Add scratch Docker image and Gitea publishing workflow

2026-10-28 19:48:35 +00:00
parent b8ee10e7b2
commit a3706f4290
4 changed files with 111 additions and 0 deletions
@@ -38,6 +38,31 @@ curl --proxy http://127.0.0.1:8080 http://example.com/
 curl --proxy http://127.0.0.1:8080 https://example.com/
 ```

+## Docker
+
+The root `Dockerfile` builds a statically linked musl binary and packages it in a non-root `scratch` image with CA certificates. No configuration or credentials are included in the image.
+
+```sh
+docker build -t hermes:local .
+```
+
+Mount a configuration file read-only at `/etc/hermes/hermes.yaml`. Inside the container, set `listen_addr` to `0.0.0.0:8080` so the published port is reachable:
+
+```sh
+docker run --rm \
+  -p 127.0.0.1:8080:8080 \
+  -v "$PWD/hermes.yaml:/etc/hermes/hermes.yaml:ro" \
+  hermes:local
+```
+
+The image sets `HERMES_CONFIG_PATH` to the mount location. Ensure the mounted file is readable by the numeric non-root container user. ACL `networks` rules see the container-network peer address, which may differ from the original host or external client address.
+
+The `scratch` runtime contains no shell or healthcheck utility. Use `docker run --rm hermes:local --version` to verify the binary starts.
+
+### Publishing
+
+The Gitea workflow in `.gitea/workflows/build.yaml` builds and publishes `linux/amd64` images to `gitea.woggioni.net/woggioni/hermes` when a tag matching `release/*` is pushed. For example, `release/v0.2.0` publishes `v0.2.0` and `latest` tags. The repository must define the `PUBLISHER_TOKEN` secret used for registry authentication.
+
 ## YAML configuration

 ```yaml