Dockerfiles

Here I am keeping the dockerfiles I create or use for my projects.

• PHP-FPM with everything the Wordpress and Nextcloud need. Non-minimal!
• Postfix container
• Dovecot
• Rspamd
• Rsyslog
• *-cli images are used for backups
• Clamav
• Language tool that is not particulairly useful, since it does not allow you to use Premium features
• VSFTPD: from https://github.com/fauria/docker-vsftpd.git, needed to be build for ARM support.

Building on Fedora

Fedora uses Podman by default. For the repository's AMD64 + ARM64 builds, install Podman and the ARM64 userspace emulator once:

sudo dnf install podman qemu-user-static-aarch64

Reboot after installing the emulator (or restart systemd-binfmt), authenticate, then build all images:

./build.sh

Pass directory names to build only selected images:

./build.sh php postfix sync

An image directory can provide a platforms file to override the default platform list when an upstream binary is architecture-specific.

Image sources retained only for historical reference live under DEPRECATED/. The default one-level */Dockerfile discovery intentionally does not build Dockerfiles below that directory.

The script pushes both latest and a UTC timestamp tag to harbor.andreybondarenko.com/library. It prefers Podman and falls back to Docker Buildx. Both engines import and export reusable build layers through a per-image Harbor repository below library/build-cache/; Podman accepts a custom cache lifetime through CACHE_TTL and defaults to 720 hours. Set LOGIN=0 when already authenticated, PULL=0 to build the current checkout without updating it, or use ./build.sh --help for all overrides.

Weekly rebuilds

The home-k8s repository contains a Kubernetes CronJob that runs every Monday at 02:29 UTC and invokes build.sh inside the podman-builder image. Harbor credentials are provided by External Secrets from kv/harbor; they are not stored in either Git repository.

Bootstrap the self-hosted builder once before enabling the CronJob:

./build.sh podman-builder

The CronJob then rebuilds the builder along with every other image, republishes latest, and creates immutable UTC timestamp tags. The builder intentionally uses Podman's vfs storage driver because it runs nested inside Kubernetes. Its privileged init container registers ARM64 emulation so the existing AMD64+ARM64 build contract is preserved on the AMD64-only cluster.

License