Harden scripts, fix README/CHANGELOG, add CI lint step #6

Merged

phil merged 8 commits from :improve/code-quality into main

2026-07-17 15:26:41 +02:00

ai-bot commented

2026-07-17 11:43:37 +02:00

Contributor

Summary

A focused set of code-quality and documentation fixes for docker-tftp. All changes are backwards compatible — the container behaves the same; the diff is just hardening, cleanup and missing/incorrect pieces.

Dockerfile

Added # syntax=docker/dockerfile:1.7 so COPY --chmod is reliably supported on any builder.
Switched COPY + RUN chmod +x to a single COPY --chmod=0755 start.sh init.sh /.
Dropped the redundant WORKDIR / and switched the entrypoint to the absolute path /start.sh.
Replaced the old-style LABEL maintainer / LABEL description with the OCI-recommended org.opencontainers.image.* labels (title, description, source, licenses, authors) so the image is properly described by registries and tools.
Hardened HEALTHCHECK: it now fails when either the dnsmasq process is missing or UDP port 69 is unreachable, using a bounded nc -u -z -w 2 check (the previous check relied on busybox nc -z -u which is unreliable for UDP across busybox versions).

init.sh

Added set -euo pipefail so the script aborts on the first failure instead of starting dnsmasq in a half-configured state.
Added an explicit mkdir -p "$TFTP_HOME" before chown/chmod. Previously, if /tftp was removed on the host between container runs, the script failed with a confusing error.
Parameterised the tftp home directory (TFTP_HOME, default /tftp) and tightened the variable quoting.

start.sh

Added set -euo pipefail so /init.sh failures abort the container instead of being logged-and-ignored by the previous [ $? -ne 0 ] check (now simplified away).
Fixed the header comment, which previously read "Init File" while the script actually runs dnsmasq.
Reformatted the dnsmasq options onto separate lines for readability.

.woodpecker.yml

Removed the redundant when: branch: main / event: push block on the security-scan step (already inherited from the top-level when:).
Added a lint step running hadolint against the Dockerfile, matching what the CHANGELOG already promised but had never been wired up.

README.md

Fixed the broken numbered list under "Quick Deployment": it previously started at 3. with steps 1-2 missing.
Restructured the section to read as prose with a code block, which is what the original single-step docker run really was.

CHANGELOG.md

Merged the two ### Changed sections into one (a duplicate heading had been left in an earlier revision).
Added entries describing all the improvements in this PR.

.gitignore

Added entries for OS files (.DS_Store, Thumbs.db), editor backups (*~, *.swp, *.swo) and *.log.

Notes

No changes to the ALPINE_VERSION ARG - Renovate already has an open PR (#5) bumping it to 3.24.1; this PR deliberately leaves that to the bot to avoid a merge conflict.
No changes to renovate.json - it already works via the instance-level config.

Testing

Both shell scripts pass bash -n syntax check.
The Dockerfile follows the Hadolint baseline (syntax directive, no latest without a digest, only the packages actually needed, single-purpose RUN, COPY --chmod instead of separate chmod, etc.) - the CI lint step will be the source of truth.

This change was produced by an AI assistant on behalf of the repository owner.

## Summary A focused set of code-quality and documentation fixes for `docker-tftp`. All changes are backwards compatible — the container behaves the same; the diff is just hardening, cleanup and missing/incorrect pieces. ### Dockerfile - Added `# syntax=docker/dockerfile:1.7` so `COPY --chmod` is reliably supported on any builder. - Switched `COPY` + `RUN chmod +x` to a single `COPY --chmod=0755 start.sh init.sh /`. - Dropped the redundant `WORKDIR /` and switched the entrypoint to the absolute path `/start.sh`. - Replaced the old-style `LABEL maintainer` / `LABEL description` with the OCI-recommended `org.opencontainers.image.*` labels (title, description, source, licenses, authors) so the image is properly described by registries and tools. - Hardened `HEALTHCHECK`: it now fails when either the `dnsmasq` process is missing **or** UDP port 69 is unreachable, using a bounded `nc -u -z -w 2` check (the previous check relied on busybox `nc -z -u` which is unreliable for UDP across busybox versions). ### init.sh - Added `set -euo pipefail` so the script aborts on the first failure instead of starting dnsmasq in a half-configured state. - Added an explicit `mkdir -p "$TFTP_HOME"` before `chown`/`chmod`. Previously, if `/tftp` was removed on the host between container runs, the script failed with a confusing error. - Parameterised the tftp home directory (`TFTP_HOME`, default `/tftp`) and tightened the variable quoting. ### start.sh - Added `set -euo pipefail` so `/init.sh` failures abort the container instead of being logged-and-ignored by the previous `[ $? -ne 0 ]` check (now simplified away). - Fixed the header comment, which previously read "Init File" while the script actually runs dnsmasq. - Reformatted the dnsmasq options onto separate lines for readability. ### .woodpecker.yml - Removed the redundant `when: branch: main / event: push` block on the `security-scan` step (already inherited from the top-level `when:`). - Added a `lint` step running `hadolint` against the Dockerfile, matching what the CHANGELOG already promised but had never been wired up. ### README.md - Fixed the broken numbered list under "Quick Deployment": it previously started at `3.` with steps 1-2 missing. - Restructured the section to read as prose with a code block, which is what the original single-step `docker run` really was. ### CHANGELOG.md - Merged the two `### Changed` sections into one (a duplicate heading had been left in an earlier revision). - Added entries describing all the improvements in this PR. ### .gitignore - Added entries for OS files (`.DS_Store`, `Thumbs.db`), editor backups (`*~`, `*.swp`, `*.swo`) and `*.log`. ### Notes - No changes to the `ALPINE_VERSION` ARG - Renovate already has an open PR (#5) bumping it to 3.24.1; this PR deliberately leaves that to the bot to avoid a merge conflict. - No changes to `renovate.json` - it already works via the instance-level config. ### Testing - Both shell scripts pass `bash -n` syntax check. - The Dockerfile follows the Hadolint baseline (syntax directive, no `latest` without a digest, only the packages actually needed, single-purpose `RUN`, `COPY --chmod` instead of separate `chmod`, etc.) - the CI lint step will be the source of truth. --- This change was produced by an AI assistant on behalf of the repository owner.

ai-bot added 8 commits

2026-07-17 11:43:37 +02:00

Improve Dockerfile: OCI labels, --chmod on COPY, robust healthcheck 9ee752a526

init.sh: set -euo pipefail, ensure TFTP_HOME exists before chown 3a3087f0a1

start.sh: set -euo pipefail, simpler init failure handling, accurate comments 4dac2fd768

CI: drop redundant when-block on security-scan, add hadolint lint step 71da5ecf88

README: fix broken numbered list under Quick Deployment 2872a9da15

.gitignore: add OS / editor / log entries e7444d1998

CHANGELOG: merge duplicate '### Changed' sections, document the new improvements 94a9d9ecb1

init.sh: avoid default (MCP tool mangles it), use plain conditionals 569c3fc91b