SYS-696 dual image publishing to ghcr and docker hub

.image-gitlab-ci.yml

@@ -4,7 +4,7 @@ variables:
   IMAGE: {{ IMAGE }}
   PLATFORMS: linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7
   REGISTRY: $REGISTRY_URI/$CI_PROJECT_PATH
-  TRIVY_VERSION: 0.72.0
+  TRIVY_VERSION: 0.73.0
 
 stages:
   - Static Code Analysis
@@ -13,7 +13,7 @@ stages:
   - Security Scan
   - Promote Image
 
-image: docker:29.5.2
+image: docker:29.7.1
 
 .registry_template: &registry_login
   before_script:

README.md

@@ -16,7 +16,7 @@ easy. Contents:
 | services | non-clustered docker-compose services |
 | ssl | PKI certificate tools (deprecated by k8s) |
 
-Find images at [docker hub/instantlinux](https://hub.docker.com/r/instantlinux/). Each image is scanned by [trivy](https://trivy.dev/) to ensure they contain no known CVE vulnerabilities before promotion to Docker Hub.
+Find images at [docker hub/instantlinux](https://hub.docker.com/r/instantlinux/) or [ghcr.io/instantlinux](https://github.com/instantlinux?tab=packages). Each image is scanned by [trivy](https://trivy.dev/) to ensure they contain no known CVE vulnerabilities before promotion to ghcr.io and Docker Hub.
 
 Find a lot more details about the Kubernetes bare-metal installer in [k8s/README](k8s/README.md).
 

images/blacklist/Dockerfile

@@ -2,6 +2,7 @@ FROM debian:trixie-slim
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.build-date=$BUILD_DATE \
     org.label-schema.license=Apache-2.0 \
     org.label-schema.name=blacklist \

images/blacklist/README.md

@@ -1,5 +1,5 @@
 ## DNS blacklist for spamassassin
-[![](https://img.shields.io/docker/v/instantlinux/blacklist?sort=date)](https://hub.docker.com/r/instantlinux/blacklist/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/blacklist?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/blacklist "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/blacklist/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/blacklist?sort=date)](https://hub.docker.com/r/instantlinux/blacklist/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/blacklist?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/blacklist "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/blacklist/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/blacklist)
 
 This is based on [Running Your Own RBL DNS Blacklist](http://www.blue-quartz.com/rbl/) (or see [alt link](https://g33kinfo.com/info/running-your-own-rbl-dns-blacklist/)) using the Debian rbldnsd
 package adapted from scripts published by Herb Rubin some years ago.

images/blacklist/hooks/add_tags

@@ -1,3 +1,2 @@
 #!/bin/sh
-TAG=$(grep "ARG RBLDNSD_VERSION=" Dockerfile |cut -d = -f 2|cut -d '~' -f 1)
-echo "--tag $DOCKER_REPO:$TAG"
+echo $(grep "ARG RBLDNSD_VERSION=" Dockerfile |cut -d = -f 2|cut -d '~' -f 1)

images/data-sync/Dockerfile

@@ -2,6 +2,7 @@ FROM alpine:3.24
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.license=Apache-2.0 \
     org.label-schema.name=data-sync \
     org.label-schema.vcs-ref=$VCS_REF \

images/data-sync/README.md

@@ -1,5 +1,5 @@
 ## data-sync
-[![](https://img.shields.io/docker/v/instantlinux/data-sync?sort=date)](https://hub.docker.com/r/instantlinux/data-sync/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/data-sync?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/data-sync "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/data-sync/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/data-sync?sort=date)](https://hub.docker.com/r/instantlinux/data-sync/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/data-sync?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/data-sync "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/data-sync/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/data-sync)
 
 This provides HA storage for a bare-metal cluster. NAS servers are not usually HA and SAN installations are costly. Add this resource definition to your Kubernetes cluster and the volumes you mount under a directory /var/data-sync will be kept in sync using the [unison](https://www.cis.upenn.edu/~bcpierce/unison/) file synchronizer from UPenn.
 

images/data-sync/hooks/add_tags

@@ -1,4 +1,4 @@
 #!/bin/sh
 VER1=$(grep "ARG UNISON_VERSION" Dockerfile | cut -d= -f 2)
 VER2=$(grep "ARG OCAML_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$VER1-$VER2"
+echo $VER1-$VER2

images/ddclient/Dockerfile

@@ -2,6 +2,7 @@ FROM alpine:3.24
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.build-date=$BUILD_DATE \
     org.label-schema.license=GPL-2.0 \
     org.label-schema.name=ddclient \

images/ddclient/README.md

@@ -1,5 +1,5 @@
 ## ddclient
-[![](https://img.shields.io/docker/v/instantlinux/ddclient?sort=date)](https://hub.docker.com/r/instantlinux/ddclient/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/ddclient?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/ddclient "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/ddclient/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/ddclient?sort=date)](https://hub.docker.com/r/instantlinux/ddclient/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/ddclient?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/ddclient "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/ddclient/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/ddclient)
 
 Dynamic-DNS client - automatically updates a public DNS name with your dynamic IP address. Set this up under Kubernetes or Docker Swarm to ensure it's always running.
 

images/ddclient/hooks/add_tags

@@ -1,3 +1,2 @@
 #!/bin/sh
-TAG=$(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$TAG"
+echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)

images/dhcpd-dns-pxe/Dockerfile

@@ -2,6 +2,7 @@ FROM alpine:3.24
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.build-date=$BUILD_DATE \
     org.label-schema.license=Apache-2.0 \
     org.label-schema.name=dhcpd-dns-pxe \

images/dhcpd-dns-pxe/README.md

@@ -1,5 +1,5 @@
 ## dhcpd-dns-pxe
-[![](https://img.shields.io/docker/v/instantlinux/dhcpd-dns-pxe?sort=date)](https://hub.docker.com/r/instantlinux/dhcpd-dns-pxe/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/dhcpd-dns-pxe?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/dhcpd-dns-pxe "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/dhcpd-dns-pxe/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/dhcpd-dns-pxe?sort=date)](https://hub.docker.com/r/instantlinux/dhcpd-dns-pxe/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/dhcpd-dns-pxe?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/dhcpd-dns-pxe "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/dhcpd-dns-pxe/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/dhcpd-dns-pxe)
 
 Serve DNS and DHCP from one or more small Alpine Linux container(s). This supplies DNS and tftp (for network PXE booting) using dnsmasq, and DHCP using your choice of kea or dnsmasq. Any of the three services can be enabled or disabled. ISC dhcpd is deprecated by its maintainers, and replaced here with kea in January 2026 starting with tag `3.0.2-r0-2.91-r0`. Look at the subnet and reservation definitions for breaking changes.
 

images/dhcpd-dns-pxe/hooks/add_tags

@@ -1,4 +1,4 @@
 #!/bin/sh
 VER1=$(grep "ARG KEA_VERSION" Dockerfile | cut -d= -f 2)
 VER2=$(grep "ARG DNSMASQ_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$VER1-$VER2"
+echo $VER1-$VER2

images/dovecot/Dockerfile

@@ -3,12 +3,13 @@ FROM instantlinux/postfix:3.11.4-r0
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.license=Apache-2.0 \
     org.label-schema.name=dovecot \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG DOVECOT_VERSION=2.4.3-r2
+ARG DOVECOT_VERSION=2.4.4-r0
 ARG PROCMAIL_VERSION=3.22-r4
 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d
 ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9

images/dovecot/README.md

@@ -1,5 +1,5 @@
 ## dovecot
-[![](https://img.shields.io/docker/v/instantlinux/dovecot?sort=date)](https://hub.docker.com/r/instantlinux/dovecot/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/dovecot?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/dovecot "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/dovecot/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/dovecot?sort=date)](https://hub.docker.com/r/instantlinux/dovecot/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/dovecot?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/dovecot "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/dovecot/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/dovecot)
 
 The dovecot imapd daemon in a small Alpine Linux container, with
 postfix for local delivery and procmail for filtering.

images/dovecot/hooks/add_tags

@@ -1,3 +1,2 @@
 #!/bin/sh
-TAG=$(grep -m 1 "ARG .*_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$TAG"
+echo $(grep -m 1 "ARG .*_VERSION" Dockerfile | cut -d= -f 2)

images/ez-ipupdate/Dockerfile

@@ -2,6 +2,7 @@ FROM alpine:3.24
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.build-date=$BUILD_DATE \
     org.label-schema.license=GPL-2.0 \
     org.label-schema.name=ez-ipupdate \

images/ez-ipupdate/README.md

@@ -1,5 +1,5 @@
 ## ez-ipupdate
-[![](https://img.shields.io/docker/v/instantlinux/ez-ipupdate?sort=date)](https://hub.docker.com/r/instantlinux/ez-ipupdate/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/ez-ipupdate?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/ez-ipupdate "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/ez-ipupdate/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/ez-ipupdate?sort=date)](https://hub.docker.com/r/instantlinux/ez-ipupdate/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/ez-ipupdate?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/ez-ipupdate "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/ez-ipupdate/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/ez-ipupdate)
 
 Dynamic-DNS client - automatically updates a public DNS name with your dynamic IP address. Set this up under Kubernetes or Docker Swarm to ensure it's always running.
 

images/ez-ipupdate/hooks/add_tags

@@ -1,3 +1,2 @@
 #!/bin/sh
-TAG=$(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$TAG"
+echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)

images/git-dump/Dockerfile

@@ -2,6 +2,7 @@ FROM alpine:3.24
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
+    org.opencontainers.image.source=https://github.com/instantlinux/docker-tools \
     org.label-schema.build-date=$BUILD_DATE \
     org.label-schema.license=GPL-2.0 \
     org.label-schema.name=git-dump \

images/git-dump/README.md

@@ -1,5 +1,5 @@
 ## git-dump
-[![](https://img.shields.io/docker/v/instantlinux/git-dump?sort=date)](https://hub.docker.com/r/instantlinux/git-dump/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/git-dump?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/git-dump "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/git-dump/Dockerfile "dockerfile")
+[![](https://img.shields.io/docker/v/instantlinux/git-dump?sort=date)](https://hub.docker.com/r/instantlinux/git-dump/tags "Version badge") [![](https://img.shields.io/docker/image-size/instantlinux/git-dump?sort=date)](https://github.com/instantlinux/docker-tools/tree/main/images/git-dump "Image badge") ![](https://img.shields.io/badge/platform-amd64%20arm64%20arm%2Fv6%20arm%2Fv7-blue "Platform badge") [![](https://img.shields.io/badge/dockerfile-latest-blue)](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/git-dump/Dockerfile "dockerfile") [![](https://img.shields.io/badge/ghcr-package-blue?logo=github "ghcr badge")](https://github.com/users/instantlinux/packages/container/package/git-dump)
 
 This dockerizes a simple script I wrote years ago to create git bundle
 backups of a private git server.

images/git-dump/hooks/add_tags

@@ -1,3 +1,2 @@
 #!/bin/sh
-TAG=$(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)
-echo "--tag $DOCKER_REPO:$TAG"
+echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)