commit 159dbcc92c1c2efb1c627eba404cabc1748ce87a
parent 1f94c9248e638b5818f43c8e7b02513a7364dd42
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:00:04 +0200
try to improve image updating of base images
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
10 files changed, 148 insertions(+), 4 deletions(-)
diff --git a/apps/talos_cluster/blog/docker/Dockerfile b/apps/talos_cluster/blog/docker/Dockerfile
@@ -1,4 +1,5 @@
# Use Ubuntu as the base image
+# {"$imagepolicy": "flux-system:docker-ubuntu-25"}
FROM ubuntu:25.10
# Non-interactive frontend for apt and set timezone
diff --git a/apps/talos_cluster/continuwuity/Dockerfile b/apps/talos_cluster/continuwuity/Dockerfile
@@ -1,9 +1,11 @@
# Wraps the upstream continuwuity scratch-based image with a shell (debian:12-slim)
# so that Velero pre/post backup hooks can freeze the process via SIGSTOP/SIGCONT.
+# {"$imagepolicy": "flux-system:forgejo-continuwuity-main"}
FROM forgejo.ellis.link/continuwuation/continuwuity:main AS upstream
# Build ldb and sst_dump from the exact RocksDB version continuwuity uses (10.10.1)
# so MANIFEST format is guaranteed compatible for recovery operations.
+# {"$imagepolicy": "flux-system:docker-debian-12-slim"}
FROM debian:12-slim AS rocksdb-tools-builder
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
@@ -27,6 +29,7 @@ RUN cmake -B build \
-DCMAKE_CXX_FLAGS="-Wno-restrict" \
&& cmake --build build --target ldb sst_dump -j$(nproc)
+# {"$imagepolicy": "flux-system:docker-debian-12-slim"}
FROM debian:12-slim
# Runtime deps for ldb/sst_dump
RUN apt-get update \
diff --git a/apps/talos_cluster/image-builder/build-blog-cronjob.yaml b/apps/talos_cluster/image-builder/build-blog-cronjob.yaml
@@ -89,7 +89,6 @@ spec:
--addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
build \
--frontend dockerfile.v0 \
- --no-cache \
--opt platform=linux/amd64,linux/arm64 \
--local context=/workspace/apps/talos_cluster/blog/docker \
--local dockerfile=/workspace/apps/talos_cluster/blog/docker \
diff --git a/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml b/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml
@@ -158,7 +158,6 @@ spec:
--addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
build \
--frontend dockerfile.v0 \
- --no-cache \
--opt platform=linux/amd64,linux/arm64 \
--local context=/workspace/bookwyrm \
--local dockerfile=/workspace/bookwyrm \
diff --git a/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml b/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml
@@ -85,7 +85,6 @@ spec:
build \
--frontend dockerfile.v0 \
--opt platform=linux/amd64,linux/arm64 \
- --no-cache \
--local context=/workspace/apps/talos_cluster/continuwuity \
--local dockerfile=/workspace/apps/talos_cluster/continuwuity \
--output "type=image,name=${IMAGE}:${TAG_TS},push=true,oci-mediatypes=true" \
diff --git a/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml b/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml
@@ -85,7 +85,6 @@ spec:
build \
--frontend dockerfile.v0 \
--opt platform=linux/amd64,linux/arm64 \
- --no-cache \
--local context=/workspace/apps/talos_cluster/matrix-backup/backup-tool \
--local dockerfile=/workspace/apps/talos_cluster/matrix-backup/backup-tool \
--output "type=image,name=${IMAGE}:${TAG_TS},push=true,oci-mediatypes=true" \
diff --git a/apps/talos_cluster/image-policies/base-images.yaml b/apps/talos_cluster/image-policies/base-images.yaml
@@ -0,0 +1,120 @@
+---
+# Ubuntu image for blog
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: docker-ubuntu
+ namespace: flux-system
+spec:
+ image: docker.io/library/ubuntu
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: docker-ubuntu-25
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: docker-ubuntu
+ filterTags:
+ pattern: '^25\.10$'
+ policy:
+ semver:
+ range: "25.10"
+---
+# Debian image for continuwuity and matrix-backup builder
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: docker-debian
+ namespace: flux-system
+spec:
+ image: docker.io/library/debian
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: docker-debian-12-slim
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: docker-debian
+ filterTags:
+ pattern: '^12.*-slim$'
+ policy:
+ semver:
+ range: "12.*"
+---
+# Golang image for matrix-backup builder
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: docker-golang
+ namespace: flux-system
+spec:
+ image: docker.io/library/golang
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: docker-golang-1-25-bookworm
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: docker-golang
+ filterTags:
+ pattern: '^1\.25.*-bookworm$'
+ policy:
+ semver:
+ range: "1.25.*"
+---
+# Distroless static image for matrix-backup runtime
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: gcr-distroless-static
+ namespace: flux-system
+spec:
+ image: gcr.io/distroless/static
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: gcr-distroless-static-nonroot
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: gcr-distroless-static
+ filterTags:
+ pattern: '^nonroot$'
+ policy:
+ alphabetical:
+ order: asc
+---
+# Continuwuity upstream image
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: forgejo-continuwuity
+ namespace: flux-system
+spec:
+ image: forgejo.ellis.link/continuwuation/continuwuity
+ interval: 6h
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: forgejo-continuwuity-main
+ namespace: flux-system
+spec:
+ imageRepositoryRef:
+ name: forgejo-continuwuity
+ filterTags:
+ pattern: '^main$'
+ policy:
+ alphabetical:
+ order: asc
diff --git a/apps/talos_cluster/image-policies/kustomization.yaml b/apps/talos_cluster/image-policies/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
- blog.yaml
- bookwyrm.yaml
- continuwuity.yaml
+ - base-images.yaml
diff --git a/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile b/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile
@@ -2,6 +2,7 @@
# The goolm build tag enables mautrix-go's pure-Go Olm/Megolm implementation.
# Build stage runs on the native host arch; cross-compiles via GOARCH.
+# {"$imagepolicy": "flux-system:docker-golang-1-25-bookworm"}
FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
ARG TARGETARCH
@@ -21,6 +22,7 @@ RUN CGO_ENABLED=0 GOARCH=${TARGETARCH} \
.
# Runtime stage — distroless/static has no shell, no libc, minimal attack surface.
+# {"$imagepolicy": "flux-system:gcr-distroless-static-nonroot"}
FROM gcr.io/distroless/static:nonroot
COPY --from=builder /matrix-backup /matrix-backup
diff --git a/infrastructure_talos/controllers/base-image-updater.yaml b/infrastructure_talos/controllers/base-image-updater.yaml
@@ -0,0 +1,21 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+ name: base-images
+ namespace: flux-system
+spec:
+ interval: 30m
+ sourceRef:
+ kind: GitRepository
+ name: flux-system
+ git:
+ commit:
+ author:
+ email: fluxcdbot@users.noreply.github.com
+ name: fluxcdbot
+ message: "chore(base-images): auto-update base image digests"
+ push:
+ branch: main
+ update:
+ path: ./apps/talos_cluster/
+ strategy: Setters
