noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
Source-owned Forgejo Actions job image
35 commits 2 branches 0 tags 115 KiB
  • Dockerfile 79.9%
  • Shell 20.1%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Noel Jackson a4123e721f Merge pull request #8 from fix/chromium-runtime-ldconfig-check 
Parse ldconfig output by exact first-field identity after sealed package installation.
2026-08-13 22:11:16 +00:00
.dockerignore Add Dockerfile with Node.js and Docker CLI for Gitea Actions 2025-12-12 15:11:06 +01:00
Dockerfile chore: make Forgejo the canonical image source 2026-08-10 12:18:48 +02:00
Dockerfile.system-hz-hermetic fix(ci): parse ldconfig entries exactly 2026-08-14 00:11:04 +02:00
LICENSE Add Dockerfile with Node.js and Docker CLI for Gitea Actions 2025-12-12 15:11:06 +01:00
README.md fix(ci): seal Chromium runtime libraries 2026-08-13 23:43:39 +02:00
supplychain-hermetic feat: add hermetic supply-chain runner tools (#8) 2026-08-08 21:18:39 +02:00
test-system-hz-hermetic.sh fix(ci): parse ldconfig entries exactly 2026-08-14 00:11:04 +02:00

README.md

act-node-docker

Forgejo Actions compatible runner image with Node.js, Docker CLI, Kubernetes tools, and infrastructure CLIs for use with Forgejo Actions (act-runner).

The canonical source is https://forgejo.noel.sh/noel/act-node-docker.

Features

  • Based on catthehacker/ubuntu:act-latest (GitHub Actions compatible)
  • Node.js pre-installed (for GitHub Actions that require it)
  • Docker CLI with Buildx and Compose plugins
  • Kubernetes tooling with kubectl and kustomize
  • Infrastructure tooling with atmos, tofu, infisical, jq, and ripgrep
  • Hermetic source security tooling with supplychain, OSV Scanner, Gitleaks, zizmor, and a digest-pinned PyPI vulnerability snapshot
  • Codewire CI native tooling with Protocol Buffers compiler and well-known type headers, PostgreSQL client, pkg-config, GTK 3, WebKitGTK 4.1, and XKB X11 development metadata
  • A system-cluster hermetic derivative with checksum-pinned Helm and ShellCheck
  • The checksum-pinned Cilium 1.19.5 chart for networkless bootstrap rendering
  • Checksum-pinned PyYAML for offline manifest contract validation
  • Checksum-pinned Ubuntu runtime packages required by pinned Chromium browser verification, installed during the networkless build phase
  • A sealed-input build contract: an external tokenless fetch phase verifies the exact SHA-256 inputs, then BuildKit mounts them read-only and runs every Dockerfile step with networking disabled
  • Compatible with act-runner's Docker-in-Docker setup

Usage

System CI

docker pull nexus-system-hz-eu-1.tail.noel.sh/oci-approved/act-node-docker@sha256:c9f5387dc5b0ec128af3b16002ebd30d1323bc51bc511404c4c8b22a6288952c

The former Docker Hub image is retained only as the immutable bootstrap base recorded in infrastructure provenance. New system CI artifacts are published to Nexus and consumed by digest through oci-approved.

Forgejo Runner Configuration

Configure your act-runner labels to use this image:

runner_labels:
  - "ubuntu-latest:docker://nexus-system-hz-eu-1.tail.noel.sh/oci-approved/act-node-docker@sha256:c9f5387dc5b0ec128af3b16002ebd30d1323bc51bc511404c4c8b22a6288952c"
  - "ubuntu-22.04:docker://nexus-system-hz-eu-1.tail.noel.sh/oci-approved/act-node-docker@sha256:c9f5387dc5b0ec128af3b16002ebd30d1323bc51bc511404c4c8b22a6288952c"
  - "ubuntu-24.04:docker://nexus-system-hz-eu-1.tail.noel.sh/oci-approved/act-node-docker@sha256:c9f5387dc5b0ec128af3b16002ebd30d1323bc51bc511404c4c8b22a6288952c"

Docker Socket Access

For jobs that need to build Docker images, mount the Docker socket from the DinD sidecar. In your act-runner Helm values:

container:
  options: "-v /var/run/docker.sock:/var/run/docker.sock"

Building Locally

docker build -t act-node-docker:latest .

What's Included

Tool Version Notes
Node.js Latest from base image For GitHub Actions
npm Latest from base image Package manager
Docker CLI Latest stable Client only, connects to external daemon
Docker Buildx Latest stable Multi-platform builds
Docker Compose Latest stable v2 plugin
kubectl 1.36.1 Kubernetes client
kustomize 5.8.1 Kubernetes manifest customization
atmos noeljackson/atmos d64609ef8 Stack and workflow orchestration with Hetzner auth support
supplychain noeljackson/supplychain 4e29a1552 Strict source security gate with fail-closed OSV offline mode
OSV Scanner 2.4.0 Uses the image's digest-pinned PyPI database in hermetic workflows
Gitleaks 8.30.1 Redacted repository secret scanning
zizmor 1.25.2 Offline GitHub/Gitea workflow audit
OpenTofu 1.11.6 Terraform-compatible IaC
Infisical CLI 0.43.58 Secret injection
jq OS package JSON processing
ripgrep OS package Fast repository search
protoc and Protobuf headers OS packages Rust and Connect contract generation, including well-known types
PostgreSQL client OS package Database and integration verification
GTK/WebKitGTK/XKB development metadata OS packages Codewire GPUI/Wry Linux verification
Helm 3.16.4 Added by Dockerfile.system-hz-hermetic for offline runner validation
ShellCheck 0.11.0 Added by Dockerfile.system-hz-hermetic for offline shell validation
Cilium chart 1.19.5 Stored at /opt/infra-artifacts/cilium-1.19.5.tgz for networkless rendering
PyYAML 6.0.2 Checksum-pinned CPython 3.12 amd64 wheel for manifest contract validation
Chromium native runtime Noble-pinned ALSA, NSPR, and NSS libraries installed from four checksum-pinned sealed .deb inputs

License

MIT