From 664590660b136b1f78b51f057996a3632887efd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B0=D0=BD=D0=B4=D1=80=20?= =?UTF-8?q?=D0=97=D0=B8=D0=BC=D0=B8=D0=BD?= Date: Sat, 20 Jun 2026 21:45:56 +0000 Subject: [PATCH] =?UTF-8?q?fix(ci):=20use=20/dockerhub/=20prefix=20=D0=B4?= =?UTF-8?q?=D0=BB=D1=8F=20Nexus=20proxy=20=D0=BF=D1=83=D1=82=D0=B5=D0=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitlab-ci.yml | 24 ++++++++++++------------ docs/Dockerfile | 4 ++-- ordinis-admin-ui/Dockerfile | 4 ++-- ordinis-app/Dockerfile | 4 ++-- ordinis-migrations/Dockerfile | 2 +- ordinis-projection-writer/Dockerfile | 4 ++-- ordinis-read-api/Dockerfile | 4 ++-- 7 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 9b14acf..7ee738d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -98,7 +98,7 @@ default: # содержит весь changelog со всеми историческими commit'ами — false positive. commit-msg-lint: stage: test - image: repo.nstart.cloud/library/alpine:3.20 + image: repo.nstart.cloud/dockerhub/library/alpine:3.20 script: # Runner не имеет outbound к dl-cdn.alpinelinux.org (Permission denied) — # переадресуем apk на internal Nexus mirror. Это нужно во всех Alpine @@ -174,7 +174,7 @@ commit-msg-lint: # ─── TEST ────────────────────────────────────── maven-test: stage: test - image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 + image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 script: - mvn $MAVEN_CLI_OPTS verify artifacts: @@ -193,9 +193,9 @@ maven-test: # не имеет Docker. maven-e2e: stage: test - image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 + image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 services: - - name: repo.nstart.cloud/library/docker:29.1.2-dind + - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind alias: docker command: ["--tls=false"] variables: @@ -221,7 +221,7 @@ maven-e2e: # на hot paths (parseRef, OnCloseAction, schema traversal). maven-bench: stage: test - image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 + image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 script: - mvn $MAVEN_CLI_OPTS -P bench -pl ordinis-bench -am package -DskipTests # Quick smoke: 1 fork, 2 warmups, 3 measurements × 2s. Total ~5 min. @@ -247,7 +247,7 @@ maven-bench: # идентичных jar'ов ~30 sec. maven-package: stage: build - image: repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 + image: repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 script: - mvn $MAVEN_CLI_OPTS package -DskipTests artifacts: @@ -262,7 +262,7 @@ maven-package: # не выдаёт errors на изменения docs/**. build-docs: stage: build - image: repo.nstart.cloud/library/node:20-alpine + image: repo.nstart.cloud/dockerhub/library/node:20-alpine before_script: # npm install pnpm — corepack может hang на CI runner integrity checks. - npm install -g --silent pnpm@9.15.4 @@ -298,7 +298,7 @@ build-docs: stage: publish image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0 services: - - name: repo.nstart.cloud/library/docker:29.1.2-dind + - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind alias: docker command: ["--tls=false"] # docker-builds группа залипла в GitLab Sidekiq после force-cancel зомби @@ -467,7 +467,7 @@ docker-docs: stage: publish image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0 services: - - name: repo.nstart.cloud/library/docker:29.1.2-dind + - name: repo.nstart.cloud/dockerhub/library/docker:29.1.2-dind alias: docker command: ["--tls=false"] resource_group: docker-builds-v2 @@ -544,7 +544,7 @@ retag-docs: resolve-tag: stage: trigger-deploy - image: repo.nstart.cloud/library/alpine:3.20 + image: repo.nstart.cloud/dockerhub/library/alpine:3.20 script: - echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env # DOCS_IMAGE_TAG может быть пустым если docker-docs не пересобирался @@ -624,7 +624,7 @@ release: # Pinned к alpine3.20 (не latest) — Nexus mirror APKINDEX для v3.23 # рассинхронизирован с filesystem (claims old version, only newer files exist). # v3.20 mirror consistent, apk add работает. См. ci/apk-update-fix история. - image: repo.nstart.cloud/library/node:22-alpine3.20 + image: repo.nstart.cloud/dockerhub/library/node:22-alpine3.20 # Раньше `needs: trigger-deploy-staging` блокировал release когда staging # deploy hang'ался (helm pending-upgrade cascade — каждый retry оставлял # stuck revision, helm wait timeout 15m → rollback → next pipeline стартует @@ -739,7 +739,7 @@ release: # Allow_failure: true — manual deploy backup path остаётся если что. commit-prod-image-bump: stage: release - image: repo.nstart.cloud/library/alpine:3.20 + image: repo.nstart.cloud/dockerhub/library/alpine:3.20 needs: # На tag pipeline images приходят через retag-* (не docker-*) после # !205 (ci/retag-on-tag-pipeline). Поэтому needs ссылается на retag-*. diff --git a/docs/Dockerfile b/docs/Dockerfile index 358a9f1..0e9ff6d 100644 --- a/docs/Dockerfile +++ b/docs/Dockerfile @@ -2,8 +2,8 @@ # Stage 1: build HTML через @diplodoc/cli (yfm). # Stage 2: nginx serving static files на /docs/ path. -ARG NODE_IMAGE=repo.nstart.cloud/library/node:20-alpine -ARG NGINX_IMAGE=repo.nstart.cloud/library/nginx:1.27-alpine +ARG NODE_IMAGE=repo.nstart.cloud/dockerhub/library/node:20-alpine +ARG NGINX_IMAGE=repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine # ─── Stage 1: Build HTML ───────────────────── FROM ${NODE_IMAGE} AS builder diff --git a/ordinis-admin-ui/Dockerfile b/ordinis-admin-ui/Dockerfile index 2a07960..52eef0e 100644 --- a/ordinis-admin-ui/Dockerfile +++ b/ordinis-admin-ui/Dockerfile @@ -1,4 +1,4 @@ -FROM repo.nstart.cloud/library/node:22-alpine AS build +FROM repo.nstart.cloud/dockerhub/library/node:22-alpine AS build # Build identity для VersionBadge / UpdateBanner. Внутри Docker build context # нет .git/ (BUILD_CONTEXT=ordinis-admin-ui/), vite execSync падает → # fallback "unknown" / package.json. CI передаёт реальные значения через @@ -26,7 +26,7 @@ RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --froze COPY . . RUN pnpm build -FROM repo.nstart.cloud/library/nginx:1.27-alpine +FROM repo.nstart.cloud/dockerhub/library/nginx:1.27-alpine COPY --from=build /app/dist /usr/share/nginx/html # Шаблон обрабатывается официальным entrypoint nginx-image: # /docker-entrypoint.d/20-envsubst-on-templates.sh пробегает по diff --git a/ordinis-app/Dockerfile b/ordinis-app/Dockerfile index 165c353..b5c2998 100644 --- a/ordinis-app/Dockerfile +++ b/ordinis-app/Dockerfile @@ -8,7 +8,7 @@ # # .dockerignore исключает frontend (admin-ui), bench, docs, target/, .git/, # IDE metadata — backend image остаётся компактным. -FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build +FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build # Git info из CI environment (`.gitlab-ci.yml` `--build-arg`) — нужен для # Spring Boot build-info goal через ordinis-app/pom.xml. Внутри Docker # context .git/ исключён (.dockerignore), поэтому git-commit-id-maven-plugin @@ -29,7 +29,7 @@ RUN mvn -B -pl ordinis-app -am package -DskipTests \ -Dgit.tags="$GIT_TAG" \ -Dgit.commit.time="$GIT_TIME" -FROM repo.nstart.cloud/library/eclipse-temurin:21-jre +FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre # Non-root user — security hardening (CSO report 2026-05-27 finding #1). # Eclipse-temurin runtime image не задаёт USER by default → JVM от root. # Compromise через Spring Boot CVE / Jackson deserialization без USER diff --git a/ordinis-migrations/Dockerfile b/ordinis-migrations/Dockerfile index b19e765..b4ad23b 100644 --- a/ordinis-migrations/Dockerfile +++ b/ordinis-migrations/Dockerfile @@ -1,5 +1,5 @@ # Liquibase migration image — запускается Helm pre-upgrade Job (1-shot, без Spring Boot) -FROM repo.nstart.cloud/liquibase/liquibase:4.27.0 +FROM repo.nstart.cloud/dockerhub/liquibase/liquibase:4.27.0 USER root COPY src/main/resources/db/changelog /liquibase/changelog diff --git a/ordinis-projection-writer/Dockerfile b/ordinis-projection-writer/Dockerfile index d8f50cc..a799838 100644 --- a/ordinis-projection-writer/Dockerfile +++ b/ordinis-projection-writer/Dockerfile @@ -1,12 +1,12 @@ # Multi-stage build для ordinis-projection-writer. См. ordinis-app/Dockerfile # для rationale `COPY . ./` + `.dockerignore` подхода (single-rule, # future-proof на новые Maven modules). -FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build +FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build WORKDIR /build COPY . ./ RUN mvn -B -pl ordinis-projection-writer -am package -DskipTests -FROM repo.nstart.cloud/library/eclipse-temurin:21-jre +FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre # Non-root user — security hardening (CSO report 2026-05-27 finding #1). # См. ordinis-app/Dockerfile для rationale. RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -s /sbin/nologin app diff --git a/ordinis-read-api/Dockerfile b/ordinis-read-api/Dockerfile index 5cfaddd..f70819e 100644 --- a/ordinis-read-api/Dockerfile +++ b/ordinis-read-api/Dockerfile @@ -1,12 +1,12 @@ # Multi-stage build для ordinis-read-api. См. ordinis-app/Dockerfile для # rationale `COPY . ./` + `.dockerignore` подхода (single-rule, future-proof # на новые Maven modules). -FROM repo.nstart.cloud/library/maven:3.9.9-eclipse-temurin-21 AS build +FROM repo.nstart.cloud/dockerhub/library/maven:3.9.9-eclipse-temurin-21 AS build WORKDIR /build COPY . ./ RUN mvn -B -pl ordinis-read-api -am package -DskipTests -FROM repo.nstart.cloud/library/eclipse-temurin:21-jre +FROM repo.nstart.cloud/dockerhub/library/eclipse-temurin:21-jre # Non-root user — security hardening (CSO report 2026-05-27 finding #1). # См. ordinis-app/Dockerfile для rationale (compromise → root в контейнере # = escalation surface на ноду). UID 10001 outside system+distro reserved.