# iperf3-enabled image variant. Same prebuilt, CAP_NET_RAW-stamped pingularity

# binary as the default Dockerfile, but the final stage is debian:13-slim + iperf3

# so the opt-in iperf3 speedtest engine has a binary to exec. The default image

# is distroless/static-debian13 with NO package manager, so iperf3 can never be

# present there; this variant exists only for users who select the iperf3 engine.

# See Dockerfile for the default (lean, iperf-free) image.

#

# The base must ship iperf3 >= 3.17: IperfVersion in internal/speedtest warns on

# every older build (the 3.17 authentication-padding change), so a base that apt-

# installs less than that makes the image flag its own binary. trixie carries 3.18;

# bookworm's 3.12 is why the base can never fall back a Debian generation.

#

# Multi-arch works exactly like the default image: goreleaser (dockers_v2) stages

# the per-platform binaries - linux/amd64/pingularity, linux/arm64/pingularity -

# in the build context and buildx selects the target-arch one via $TARGETPLATFORM.

# The difference here is the final stage runs apt for the TARGET arch (under QEMU

# when cross-building; the release workflow already sets up buildx + QEMU). setcap

# stays on $BUILDPLATFORM so it still runs natively without emulation.

#

# Both FROM lines are pinned by digest (alongside the tag) so Dependabot's docker

# ecosystem can bump them; the debian:13-slim digest is kept identical to the one

# in the default Dockerfile so the two bases stay in lock-step.

# --- stamp CAP_NET_RAW onto the binary (runs natively on the build host) ---

FROM --platform=$BUILDPLATFORM debian:13-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258 AS setcap

RUN apt-get update \

&& apt-get install -y --no-install-recommends libcap2-bin \

&& rm -rf /var/lib/apt/lists/*

# TARGETPLATFORM (set by buildx per target arch) selects the matching prebuilt

# binary; this stage stays pinned to $BUILDPLATFORM above so apt + setcap run

# natively without QEMU.

ARG TARGETPLATFORM

COPY $TARGETPLATFORM/pingularity /pingularity

# +ep: effective+permitted, so the cap is raised automatically on exec even for a

# non-root user. `mkdir /data` seeds the data dir the final stage chowns. BuildKit

# preserves the security.capability xattr across the COPY into the final image

# (same guarantee the default Dockerfile relies on), so the final stage needs no

# libcap2-bin of its own.

# The .pingularity-image-dir marker is a volume-lineage HEURISTIC (not a proof

# of volume type): Docker's copy-up carries it into a fresh named volume, so the

# daemon's container carve-out (store.go) can tell content that came from OUR

# image from an empty PVC or a plain bind-mounted host directory, which never

# carry it. A bind mount restored FROM a marked volume would carry it too - an

# accepted edge, since the content is genuinely ours.

RUN setcap cap_net_raw+ep /pingularity && mkdir -p /data && touch /data/.pingularity-image-dir

# --- final image: debian-slim carrying iperf3 + the capped binary ---

FROM debian:13-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258

# Static attribution; version/revision are stamped per build by goreleaser

# (dockers_v2 labels/annotations in .goreleaser.yaml), not hardcoded here.

LABEL org.opencontainers.image.title="pingularity" \

org.opencontainers.image.description="Single-binary internet-connectivity monitor (iperf3-enabled image variant)." \

org.opencontainers.image.source="https://github.com/pingular/pingularity" \

org.opencontainers.image.licenses="MIT"

# iperf3 gives the opt-in engine a binary to exec (pingularity looks it up on PATH

# via exec.LookPath; the debian package installs /usr/bin/iperf3, pulling libiperf0

# as a dependency). ca-certificates + tzdata are bundled by the distroless/static

# base of the default image, so install them here too: without ca-certificates the

# static Go binary's TLS calls (Ookla, the update feed) fail x509 verification, and

# tzdata keeps time-zone handling identical to the default image.

RUN apt-get update \

&& apt-get install -y --no-install-recommends iperf3 ca-certificates tzdata \

&& rm -rf /var/lib/apt/lists/*

# debian has no distroless `nonroot` account, so recreate the SAME uid/gid (65532)

# the default image runs as. This keeps the volume-ownership contract identical: a

# freshly created named volume inherits 65532 and the unprivileged process can

# write its database + pingularity.key. Creating the account (not just USER 65532)

# also restores the /etc/passwd entry distroless `nonroot` provides, so uid->name

# lookups resolve.

RUN groupadd --gid 65532 pingularity \

&& useradd --uid 65532 --gid 65532 --no-create-home --home-dir /var/lib/pingularity --shell /usr/sbin/nologin pingularity

COPY --from=setcap /pingularity /pingularity

# The licences the binary is distributed under. Every other channel carries these

# - the archives ship them beside the binary (.goreleaser.yaml archives.files) and

# the deb/rpm install them under /usr/share/doc/pingularity - but an image is a

# binary distribution too, and the statically-linked binary carries BSD-3 code

# (golang.org/x, speedtest-go, the modernc/musl-derived libc) plus an embedded

# OFL font, all of which ask for their notice to travel with it. goreleaser stages

# only the built binaries into the docker context, so both files are named in that

# builder's extra_files; without them this COPY fails the build rather than

# silently shipping an image with no notices.

COPY LICENSE THIRD-PARTY-NOTICES.md /usr/share/doc/pingularity/

# The data dir must exist owned by 65532 so a freshly created named volume inherits

# that ownership and the unprivileged process can write to it.

# --chmod=0700 to match the mode pingularity gives a data directory it creates

# itself; see the same COPY in Dockerfile. Without it the destination directory is

# 0755 (COPY does not carry the source mode across) and the daemon spends every

# start warning that its own data directory is readable by others.

COPY --from=setcap --chown=65532:65532 --chmod=0700 /data /var/lib/pingularity

# Belt and braces: some BuildKit versions apply COPY --chmod to the files but

# not the directory itself (observed: buildx honors it, ubuntu-latest's plain

# docker build does not), and this image HAS a shell to correct it. The

# distroless default image cannot RUN anything, so it seeds the directory one

# level down and copies it as an entry instead - see the COPY in Dockerfile.

# The daemon also tightens its own container data dir at boot either way

# (store.go's container carve-out).

RUN chmod 0700 /var/lib/pingularity

EXPOSE 9000

VOLUME /var/lib/pingularity

# Start in the writable data dir rather than / (unwritable for uid 65532), the

# same guarantee the distroless base gives the default image via /home/nonroot:

# anything that resolves a relative path lands somewhere the process can write.

WORKDIR /var/lib/pingularity

USER pingularity

# Same healthcheck as the default image, exec form for parity (this image has a

# shell, but the contract is one probe in both variants). The subcommand probes

# http://127.0.0.1:9000/healthz; operators who change -listen must override this

# healthcheck (or disable it), or the container reports unhealthy while the

# daemon is fine.

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \

CMD ["/pingularity", "healthz"]

# Pin the database onto the volume, exactly as the default image does: without this

# the path is chosen from the effective uid and a --user override would fall back to

# a temp dir inside the writable layer, leaving the mounted volume empty so updates

# silently discard all history plus pingularity.key. The key lives beside the

# database, so pinning -db pins both.

ENTRYPOINT ["/pingularity", "run", "-db", "/var/lib/pingularity/pingularity.db"]