile +++ b/data/Dockerfiles/unbound/Dockerfile @@ -1,10 +1,10 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH " # install unbound from alpine:edge to get security patches # minimum version is pinned -RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main "unbound>=1.26.1-r0" +RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main "unbound>=1.26.2-r0" # install other packages from regular alpine stable repo RUN apk add --update --no-cache \ diff --git a/data/Dockerfiles/watchdog/Dockerfile b/data/Dockerfiles/watchdog/Dockerfile index 54854ea1a..c3b1d54e8 100644 --- a/data/Dockerfiles/watchdog/Dockerfile +++ b/data/Dockerfiles/watchdog/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.23 +FROM alpine:3.24 LABEL maintainer = "The Infrastructure Company GmbH "