Docker Containers

Production-ready Docker images with zero-touch upstream monitoring — when a new version drops, builds happen automatically.

What's in the box

Container	What it does	Variants
postgres	PostgreSQL with extension ecosystem	base, vector, analytics, timeseries, distributed, full
terraform	Terraform CLI, cloud-provider scoped	base, aws, azure, gcp, full
wordpress	WordPress with PHP optimizations	—
openresty	Nginx + Lua web platform	—
php	PHP-FPM runtime	—
ansible	Automation platform	—
debian	Minimal base image	—
jekyll	Static site generator	—
openvpn	VPN server	—
sslh	SSL/SSH port multiplexer	—

All images are published to GHCR and Docker Hub.

How it works

Upstream releases new version
        │
        ▼
  upstream-monitor.yaml     ← daily at 06:00 UTC
  detects version change
        │
        ▼
  Creates PR + triggers
  auto-build.yaml
        │
        ▼
  Smart rebuild: compares    ← skips if nothing changed
  build digest vs registry
        │
        ▼
  Multi-arch build           ← linux/amd64 + linux/arm64
  (native runners, no QEMU)
        │
        ▼
  Push to GHCR + Docker Hub
  Emit build lineage JSON
        │
        ▼
  Auto-merge PR

Key differentiators:

• Smart rebuild detection — content-based digest skips unchanged builds (ADR-002)
• Declarative variants — one Dockerfile, N flavors via variants.yaml (ADR-003)
• Build lineage tracking — full provenance chain from source to published image (ADR-004)
• Native multi-arch — parallel amd64/arm64 on dedicated runners, no emulation (ADR-001)

Quick start

# List containers
./make list

# Build a container (auto-discovers latest upstream version)
./make build postgres

# Build with specific version
./make build postgres 17

# Push to registries
./make push postgres

# Check what's upstream
./make version postgres

# Check all containers for updates
./make check-updates

# Show build lineage
./make lineage postgres

# Show image sizes
./make sizes

Adding a container

1. Create a directory with a Dockerfile and a version.sh:

mkdir my-app

2. version.sh discovers the latest upstream version:

#!/bin/bash
source "$(dirname "$0")/../helpers/docker-registry"

get_latest_upstream() {
    latest-docker-tag library/nginx "^[0-9]+\.[0-9]+\.[0-9]+$"
}

handle_version_request "$1" "oorabona/my-app" "^[0-9]+\.[0-9]+\.[0-9]+$" "get_latest_upstream"

3. Build and test:

./make build my-app
./make run my-app

That's it. The CI picks it up automatically on next push.

Requirements

• Docker Engine 20.10+ (or Podman)
• Bash 4.0+
• yq (for variant containers)

Documentation

• Development Guide — internals, variants, build system
• CI/CD Workflows — GitHub Actions reference
• Architecture — pipeline design
• Local Development — dev setup
• Testing Guide — running tests locally
• Container Dashboard — live build status

License

MIT