# debian.sh --arch 'amd64' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=amd64

ARG TARGETVARIANT=

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=amd64 TARGETVARIANT= VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'armhf' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=arm

ARG TARGETVARIANT=v7

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=arm TARGETVARIANT=v7 VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'arm64' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=arm64

ARG TARGETVARIANT=

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=arm64 TARGETVARIANT= VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'ppc64el' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=ppc64le

ARG TARGETVARIANT=

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=ppc64le TARGETVARIANT= VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 'riscv64' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=riscv64

ARG TARGETVARIANT=

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=riscv64 TARGETVARIANT= VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]

# debian.sh --arch 's390x' out/ 'trixie' '@1791158400'

LABEL maintainer=wekan

LABEL org.opencontainers.image.ref.name=debian

LABEL org.opencontainers.image.version=trixie

LABEL org.opencontainers.image.source=https://github.com/wekan/wekan

ARG TARGETARCH=s390x

ARG TARGETVARIANT=

ARG VERSION=12.25

ARG DEBIAN_FRONTEND=noninteractive

ENV BUILD_DEPS=apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip

ENV DEBUG=false DDP_TRANSPORT=sockjs NODE_VERSION=v26.11.1 METEOR_RELEASE=METEOR@3.6-beta.3 USE_EDGE=false NPM_VERSION=12.2.0 SRC_PATH=./ WITH_API=true MONGO_OPLOG_URL= RESULTS_PER_PAGE= DEFAULT_BOARD_ID= ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM= ATTACHMENTS_UPLOAD_MIME_TYPES= ATTACHMENTS_UPLOAD_MAX_SIZE=0 AVATARS_UPLOAD_EXTERNAL_PROGRAM= AVATARS_UPLOAD_MIME_TYPES= AVATARS_UPLOAD_MAX_SIZE=72000 DEFAULT_AVATAR_URL= CARD_OPENED_WEBHOOK_ENABLED=false MAX_IMAGE_PIXEL= IMAGE_COMPRESS_RATIO= NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE= BIGEVENTS_PATTERN=NONE NOTIFY_ON_ASSIGN=true NOTIFY_DUE_DAYS_BEFORE_AND_AFTER= NOTIFY_DUE_AT_HOUR_OF_DAY= EMAIL_NOTIFICATION_TIMEOUT=30000 MATOMO_ADDRESS= MATOMO_SITE_ID= MATOMO_DO_NOT_TRACK=true MATOMO_WITH_USERNAME=false METRICS_ALLOWED_IP_ADDRESSES= BROWSER_POLICY_ENABLED=true TRUSTED_URL= WEBHOOKS_ATTRIBUTES= OAUTH2_ENABLED=false OIDC_REDIRECTION_ENABLED=false OAUTH2_CA_CERT= OAUTH2_ADFS_ENABLED=false OAUTH2_B2C_ENABLED=false OAUTH2_LOGIN_STYLE=redirect OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SECRET_FILE= OAUTH2_SERVER_URL= OAUTH2_AUTH_ENDPOINT= OAUTH2_USERINFO_ENDPOINT= OAUTH2_TOKEN_ENDPOINT= OAUTH2_LOGOUT_ENDPOINT= OAUTH2_ID_MAP= OAUTH2_USERNAME_MAP= OAUTH2_AUTO_REGISTRATION=true OAUTH2_ADMIN_GROUPS= OAUTH2_FULLNAME_MAP= OAUTH2_ID_TOKEN_WHITELIST_FIELDS= OAUTH2_REQUEST_PERMISSIONS=openid profile email OAUTH2_EMAIL_MAP= LDAP_ENABLE=false LDAP_PORT=389 LDAP_HOST= LDAP_AD_SIMPLE_AUTH= LDAP_USER_AUTHENTICATION=false LDAP_USER_AUTHENTICATION_FIELD=uid LDAP_BASEDN= LDAP_LOGIN_FALLBACK=false LDAP_RECONNECT=true LDAP_TIMEOUT=10000 LDAP_IDLE_TIMEOUT=10000 LDAP_CONNECT_TIMEOUT=10000 LDAP_AUTHENTIFICATION=false LDAP_AUTHENTIFICATION_USERDN= LDAP_AUTHENTIFICATION_PASSWORD= LDAP_AUTHENTIFICATION_PASSWORD_FILE= LDAP_LOG_ENABLED=false LDAP_BACKGROUND_SYNC=false LDAP_BACKGROUND_SYNC_INTERVAL= LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false LDAP_ENCRYPTION=false LDAP_CA_CERT= LDAP_REJECT_UNAUTHORIZED=true LDAP_USER_SEARCH_FILTER= LDAP_USER_SEARCH_SCOPE= LDAP_USER_SEARCH_FIELD= LDAP_SEARCH_PAGE_SIZE=0 LDAP_SEARCH_SIZE_LIMIT=0 LDAP_GROUP_FILTER_ENABLE=false LDAP_GROUP_FILTER_OBJECTCLASS= LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= LDAP_GROUP_FILTER_NESTED=false LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN= LDAP_USER_ATTRIBUTES= LDAP_GROUP_BASEDN= OAUTH2_AVATAR_MAP= OAUTH2_MERGE_EXISTING_USERS= OAUTH2_ALLOWED_EMAIL_DOMAINS= OAUTH2_DEFAULT_ORGANIZATION= PROPAGATE_OIDC_DATA= OAUTH2_SECRET_JWT_KEY_PATH= OAUTH2_SECRET_JWT_ISSUER= OAUTH2_SECRET_JWT_KEY_ID= OAUTH2_SECRET_JWT_AUDIENCE= OAUTH2_SECRET_JWT_SUBJECT= OAUTH2_SECRET_JWT_EXPIRES_IN= CAS_MERGE_EXISTING_USERS= LDAP_GROUP_FILTER_GROUP_NAME= LDAP_UNIQUE_IDENTIFIER_FIELD= LDAP_UTF8_NAMES_SLUGIFY=true LDAP_USERNAME_FIELD= LDAP_FULLNAME_FIELD= LDAP_MERGE_EXISTING_USERS=false LDAP_EMAIL_FIELD= LDAP_EMAIL_MATCH_ENABLE=false LDAP_EMAIL_MATCH_REQUIRE=false LDAP_EMAIL_MATCH_VERIFIED=false LDAP_SYNC_USER_DATA=false LDAP_SYNC_USER_DATA_FIELDMAP= LDAP_SYNC_GROUP_ROLES= LDAP_DEFAULT_DOMAIN= LDAP_SYNC_ADMIN_STATUS= LDAP_SYNC_ADMIN_GROUPS= LDAP_SYNC_ORGANIZATIONS=false LDAP_SYNC_ORGANIZATIONS_GROUPS= LDAP_SYNC_TEAMS=false LDAP_SYNC_TEAMS_GROUPS= HEADER_LOGIN_ID= HEADER_LOGIN_FIRSTNAME= HEADER_LOGIN_LASTNAME= HEADER_LOGIN_EMAIL= HEADER_LOGIN_TRUSTED_IPS= HEADER_LOGIN_TRUSTED_PROXIES= LOGOUT_WITH_TIMER=false LOGOUT_IN= LOGOUT_ON_HOURS= LOGOUT_ON_MINUTES= CORS= CORS_ALLOW_HEADERS= CORS_EXPOSE_HEADERS= DEFAULT_AUTHENTICATION_METHOD= PASSWORD_LOGIN_ENABLED=true CAS_ENABLED=false CAS_BASE_URL= CAS_LOGIN_URL= CAS_VALIDATE_URL= SAML_ENABLED=false SAML_PROVIDER= SAML_ENTRYPOINT= SAML_ISSUER= SAML_CERT= SAML_IDPSLO_REDIRECTURL= SAML_PRIVATE_KEYFILE= SAML_PUBLIC_CERTFILE= SAML_IDENTIFIER_FORMAT= SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE= SAML_ATTRIBUTES= SAML_MERGE_EXISTING_USERS=false SAML_IDP_PROFILE= SAML_WANT_RESPONSE_SIGNED= SAML_WANT_ASSERTIONS_SIGNED= SAML_LOGIN_FLOW= OAUTH_GOOGLE_ENABLED=false OAUTH_GOOGLE_CLIENT_ID= OAUTH_GOOGLE_SECRET= OAUTH_GOOGLE_SECRET_FILE= OAUTH_GITHUB_ENABLED=false OAUTH_GITHUB_CLIENT_ID= OAUTH_GITHUB_SECRET= OAUTH_GITHUB_SECRET_FILE= OAUTH_FACEBOOK_ENABLED=false OAUTH_FACEBOOK_APP_ID= OAUTH_FACEBOOK_SECRET= OAUTH_FACEBOOK_SECRET_FILE= OAUTH_TWITTER_ENABLED=false OAUTH_TWITTER_CONSUMER_KEY= OAUTH_TWITTER_SECRET= OAUTH_TWITTER_SECRET_FILE= OAUTH_METEOR_DEVELOPER_ENABLED=false OAUTH_METEOR_DEVELOPER_CLIENT_ID= OAUTH_METEOR_DEVELOPER_SECRET= OAUTH_METEOR_DEVELOPER_SECRET_FILE= OAUTH_WEIBO_ENABLED=false OAUTH_WEIBO_CLIENT_ID= OAUTH_WEIBO_SECRET= OAUTH_WEIBO_SECRET_FILE= OAUTH_MEETUP_ENABLED=false OAUTH_MEETUP_CLIENT_ID= OAUTH_MEETUP_SECRET= OAUTH_MEETUP_SECRET_FILE= OAUTH_PROVIDERS_LOGIN_STYLE=redirect OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS= PASSWORDLESS_ENABLED=false ORACLE_OIM_ENABLED=false WAIT_SPINNER= WRITABLE_PATH=/data S3= MAIL_URL_FILE= MONGO_URL_FILE= S3_SECRET_KEY_FILE=

COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh # buildkit

COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh # buildkit

COPY --chmod=755 releases/check-telemetry.py /tmp/check-telemetry.py # buildkit

COPY releases/risk-baseline.json /tmp/risk-baseline.json # buildkit

COPY --chmod=755 releases/prepare-bundle-npm.mjs /tmp/prepare-bundle-npm.mjs # buildkit

COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs # buildkit

COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs # buildkit

COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json # buildkit

COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs # buildkit

COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs # buildkit

RUN |4 TARGETARCH=s390x TARGETVARIANT= VERSION=12.25 DEBIAN_FRONTEND=noninteractive /bin/sh -c set -o xtrace # Fail hard on any error so a missing release zip / failed download can never # produce a "successful" image with an empty /build (Cannot find /build/main.js). set -eo pipefail # Create Wekan user. --create-home is required because --system users do not # get a home directory by default; without it /home/wekan never exists and the # later `chown ... /home/wekan/` aborts the build (now that set -e is active). useradd --user-group --system --create-home --home-dir /home/wekan wekan # OS Updates apt-get update --assume-yes apt-get upgrade --assume-yes apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} # Runtime MIME detection and Node.js atomic operations survive build cleanup. apt-get install --assume-yes --no-install-recommends file libatomic1 # Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is # both the bundle .zip's name and what resolve-node-source.sh is asked about. # amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB # server and ship FerretDB v1 instead (the ferretdb binary is baked into their # .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf # (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs. case "${TARGETARCH}" in "amd64") WEKAN_ARCH="amd64" ;; "arm64") WEKAN_ARCH="arm64" ;; "ppc64le") WEKAN_ARCH="ppc64le" ;; "s390x") WEKAN_ARCH="s390x" ;; "riscv64") WEKAN_ARCH="riscv64" ;; "386") WEKAN_ARCH="i386" ;; # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6 # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's # ARMv7-A baseline and whose instructions that board cannot execute. "arm") case "${TARGETVARIANT}" in "v6") WEKAN_ARCH="armv6" ;; # v7, and an unset variant, are Debian's armhf port: ARMv7-A, # VFPv3-D16 hard-float. That is what linux/arm/v7 runs. "v7"|"") WEKAN_ARCH="armhf" ;; # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go), # but Node.js does not exist for ARMv5 at all, so there is no bundle to # put in an image and refusing is the only honest answer. *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;; esac ;; *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;; esac # Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org, # then wekan/node-patches, in that order, for EVERY architecture. # # The choice is made by releases/resolve-node-source.sh, copied in above and used # by the .zip bundles and the snap as well, so the image and the bundle of one # architecture always carry the same Node.js from the same place. It is asked # about the MAJOR, so a CPU whose newest build lags a release still gets its # newest: it answers with the exact file, what shape that file is, and the # SHA256 the source published for it. # # npm is arch-independent JavaScript, so it is grafted from the official amd64 # tarball of the version that was resolved - a build-time tool, not the shipped # node. (node-patches publishes a bare node binary and no npm at all, which is # why npm is fetched separately rather than taken from the archive above.) cd /tmp NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}" if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2 exit 1 fi eval "${NODE_META}" echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}" echo "${node_sha256} node-download" | sha256sum -c - case "${node_kind}" in binary) cp node-download /usr/local/bin/node ;; tar.xz|tar.gz|tar) # bsdtar (libarchive-tools) is installed below for the bundle; plain tar # here, letting it detect the compression rather than naming it. tar -xf node-download --no-same-owner "${node_member}" cp "${node_member}" /usr/local/bin/node ;; *) echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2 exit 1 ;; esac chmod +x /usr/local/bin/node # npm + npx from the official amd64 tarball of the SAME version; extract only # those paths, not the amd64 node binary. # Same flags as the download above: a bare wget treats a 503 as fatal, and # nodejs.org has them. wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz" wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \ "https://nodejs.org/dist/${node_full}/SHASUMS256.txt" grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c - tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \ "node-${node_full}-linux-x64/lib/node_modules/npm" \ "node-${node_full}-linux-x64/bin/npm" \ "node-${node_full}-linux-x64/bin/npx" rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs" # NPM configuration npm install -g npm@${NPM_VERSION} chown --recursive wekan:wekan /home/wekan/ # Temporary Tar swap for Meteor bundle cp $(which tar) $(which tar)~ ln -sf $(which bsdtar) $(which tar) # WeKan Bundle Installation mkdir -p /home/wekan/app cd /home/wekan/app # Retry the release-asset download: even though the CI `docker` job needs the # `release` job (so the asset is already uploaded), GitHub's # releases/download/<tag>/<asset> URL can briefly return 404 right after upload # (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the # build; retry on transient HTTP errors so propagation lag no longer breaks it. WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip" wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \ || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; } unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip" rm "wekan-${VERSION}-${WEKAN_ARCH}.zip" node /tmp/prepare-bundle-npm.mjs ./bundle npm install --prefix ./bundle/programs/server # node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module # in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their # tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the # published image, so it goes now that the install is done. node /tmp/prune-build-only-modules.mjs ./bundle # The .zip already carries the bumped meteor/ tree; this install put back # meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the # same pass runs here. node /tmp/bump-bundle-npm-deps.mjs ./bundle # No uWebSockets.js, no legacy client, no source maps: this image runs sockjs, # serves web.browser to every browser, and has no debugger attached to it. node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client # And the npm tree rspack cannot tree-shake, because Atmosphere packages load it # through Npm.require(). Only what it can prove nothing requires. node /tmp/prune-unreachable-npm.mjs ./bundle python3 /tmp/check-telemetry.py --bundle ./bundle mv /home/wekan/app/bundle /build # The .zip bundle now ships a self-contained launcher + its own Node.js for the # offline downloads; the Docker image installs its own Node and uses # wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps # /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools # (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the # bundle) for backup/restore inside the container. Saves ~80 MB per arch. rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat # Restore original tar mv $(which tar)~ $(which tar) # Cleanup # npm is a BUILD tool in this image and nothing else: the only thing it does is # the `npm install` above, and the container starts bash + wekan-entrypoint.sh, # which never calls it. Shipping it shipped npm's own bundled dependencies - its # `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` - # as image content that no code path can reach. node itself stays, because that # is what runs WeKan. rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx # Remove unused Go-based pebble binary shipped by base image to reduce CVE surface. apt-get remove --purge --assume-yes pebble || true rm -f /usr/bin/pebble apt-get remove --purge --assume-yes ${BUILD_DEPS} apt-get autoremove --assume-yes apt-get clean --assume-yes rm -Rf /tmp/* rm -Rf /var/lib/apt/lists/* rm -Rf /home/wekan/app mkdir -p /data chown wekan:wekan --recursive /data # buildkit

COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh # buildkit

COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs # buildkit

COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs # buildkit

USER wekan

ENV PORT=8080

EXPOSE [8080/tcp]

STOPSIGNAL SIGKILL

WORKDIR /build

CMD ["bash" "/build/wekan-entrypoint.sh"]