devsam/core2026_docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(runtime): harden smoke and credential boundaries

Browse Source
This commit is contained in:
Hide_D
2026-08-04 16:05:06 +00:00
parent 09d849de07
commit c49989631f
16 changed files with 517 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check.sh
+26 -3
View File
@@ -4,9 +4,32 @@ set -eu
stack_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
cd "$stack_dir"
docker compose --env-file .env config --quiet
docker compose --env-file .env -f compose.yaml -f compose.dev.yaml config --quiet
docker run --rm -v "$stack_dir/caddy/Caddyfile:/etc/caddy/Caddyfile:ro" \
env_file=${ENV_FILE:-.env}
if [ ! -f "$env_file" ]; then
echo "$env_file does not exist; copy .env.example and replace every placeholder first." >&2
exit 66
fi
docker run --rm --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 --env-file "$env_file" \
-v "$stack_dir/runtime/validate-env.mjs:/opt/sammo/validate-env.mjs:ro" \
node:24.18.0-bookworm-slim node /opt/sammo/validate-env.mjs
docker compose --env-file "$env_file" config --quiet
docker compose --env-file "$env_file" -f compose.yaml -f compose.dev.yaml config --quiet
docker compose --env-file "$env_file" -f compose.yaml -f compose.smoke.yaml config --quiet
docker compose --env-file "$env_file" config --format json | \
docker run --rm -i --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 \
-v "$stack_dir/runtime/validate-compose-model.mjs:/opt/sammo/validate-compose-model.mjs:ro" \
node:24.18.0-bookworm-slim node /opt/sammo/validate-compose-model.mjs production
docker compose --env-file "$env_file" -f compose.yaml -f compose.dev.yaml config --format json | \
docker run --rm -i --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 \
-v "$stack_dir/runtime/validate-compose-model.mjs:/opt/sammo/validate-compose-model.mjs:ro" \
node:24.18.0-bookworm-slim node /opt/sammo/validate-compose-model.mjs development
docker compose --env-file "$env_file" -f compose.yaml -f compose.smoke.yaml config --format json | \
docker run --rm -i --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 \
-v "$stack_dir/runtime/validate-compose-model.mjs:/opt/sammo/validate-compose-model.mjs:ro" \
node:24.18.0-bookworm-slim node /opt/sammo/validate-compose-model.mjs smoke
docker run --rm --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 \
-v "$stack_dir/caddy/Caddyfile:/etc/caddy/Caddyfile:ro" \
-e SITE_ADDRESS=:80 -e ACME_EMAIL=validate@example.invalid caddy:2.10.2-alpine \
caddy validate --config /etc/caddy/Caddyfile
echo 'Compose and Caddy configuration are valid.'