Using proper way to define Debian repository for Ubuntu based web-service

This commit is contained in:
Alexey Pustovalov 2026-07-17 18:48:52 +09:00
parent 7061e5e18b
commit 999249248e
4 changed files with 24 additions and 18 deletions

View file

@ -70,7 +70,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
smartmontools \ smartmontools \
sudo" && \ sudo" && \
microdnf -y install \ microdnf -y install \
--disableplugin=subscription-manager \
--disablerepo="*" \ --disablerepo="*" \
--enablerepo="ubi-10-baseos-rpms" \ --enablerepo="ubi-10-baseos-rpms" \
--setopt=install_weak_deps=0 \ --setopt=install_weak_deps=0 \

View file

@ -32,24 +32,24 @@ STOPSIGNAL SIGTERM
COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/sbin/zabbix_web_service /usr/sbin/zabbix_web_service COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/sbin/zabbix_web_service /usr/sbin/zabbix_web_service
COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/conf/ ${ZABBIX_CONF_DIR}/ COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/conf/ ${ZABBIX_CONF_DIR}/
COPY conf/etc/apt/preferences.d/chromium.pref /etc/apt/preferences.d/chromium.pref
RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
--mount=type=cache,target=/var/lib/apt/,sharing=locked \ --mount=type=cache,target=/var/lib/apt/,sharing=locked \
set -eux && \ set -eux && \
INSTALL_PKGS="bash \ INSTALL_SYSTEM_PKGS="ca-certificates \
ca-certificates \ debian-archive-keyring" && \
chromium \
chromium-sandbox" && \
INSTALL_TEMP_PKGS="gnupg dirmngr gpg gpgconf" && \
apt-get update && \ apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y \ DEBIAN_FRONTEND=noninteractive apt-get install -y \
--no-install-recommends \ --no-install-recommends \
${INSTALL_TEMP_PKGS} && \ ${INSTALL_SYSTEM_PKGS}
gpg --keyserver keyserver.ubuntu.com --recv-keys 78DBA3BC47EF2265 && \
gpg -o /etc/apt/keyrings/debian.gpg --export 78DBA3BC47EF2265 && \ COPY conf/etc/ /etc/
echo "deb [signed-by=/etc/apt/keyrings/debian.gpg] http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/debian.list && \
echo "deb [signed-by=/etc/apt/keyrings/debian.gpg] http://deb.debian.org/debian trixie-updates main" >> /etc/apt/sources.list.d/debian.list && \ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
--mount=type=cache,target=/var/lib/apt/,sharing=locked \
set -eux && \
INSTALL_PKGS="chromium \
chromium-sandbox" && \
apt-get update && \ apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y \ DEBIAN_FRONTEND=noninteractive apt-get install -y \
--no-install-recommends \ --no-install-recommends \
@ -72,10 +72,6 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
${ZABBIX_USER_HOME_DIR}/enc_internal && \ ${ZABBIX_USER_HOME_DIR}/enc_internal && \
chown --quiet -R zabbix:0 ${ZABBIX_USER_HOME_DIR}/ && \ chown --quiet -R zabbix:0 ${ZABBIX_USER_HOME_DIR}/ && \
chmod -R g=u ${ZABBIX_USER_HOME_DIR}/ && \ chmod -R g=u ${ZABBIX_USER_HOME_DIR}/ && \
DEBIAN_FRONTEND=noninteractive apt-get purge -y \
${INSTALL_TEMP_PKGS} && \
rm -rf ~/.gnupg && \
apt-get autoremove -y && \
/usr/sbin/zabbix_web_service -V /usr/sbin/zabbix_web_service -V
RUN --mount=from=entrypoints,target=/tmp/entrypoints,ro \ RUN --mount=from=entrypoints,target=/tmp/entrypoints,ro \

View file

@ -4,11 +4,11 @@ Pin: release a=resolute
Pin-Priority: 500 Pin-Priority: 500
Package: * Package: *
Pin: origin "deb.debian.org" Pin: release o=Debian
Pin-Priority: 300 Pin-Priority: 300
# Pattern includes 'chromium', 'chromium-browser' and similarly # Pattern includes 'chromium', 'chromium-browser' and similarly
# named dependencies: # named dependencies:
Package: chromium* Package: chromium*
Pin: origin "deb.debian.org" Pin: release o=Debian
Pin-Priority: 700 Pin-Priority: 700

View file

@ -0,0 +1,11 @@
Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg