feat(dist): container image, signed releases (SBOM + provenance), go install - #41
Merged
Merged
Conversation
…install - Dockerfile: multi-stage build to a distroless/static base, non-root, embeds the UI, ~30 MB. A new release.yml `image` job pushes a multi-arch (amd64/arm64) image to ghcr.io/koduj-dev/docker-commander with provenance + SBOM attestations and a cosign signature. - release.yml: keyless cosign signature over SHA256SUMS (+ .sig/.pem), an SPDX SBOM (dockercmd.sbom.spdx.json), and per-binary SLSA build-provenance attestations. - README: Docker and `go install` quick-start options + a "Verifying a download" section (sha256sum / cosign verify-blob / gh attestation verify). - .dockerignore + CHANGELOG [Unreleased] entries.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds standard distribution and supply-chain outputs for Docker Commander: a published container image, signed release artifacts with SBOM/provenance attestations, and updated installation/verification docs.
Changes:
- Add a multi-stage Dockerfile producing a distroless, non-root runtime image that embeds the UI.
- Extend GitHub release workflow to generate an SPDX SBOM, sign
SHA256SUMSwith keyless cosign, and emit build provenance; add a separate job to build/push/sign a multi-arch GHCR image with SBOM/provenance attestations. - Update README/CHANGELOG with Docker +
go installquick-start and verification steps; add a.dockerignore.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds Docker + go install installation paths and artifact verification commands. |
| Dockerfile | Introduces a multi-stage build producing a distroless/non-root container image. |
| CHANGELOG.md | Documents new distribution options and supply-chain artifacts under Unreleased. |
| .github/workflows/release.yml | Adds SBOM generation, cosign signing, provenance attestations, and a GHCR image publish/sign job. |
| .dockerignore | Reduces Docker build context size by excluding irrelevant directories/files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| sha256sum -c SHA256SUMS --ignore-missing # checksum | ||
|
|
||
| cosign verify-blob --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \ | ||
| --certificate-identity-regexp 'koduj-dev/docker-commander' \ |
Comment on lines
+45
to
+47
| # cosign verify-blob --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \ | ||
| # --certificate-identity-regexp 'koduj-dev/docker-commander' \ | ||
| # --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS |
Comment on lines
+90
to
+94
| tags: | | ||
| type=semver,pattern={{version}} | ||
| type=semver,pattern={{major}}.{{minor}} | ||
| type=raw,value=latest | ||
|
|
… cosign identity, no latest on pre-releases - README Docker quick-start binds the UI to 127.0.0.1 by default (drop it to expose on the LAN), matching the native default for an admin tool. - Tighten the cosign verify-blob --certificate-identity-regexp to the exact repo + workflow path (anchored), so signatures from similarly named repos (docker-commander-*) can't satisfy it. Updated in the README and the release.yml comment. - Drop the explicit `type=raw,value=latest` image tag; rely on docker/metadata-action's default latest=auto so only stable semver tags move `latest` (a v*-rc pre-release won't).
This was referenced Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Standard distribution/supply-chain tooling for the project — three additions:
Dockerfile(multi-stage →distroless/static, non-root, embeds the UI, ~30 MB) and a newimagejob inrelease.ymlthat pushes a multi-arch (amd64/arm64) image toghcr.io/koduj-dev/docker-commanderon eachv*tag, with buildx provenance + SBOM attestations and a cosign signature.release.ymlnow keyless-signsSHA256SUMSwith cosign (SHA256SUMS.sig/.pem), generates an SPDX SBOM (dockercmd.sbom.spdx.json), and emits per-binary SLSA build provenance (actions/attest-build-provenance). Fits the project's existing supply-chain story (SHA-256-verified self-update).go install— documented as an install path in the README.Plus a
.dockerignore, README Quick start options (Docker /go install) and a Verifying a download section, andCHANGELOG[Unreleased]entries.Type of change
Checklist
go test -short ./...andgo vet ./...passgofmtgate is clean (gofmt -l $(git ls-files '*.go')after staging)cd web && npx tsc --noEmit) — N/A (no UI change)web/dist— N/A (nothing underweb/srcchanged)docker build, see notes)docs/and added aCHANGELOG.mdentry for user-facing changesNotes for reviewers
Dockerfilewas built and run locally on amd64: the image is 30 MB, runs as non-root, and--version/--helpwork.v*tag. YAML validated; action versions are current (cosign-installer@v3,attest-build-provenance@v2,sbom-action@v0,build-push-action@v6,metadata-action@v5).imagejob usesGITHUB_TOKENwithpackages: write(set per-job). cosign is keyless (Sigstore OIDC) — no secrets to manage.permissionsare scoped (release:contents/id-token/attestations; image:packages/id-token/attestations).