Block a user
depot (latest)
Published 2026-10-26 20:55:50 -04:00 by flan
Installation
docker pull git.arch.fyi/flan/depot:latestsha256:f3ecbd7f4306aa0918f9180214014f6b87d9104dbd008933d09d48284940f7df
Images
| Digest | OS / Arch | Size |
|---|---|---|
| d6463cbf6e | linux/amd64 | 904 MiB |
Image Layers ( linux/amd64)
| # debian.sh --arch 'amd64' out/ 'bookworm' '@1785715200' |
| ENV DEBIAN_FRONTEND=noninteractive |
| RUN /bin/sh -c (grep -rl 'Components:' /etc/apt/sources.list.d/ 2>/dev/null | xargs -r sed -i 's/Components: main/Components: main contrib non-free non-free-firmware/' ; sed -i 's/ main$/ main contrib non-free non-free-firmware/' /etc/apt/sources.list 2>/dev/null || true) ; dpkg --add-architecture i386 && apt-get update && apt-get install -y --no-install-recommends wine wine32 wine64 xvfb openbox xdotool imagemagick x11-utils x11-apps p7zip-full p7zip-rar unzip zip rsync openssh-client sqlite3 curl ca-certificates xz-utils innoextract unshield yara clamav procps findutils coreutils sed grep util-linux iproute2 && rm -rf /var/lib/apt/lists/* # buildkit |
| RUN /bin/sh -c freshclam --quiet --stdout || true; chmod -R a+rX /var/lib/clamav && printf 'X5O!P%%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.com && clamscan --no-summary /tmp/eicar.com 2>&1 | grep -q 'Eicar-Test-Signature FOUND' && rm -f /tmp/eicar.com && echo "clamav: signatures loaded and detection verified ($(du -sh /var/lib/clamav | cut -f1))" # buildkit |
| RUN /bin/sh -c mkdir -p /opt/ssl11 && cd /tmp && { curl -fsSL -o l.deb "https://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.1_1.1.1w-0+deb11u8_amd64.deb" || curl -fsSL -o l.deb "https://snapshot.debian.org/archive/debian-security/20260615T025018Z/pool/updates/main/o/openssl/libssl1.1_1.1.1w-0+deb11u8_amd64.deb"; } && echo "dcc68a543de6cb955a57077b66dcdb15f61d1e31e072f2c6cc4082c37da1b00d l.deb" | sha256sum -c - && dpkg-deb -x l.deb x && cp x/usr/lib/x86_64-linux-gnu/libssl.so.1.1 x/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 /opt/ssl11/ && rm -rf x l.deb # buildkit |
| RUN /bin/sh -c mkdir -p /opt/redist-cache && curl -sL -o /opt/redist-cache/vcredist_2008_x86.exe "https://download.microsoft.com/download/5/D/8/5D8C65CB-C849-4025-8E95-C3966CAFD8AE/vcredist_x86.exe" && echo "8742bcbf24ef328a72d2a27b693cc7071e38d3bb4b9b44dec42aa3d2c8d61d92 /opt/redist-cache/vcredist_2008_x86.exe" | sha256sum -c - # buildkit |
| RUN /bin/sh -c innoextract --version && command -v unshield && apt-get update && apt-get install -y --no-install-recommends dolphin-emu && rm -rf /var/lib/apt/lists/* && test -x /usr/games/dolphin-tool # buildkit |
| RUN /bin/sh -c dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | sort > /opt/depot-packages.txt && printf 'recorded %s packages\n' "$(wc -l < /opt/depot-packages.txt)" # buildkit |
| COPY depot/ /opt/depot/depot/ # buildkit |
| COPY assets/ /opt/depot/assets/ # buildkit |
| COPY code/ /opt/depot/code/ # buildkit |
| COPY docker/arr-probe.sh docker/depot.sh docker/entrypoint.sh docker/go-observer.sh docker/migrate.sh docker/midclt /opt/depot/docker/ # buildkit |
| COPY Dockerfile docker-compose.yml build.sh check-gates.sh CHANGELOG.md README.md /opt/depot/ # buildkit |
| COPY docs/INCIDENT.md docs/PORT-GO.md docs/FILE-TYPES.md /opt/depot/docs/ # buildkit |
| COPY docs/contracts/ /opt/depot/docs/contracts/ # buildkit |
| COPY packaging/AppRun packaging/bake-keys.sh packaging/build-appimage.sh /opt/depot/packaging/ # buildkit |
| COPY .gitea/workflows/release.yml .gitea/workflows/ci.yml .gitea/workflows/go.yml /opt/depot/.gitea/workflows/ # buildkit |
| COPY .github/workflows/ci.yml /opt/depot/.github/workflows/ # buildkit |
| COPY /out/ /opt/depot/bin/ # buildkit |
| COPY go/go.mod go/go.sum /opt/depot/go/ # buildkit |
| COPY go/build-static.sh go/check-static.sh go/check-cleanroom.sh /opt/depot/go/ # buildkit |
| COPY go/internal/ /opt/depot/go/internal/ # buildkit |
| COPY go/cmd/ /opt/depot/go/cmd/ # buildkit |
| RUN /bin/sh -c chmod -R a+rX /opt/depot && chmod a+rx /opt/depot/docker/* /opt/depot/depot/*.sh /opt/depot/code/*.sh /opt/depot/code/wizard/*.sh 2>/dev/null || true # buildkit |
| RUN /bin/sh -c set -e; for f in /opt/depot/docker/entrypoint.sh /opt/depot/docker/depot.sh /opt/depot/depot/depot-lib.sh; do su -s /bin/sh -c "test -r $f && test -x $f" nobody || { echo "FATAL: $f is not readable+executable by a non-root user"; ls -l "$f"; exit 1; }; done; echo "entrypoint is readable and executable by a non-root user" # buildkit |
| RUN /bin/sh -c cd /opt/depot && bash depot/tests/smoke.sh # buildkit |
| ARG DEPOT_VERSION=0.314.6 |
| ARG DEPOT_SHA=4e7c0bc |
| RUN |2 DEPOT_VERSION=0.314.6 DEPOT_SHA=4e7c0bc /bin/sh -c chmod -R a+rX /opt/depot/bin /opt/depot/go && DEPOT_GO_DIR=/opt/depot/go /opt/depot/bin/depot-go proof-db /tmp/depot-proof.db >/dev/null && bash /opt/depot/go/check-static.sh /opt/depot/bin /tmp/depot-proof.db && su -s /bin/sh -c "/opt/depot/bin/depot-differential --version" nobody >/dev/null && su -s /bin/sh -c "/opt/depot/bin/depot-go --version" nobody >/dev/null && echo "the Go binaries are executable by a non-root user" && rm -f /tmp/depot-proof.db # buildkit |
| ENV REDIST_CACHE=/opt/redist-cache DEPOT_LIB=/data/games DEPOT_QBIT=/data/downloads DEPOT_DATA=/data/games/_unsorted DEPOT_CONFIG=/config DEPOT_STATE=/state DEPOT_HELPERS=/opt/depot/depot DEPOT_ASSETS=/opt/depot/assets DEPOT_VERSION=0.314.6 DEPOT_SHA=4e7c0bc DEPOT_BIND=0.0.0.0 |
| RUN |2 DEPOT_VERSION=0.314.6 DEPOT_SHA=4e7c0bc /bin/sh -c install -d -m 1777 /home/depot && chmod -R a+rwX /opt/redist-cache # buildkit |
| ENV HOME=/home/depot |
| USER 1000:1000 |
| ENTRYPOINT ["/opt/depot/docker/entrypoint.sh"] |