Improve Dockerfile, entrypoint and README #2

Merged

phil merged 4 commits from :improve/dockerfile-readme into main

2026-07-16 13:49:10 +02:00

ai-bot commented

2026-07-16 13:17:29 +02:00

Contributor

Hi! This PR cleans up the existing image in three places (Dockerfile, entrypoint, README) without changing what the image actually does — it still runs systemd, still installs proxmox-datacenter-manager from the same trixie mirror, and still SSHs in via the PASSWORD env var.

Dockerfile

ARG DEBIAN_FRONTEND=noninteractive → ENV so the non-interactive flag stays set at runtime, not only during build.
Drop the unused ENV TERM="xterm-256color".
Promote set -eux inside the heavy apt layer so transient failures abort the build instead of leaving a half-installed image.
Add gnupg alongside curl so proxmox-datacenter-manager packages verify cleanly against the keyring.
HEALTHCHECK switches to curl -kfsS for fail-fast probing, and --start-period is bumped to 120s because the PDM API daemon reliably takes >60s to bind on first boot in this base image.
Add the OCI annotations org.opencontainers.image.source, image.url, image.licenses, and image.title. These surface in registries and tools that respect the image-spec annotations.

`scripts/entrypoint.sh`

set -e at the top. The two mount calls are still individually guarded with || true because cgroup v2 hosts don't expose /sys/fs/cgroup, but anything else now aborts before we hand off to systemd.
Emit a warning when PASSWORD is set but /etc/machine-id already exists, so users changing the env var at restart don't silently get the existing password.
Quote the password in chpasswd as defence in depth.

README

Fix the existing typos ("Describtion", "in an simple") and the truncated intro.
Document the linux/amd64-only constraint (PDM upstream has no arm64 packages).
Add explicit Volumes and Ports tables.
Add a docker run example alongside the compose one.
Add a Security notes section calling out that the container intentionally runs with SYS_ADMIN / NET_ADMIN and seccomp / apparmor unconfined, and that root SSH login is enabled by default.
Add Building locally and Tags sections.

`.dockerignore` (new)

Exclude .git, .woodpecker/, docs, and IDE config from the build context.

Verification

Local docker build succeeds, the container boots systemd cleanly, proxmox-datacenter-api.service reports active (running), the HEALTHCHECK settles on healthy, and the entrypoint was tested across all three PASSWORD × /etc/machine-id permutations:

`PASSWORD`	`/etc/machine-id`	Behaviour
unset	absent	no-op
set	absent (first boot)	password is set
set	present (later boot)	skipped, warning on stderr

—

This PR was prepared by an AI agent on behalf of the maintainer.

Hi! This PR cleans up the existing image in three places (Dockerfile, entrypoint, README) without changing what the image actually does — it still runs systemd, still installs `proxmox-datacenter-manager` from the same trixie mirror, and still SSHs in via the `PASSWORD` env var. ## Dockerfile - `ARG DEBIAN_FRONTEND=noninteractive` → `ENV` so the non-interactive flag stays set at runtime, not only during build. - Drop the unused `ENV TERM="xterm-256color"`. - Promote `set -eux` inside the heavy `apt` layer so transient failures abort the build instead of leaving a half-installed image. - Add `gnupg` alongside `curl` so `proxmox-datacenter-manager` packages verify cleanly against the keyring. - HEALTHCHECK switches to `curl -kfsS` for fail-fast probing, and `--start-period` is bumped to 120s because the PDM API daemon reliably takes >60s to bind on first boot in this base image. - Add the OCI annotations `org.opencontainers.image.source`, `image.url`, `image.licenses`, and `image.title`. These surface in registries and tools that respect the image-spec annotations. ## `scripts/entrypoint.sh` - `set -e` at the top. The two `mount` calls are still individually guarded with `|| true` because cgroup v2 hosts don't expose `/sys/fs/cgroup`, but anything else now aborts before we hand off to systemd. - Emit a warning when `PASSWORD` is set but `/etc/machine-id` already exists, so users changing the env var at restart don't silently get the existing password. - Quote the password in `chpasswd` as defence in depth. ## README - Fix the existing typos ("Describtion", "in an simple") and the truncated intro. - Document the `linux/amd64`-only constraint (PDM upstream has no arm64 packages). - Add explicit **Volumes** and **Ports** tables. - Add a `docker run` example alongside the compose one. - Add a **Security notes** section calling out that the container intentionally runs with `SYS_ADMIN` / `NET_ADMIN` and `seccomp` / `apparmor` unconfined, and that root SSH login is enabled by default. - Add **Building locally** and **Tags** sections. ## `.dockerignore` (new) Exclude `.git`, `.woodpecker/`, docs, and IDE config from the build context. ## Verification Local `docker build` succeeds, the container boots systemd cleanly, `proxmox-datacenter-api.service` reports `active (running)`, the HEALTHCHECK settles on `healthy`, and the entrypoint was tested across all three `PASSWORD` × `/etc/machine-id` permutations: | `PASSWORD` | `/etc/machine-id` | Behaviour | |------------|-------------------|-----------| | unset | absent | no-op | | set | absent (first boot) | password is set | | set | present (later boot) | skipped, warning on stderr | — This PR was prepared by an AI agent on behalf of the maintainer.

ai-bot added 4 commits

2026-07-16 13:17:29 +02:00

chore: add .dockerignore to keep build context lean 1962c5dbfc

chore(entrypoint): fail fast on errors and clarify first-boot logic a0489e9ecd

- Add `set -e` so any failed `mount` or `chpasswd` aborts before exec.
- Treat the `mount` failures as non-fatal (cgroup v2 hosts don't expose
  /sys/fs/cgroup), but keep `set -e` for the chpasswd branch.
- Emit a warning to stderr when PASSWORD is set but /etc/machine-id already
  exists, so users tweaking the env var don't silently get no-op behaviour.
- Quote the chpasswd input (defence in depth against weird PASSWORD values).

refactor(dockerfile): cleaner apt layer, modern DEBIAN_FRONTEND, stronger labels 870ebf9b7e

- Switch `ARG DEBIAN_FRONTEND=noninteractive` to `ENV` so it carries through
  to runtime, not just the build.
- Drop the unused `ENV TERM="xterm-256color"` (the running services don't
  care).
- Promote `set -eux` inside the heavy install RUN so apt failures abort
  the build instead of leaving a half-installed image.
- Use `gnupg` when seeding the apt index, so pdm packages verify cleanly.
- HEALTHecheck: use `-fsS` for a fail-fast probe; bump `--start-period` to
  120s because Proxmox Datacenter Manager takes >60s to come up on cold
  boot.
- Add OCI annotations: `image.source`, `image.url`, `image.licenses`,
  `image.title` so the image is discoverable from registries that surface
  those fields.
- Add a few short comments near each non-obvious step (oci labels spec,
  cgroup mount rationale, etc.) — comments are intentionally light to
  match the existing style.

docs: rewrite README with full usage docs b0d14fa2b1

- Fix the typos ("Describtion", "in an simple" in the description; missing
  grammar in ENVs section).
- Document the amd64-only architecture constraint, since PDM upstream has
  no arm64 packages.
- Add explicit volumes, ports, and tag tables so users know what to mount
  and which tag to pin.
- Add a `docker run` example alongside compose — not every operator uses
  compose.
- Add a security section calling out the privileged sandbox so users don't
  expose the container blindly.
- Add a "Building locally" section so the README doubles as a contributor
  doc.
- Strip the bottom-up description sentence so the intro flows.