This repository was archived by the owner on Aug 8, 2026. It is now read-only.
Repository navigation
Migrate to Debian, run non-root, split CI, align with org scaffolding - #64
Merged
Merged
Conversation
Alpine dropped the dhcrelay package entirely starting at 3.21 (upstream ISC-DHCP has had no releases since 2022); Debian trixie still ships and security-patches isc-dhcp-relay, so that's the new base. The process now runs as a non-root user with only NET_RAW/NET_BIND_SERVICE via setcap, verified empirically to still bind port 67 and relay correctly (NET_ADMIN, previously granted, turns out to be unnecessary). - Dockerfile: debian:trixie-slim, setcap+non-root, OCI labels, a real pgrep-free healthcheck, and an entrypoint.sh that builds the dhcrelay command from DHCRELAY_* env vars (falling back to passthrough for any explicit command, so existing compose overrides keep working). - docker-compose.yml: cap_drop: ALL + minimal cap_add, env-var config, drops the obsolete `version:` key. - CI split: hadolint now lives in .github/workflows/lint.yml (GitHub Actions); .woodpecker.yml (replacing .drone.yml) builds/pushes on push-to-master + manual events, tagging images with the resolved isc-dhcp-relay version instead of a hardcoded one. - .github/workflows/dhcrelay-freshness.yml: weekly check comparing Debian's current package version against the published image tag, opens a tracking issue if stale (manual Woodpecker rebuild fixes it). - renovate.json now just extends the shared org preset; .hadolint.yaml overrides DL3008 for the intentionally-unpinned package. - .github/settings.yml + autoassign.yml brought in line with the rest of the account (labelsync.yml/labels.yml removed, now inherited via settings.yml). - README updated for the new compose shape, env vars, and split DHCPv4/DHCPv6 command examples; removed the now-unused Links/ and version_check.txt (Alpine-specific). Addresses #63.
Adds a maintenance-mode notice with a placeholder link to the future Kea-based repo, and a "What changed" summary of the non-root/healthcheck/ env-var/freshness-check work from this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
debian:trixie-slim. Alpine dropped thedhcrelaypackage entirely starting at 3.21 (confirmed empirically against 3.21/3.22/3.23/3.24 - it's just gone). Upstream ISC-DHCP has had no releases since 2022 (#63), but Debian still packages and security-patchesisc-dhcp-relay, so this keeps the image receiving real security fixes going forward instead of being stuck on an ancient Alpine branch.setcap cap_net_raw,cap_net_bind_service+eipon thedhcrelaybinary + a non-rootUSER, with composecap_drop: ALL+cap_add: [NET_RAW, NET_BIND_SERVICE]. Tested against a real interface: binds UDP/67 and relays correctly asuid=999. The previousNET_ADMINgrant turned out to be unnecessary - confirmed by testing, not assumed.entrypoint.shbuilds thedhcrelaycommand line fromDHCRELAY_DOWN_INTERFACE/DHCRELAY_UP_INTERFACE/DHCRELAY_SERVERS/DHCRELAY_MODE/DHCRELAY_EXTRA_ARGS, but if acommand:is given (the old style), it's passed straight through untouched.nc -uzvw3one wouldn't have worked -dhcrelayuses raw AF_PACKET sockets, not a connectable UDP listener. Now checks that PID 1 is stilldhcrelay..github/workflows/lint.yml- hadolint on GitHub Actions (was in Drone)..woodpecker.yml(replacing.drone.yml) - build/push/pushrm/slack, triggered on push-to-master + manual, mirroringdocker-borgmatic/docker-starwars. Tags now resolve the actualisc-dhcp-relayversion installed (e.g.4.4.3) instead of a hardcoded, driftable one..github/workflows/dhcrelay-freshness.yml- weekly check comparing Debian's current package version against the published image tag; opens a tracking issue if stale (mirrorsdocker-starwars' content-freshness pattern). Rebuild stays a manual Woodpecker trigger rather than a silent auto-push..github/settings.yml(_extends: .github),autoassign.ymlnow handles PRs too (excludingrenovate[bot]),labelsync.yml/labels.ymlremoved (labels now inherited from the account-wide settings),renovate.jsonnow just extendsgithub>modem7/renovate-config(no local digest pinning - matches the preset repo's documented convention).Links/andversion_check.txt(Alpine-specific, dead now).Closes #63.
Test plan
docker buildsucceeds;hadolintandshellcheckboth clean.command: [...], old-style) verified: relay starts, listens/sends on a real interface.DHCRELAY_DOWN_INTERFACE/DHCRELAY_UP_INTERFACE/DHCRELAY_SERVERS.uid=999) with onlyNET_RAW+NET_BIND_SERVICE, binds UDP/67.HEALTHCHECKreportshealthywhile the relay is running.prepare-tags/build-and-pushend to end).eno1/br_piholesetup, since I could only test with synthetic interfaces here.