mildman1848 Docker Image Template

Reusable LinuxServer.io-inspired Docker image template for self-built homelab images.

This is the master template for future image repositories. It intentionally synthesizes the useful parts from the older image repos instead of copying their historical ballast:

• Make ideas from rclone, serpbear, and tandoor
• Container operation helpers from abs-tracked
• SBOM/security ideas from audiobookshelf
• The current GitHub → Codeberg/GitLab mirror.yml

Goals

• Consistent LinuxServer.io-style runtime foundation.
• s6-overlay v3 supervision patterns.
• Secure make workflows for secrets and local automation.
• Local build, smoke, scan, SBOM, and container-debug targets.
• Reusable GitHub Actions workflow for multiarch Docker builds.
• Git mirrors to Codeberg and GitLab.
• Registry strategy: GHCR and Docker Hub first; GitLab/Codeberg registries after the image is proven.

What this repo is

This repository is the template. Real images live in their own repositories, for example:

• postgresql
• mariadb

PostgreSQL and MariaDB are deliberately not kept under examples/; they are validation projects and future standalone image repos.

Quick start

make help
make info
make lint
make env-setup
make secret SECRET_NAME=secrets/my_service_password.txt

For a real image repo copied from this template:

make build IMAGE_NAME=my-image APP_VERSION=1.2.3 IMAGE_REVISION=mldm1
make security-scan IMAGE_NAME=my-image APP_VERSION=1.2.3 IMAGE_REVISION=mldm1
make sbom IMAGE_NAME=my-image APP_VERSION=1.2.3 IMAGE_REVISION=mldm1

If the local Docker socket needs sudo:

make build DOCKER='sudo docker'
make security-scan DOCKER='sudo docker'

Important defaults

Setting	Default
Image revision suffix	mldm<N>
Required CI platforms	linux/amd64,linux/arm64
Raspberry Pi 32-bit	best effort only; verify base image manifest first
Base image policy	pin real LSIO base tags, never latest
Runtime user policy	s6 starts as root, final app process drops to abc
Secrets	generated by Python CSPRNG, mode 0600, values never printed

Design docs

• docs/architecture.md
• docs/make-targets.md
• docs/secrets.md
• docs/security-sbom.md
• docs/registries.md
• docs/upstream-policy.md
• docs/versioning.md
• docs/licensing.md
• docs/implementation-plan.md

Verification

The template itself has no production Dockerfile, so build targets intentionally fail with a clear message until copied into an image repository.

Static verification:

make lint
make validate
actionlint

Standalone image repositories

The pilot images now live in standalone repositories named after the image:

• postgresql
• mariadb

Repository names match the image names. LSIO-style behavior is documented in the image metadata and README instead.