docker: add next-generation rootless image with Kubernetes security context support #8061

Copilot · 2025-11-26T03:06:10Z

Summary

Two docker setups are now available:

Legacy (default): `docker/` + `Dockerfile`

Image tags: gogs/gogs:latest, gogs/gogs:<version> (Docker Hub, GHCR only)
Runs as root with PUID/PGID support
Includes OpenSSH server
Supports SOCAT_LINK, RUN_CROND options
Full backward compatibility

Next Generation: `docker-next/` + `Dockerfile.next`

Image tags: gogs/gogs:next-latest, gogs/gogs:next-<version> (Docker Hub, GHCR, DigitalOcean)
Minimal image - packages: bash, ca-certificates, git, linux-pam, openssh-keygen
Direct execution - no process supervisor, just gogs web
Runs as non-root user (UID 1000)
Built-in SSH server via app.ini (START_SSH_SERVER = true)
Supports K8s security contexts: runAsNonRoot, allowPrivilegeEscalation: false, capabilities: { drop: [ALL] }

Original prompt

the way that the docker image is built is old-fastion, doesn't support best possible securityContext running in k8s, and requires root at start. fix that!

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

- Run as non-root user (UID 1000) by default - Remove gosu dependency and root privilege escalation - Add support for restrictive K8s security contexts - Disable SSH/syslogd in rootless mode (use built-in SSH instead) - Update documentation with migration guide Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

- Use proper if/then for mkdir error checks in start.sh - Add consistent warning messages for directory creation failures - Document that crontabs directory is pre-created by finalize.sh - Log warnings when chmod operations fail on data directories Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

unknwon · 2025-11-26T03:27:39Z

@copilot

would the new image break how people start containers today?

does the change support having

   capabilities:
     drop:
     - ALL
     add:
     - maybe?

Copilot · 2025-11-26T03:28:56Z

@copilot

would the new image break how people start containers today?
...

Yes, there are breaking changes for existing users:
- PUID/PGID env vars removed - Users must rebuild the image with --build-arg GOGS_UID=xxx for custom UID/GID
- Volume permissions - Existing volumes may need chown -R 1000:1000 /var/gogs
- OpenSSH disabled by default - Users needing OpenSSH must either run as root (--user root) or switch to built-in SSH server
The "Migration from Previous Versions" section in README.md documents this, but I can add a more prominent breaking changes notice if you'd like.
Yes, drop: - ALL is fully supported - no capabilities need to be added back. The README already shows this in the security context example (lines 29-31). Gogs only needs:
- HTTP port 3000 (>1024, no CAP_NET_BIND_SERVICE)
- Built-in SSH port 2222 (>1024, no capability)
- File I/O to volumes (no capability)
So capabilities: { drop: [ALL] } works without any add: entries.

unknwon · 2025-11-27T18:22:24Z

@copilot Keep everything old as-is, but name things related to it as "docker-legacy".

The modern way of building name it "docker".

If running sshd inside docker requires root, then remove it and let app.ini itself control if builtin SSH server should start.

That means we have two sets of everything, including README.

- Keep original docker setup as docker-legacy/ with sshd support - Create new modern docker/ without sshd (uses built-in SSH via app.ini) - Modern image: runs as non-root, supports K8s security contexts - Add Dockerfile.legacy for building legacy image - Update CI to trigger on both docker/ and docker-legacy/ changes Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

- Add warning when chmod fails in gogs setup - Clarify non-root cron limitations in comment - Add git user context to backup-init comment Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot · 2025-11-27T18:30:47Z

@copilot Keep everything old as-is, but name things related to it as "docker-legacy".

The modern way of building name it "docker"....

Done in ae72062. Created dual setup:

Modern (Dockerfile + docker/): Rootless, no sshd, K8s-friendly with capabilities: { drop: [ALL] } support
Legacy (Dockerfile.legacy + docker-legacy/): Original behavior preserved as-is with sshd, PUID/PGID, gosu

SSH access in modern image uses Gogs' built-in SSH server via app.ini config (START_SSH_SERVER = true).

unknwon · 2025-11-27T18:34:26Z

@copilot my bad. Keep legacy as "docker", modern as "docker-next"

- docker/ now contains original legacy setup (sshd, PUID/PGID, gosu) - docker-next/ contains modern rootless setup (K8s security contexts) - Dockerfile uses docker/ (legacy, unchanged behavior) - Dockerfile.next uses docker-next/ (modern, K8s-friendly) Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot · 2025-11-27T18:38:37Z

@copilot my bad. Keep legacy as "docker", modern as "docker-next"

Done in bdd872c. Renamed to:

Legacy: docker/ + Dockerfile (original behavior preserved)
Modern: docker-next/ + Dockerfile.next (rootless, K8s-friendly)

Dockerfile.next

… gogs execution - Update to alpine:3.22 and golang:alpine3.22 - Remove s6 process supervisor - run gogs directly - Remove unnecessary packages (rsync, shadow, curl, s6) - Remove nsswitch.conf (not needed) - Expose port 22 for built-in SSH server - Simplify to just: ENTRYPOINT ["/app/gogs/gogs"] CMD ["web"] - Use docker/build/install-task.sh from legacy Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

unknwon · 2025-11-27T19:17:15Z

@copilot only push next image to DigitalOcean, legacy no need anymore.

- Remove DigitalOcean login and tag from buildx (legacy) job - Change deploy-demo to depend on buildx-next instead of buildx Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot · 2025-11-27T19:19:20Z

@copilot only push next image to DigitalOcean, legacy no need anymore.

Done in 8703a75. DigitalOcean registry now only receives the next-gen image (gogs/gogs:next-latest). Legacy image pushes to Docker Hub and GHCR only. Also updated deploy-demo to depend on buildx-next.

.github/workflows/docker.yml

unknwon · 2025-11-30T02:03:56Z

@copilot make images on ttl.sh 7d instead of 1d

Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot · 2025-11-30T02:06:09Z

@copilot make images on ttl.sh 7d instead of 1d

Done in 7dd9e29. Changed ttl.sh images from :1d to :7d for both legacy and next-gen PR builds.

unknwon · 2025-11-30T02:30:40Z

@copilot next image needs to have SSH utilities

SSH: Failed to setup host keys: generate host key with args [ssh-keygen -t rsa -f /app/gogs/data/ssh/gogs.rsa -m PEM -N '']: failed to start command: exec: "ssh-keygen": executable file not found in $PATH

Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot · 2025-11-30T02:33:18Z

@copilot next image needs to have SSH utilities

...

Added openssh-keygen package in b85399a. This provides the ssh-keygen binary needed for generating SSH host keys without including the full OpenSSH server/client.

Copilot AI self-assigned this Nov 26, 2025

Initial plan

71fece6

Copilot AI assigned unknwon Nov 26, 2025

Copilot started work on behalf of unknwon November 26, 2025 03:06 View session

Copilot AI and others added 2 commits November 26, 2025 03:17

Copilot AI changed the title ~~[WIP] Fix Docker image build process for better security~~ Modernize Docker image for Kubernetes security context support Nov 26, 2025

Copilot finished work on behalf of unknwon November 26, 2025 03:20

Copilot AI requested a review from unknwon November 26, 2025 03:20

Copilot started work on behalf of unknwon November 26, 2025 03:28 View session

Copilot finished work on behalf of unknwon November 26, 2025 03:29

Copilot started work on behalf of unknwon November 27, 2025 18:22 View session

Copilot AI and others added 2 commits November 27, 2025 18:28

Address code review: improve error handling and comments

ae72062

- Add warning when chmod fails in gogs setup - Clarify non-root cron limitations in comment - Add git user context to backup-init comment Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot AI changed the title ~~Modernize Docker image for Kubernetes security context support~~ Add modern rootless Docker image with Kubernetes security context support Nov 27, 2025

Copilot finished work on behalf of unknwon November 27, 2025 18:32

Copilot started work on behalf of unknwon November 27, 2025 18:34 View session

Copilot AI changed the title ~~Add modern rootless Docker image with Kubernetes security context support~~ Add next-generation rootless Docker image with Kubernetes security context support Nov 27, 2025

Copilot finished work on behalf of unknwon November 27, 2025 18:39

unknwon requested changes Nov 27, 2025

View reviewed changes

Copilot started work on behalf of unknwon November 27, 2025 18:51 View session

Copilot AI requested a review from unknwon November 27, 2025 18:57

Copilot finished work on behalf of unknwon November 27, 2025 19:16

Copilot started work on behalf of unknwon November 27, 2025 19:17 View session

Only push next image to DigitalOcean, remove legacy from DO registry

8703a75

- Remove DigitalOcean login and tag from buildx (legacy) job - Change deploy-demo to depend on buildx-next instead of buildx Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot finished work on behalf of unknwon November 27, 2025 19:20

unknwon requested changes Nov 27, 2025

View reviewed changes

.github/workflows/docker.yml Show resolved Hide resolved

Copilot started work on behalf of unknwon November 27, 2025 19:49 View session

Copilot AI requested a review from unknwon November 27, 2025 19:51

Copilot finished work on behalf of unknwon November 27, 2025 19:51

unknwon changed the title ~~Add next-generation rootless Docker image with Kubernetes security context support~~ docker: add next-generation rootless image with Kubernetes security context support Nov 27, 2025

unknwon marked this pull request as ready for review November 27, 2025 20:40

Copilot started work on behalf of unknwon November 30, 2025 02:04 View session

Change ttl.sh image expiration from 1d to 7d

7dd9e29

Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot finished work on behalf of unknwon November 30, 2025 02:07

Copilot started work on behalf of unknwon November 30, 2025 02:31 View session

Add openssh-keygen to Dockerfile.next for built-in SSH server

b85399a

Co-authored-by: unknwon <2946214+unknwon@users.noreply.github.com>

Copilot finished work on behalf of unknwon November 30, 2025 02:34

unknwon force-pushed the copilot/fix-docker-image-security branch from a08ed64 to 7696e03 Compare November 30, 2025 03:47

update docker README

dd8af63

unknwon force-pushed the copilot/fix-docker-image-security branch from 7696e03 to dd8af63 Compare November 30, 2025 03:53

CHANGELOG

d0637c2

unknwon approved these changes Nov 30, 2025

View reviewed changes

Merge branch 'main' into copilot/fix-docker-image-security

3938da2

unknwon merged commit 332c089 into main Nov 30, 2025
11 of 12 checks passed

unknwon deleted the copilot/fix-docker-image-security branch November 30, 2025 04:01

docker: add next-generation rootless image with Kubernetes security context support #8061

docker: add next-generation rootless image with Kubernetes security context support #8061

Uh oh!

Conversation

Copilot AI commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Legacy (default): docker/ + Dockerfile

Next Generation: docker-next/ + Dockerfile.next

Uh oh!

unknwon commented Nov 26, 2025

Uh oh!

Copilot AI commented Nov 26, 2025

Uh oh!

unknwon commented Nov 27, 2025

Uh oh!

Copilot AI commented Nov 27, 2025

Uh oh!

unknwon commented Nov 27, 2025

Uh oh!

Copilot AI commented Nov 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

unknwon commented Nov 27, 2025

Uh oh!

Copilot AI commented Nov 27, 2025

Uh oh!

Uh oh!

unknwon commented Nov 30, 2025

Uh oh!

Copilot AI commented Nov 30, 2025

Uh oh!

unknwon commented Nov 30, 2025

Uh oh!

Copilot AI commented Nov 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Nov 26, 2025 •

edited

Loading

Legacy (default): `docker/` + `Dockerfile`

Next Generation: `docker-next/` + `Dockerfile.next`