# debian.sh --arch 'amd64' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'armhf' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'arm64' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'ppc64el' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'riscv64' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 's390x' out/ 'trixie' '@1793827419'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG DEBIAN_FRONTEND=noninteractive

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.13.0 METEOR_RELEASE=METEOR@3.6-rc.1 USE_EDGE=false NPM_VERSION=12.2.2 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= USERS_DISABLE_INACTIVE_AFTER_DAYS= LOGOUT_IDLE_MINUTES= REQUIRE_2FA= PASSWORD_MIN_LENGTH= PASSWORD_MIN_LENGTH_ENFORCE= PASSWORD_CHECK_PWNED= HSTS_MAX_AGE= HSTS_INCLUDE_SUBDOMAINS= HSTS_PRELOAD= ATTACHMENTS_RETENTION_DAYS= ATTACHMENTS_RETENTION_MODE= ATTACHMENTS_PURGE_DELETED_AFTER_DAYS= ATTACHMENTS_RETENTION_DRY_RUN= ATTACHMENTS_RETENTION_MAX_PER_RUN= BACKUP_KEEP_DAYS= ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT= INBOUND_IMAP_POLL_SECONDS= INBOUND_EMAIL_PER_ADDRESS_PER_HOUR= INBOUND_EMAIL_WEBHOOK_SECRET= INBOUND_EMAIL_MAX_BYTES= INBOUND_EMAIL_MAX_ATTACHMENT_BYTES= EMAIL_VIEW_SENDS_PER_HOUR= INBOUND_IMAP_DISABLED= WEKAN_DISK_MONITOR= WEKAN_DISK_WATCH_PATHS= WEKAN_RAM_MONITOR= WEKAN_IMPORT_RUN_STALE_MS= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default. useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes # Runtime MIME detection and Node.js atomics. Nothing in this image compiles # anything, so no compiler is installed (and none has to be purged). # No docker-cli: it is a Go program whose Go 1.24 standard library was most of # the image's vulnerability scan, for a client only the UCS migration used. That # talks to the Docker socket itself now (releases/ucs-migration/docker-exec.mjs). apt-get install --assume-yes --no-install-recommends file libatomic1 # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /var/lib/apt/lists/* mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY /out/ / # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

COPY releases/ucs-migration /opt/ucs-migration # buildkit

RUN |1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod 755 /opt/ucs-migration/start.sh /opt/ucs-migration/tools/* # buildkit

COPY releases/nextcloud/capability.json /build/nextcloud-exapp-capability.json # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]