containers

Self-built Docker images from source. Trust but verify.

Why?

Instead of blindly trusting Docker Hub images, this repo builds images directly from upstream source code. Every build is:

• Auditable - You can inspect the Dockerfile and see exactly what's included
• Reproducible - Pinned versions and build args tracked in git
• Signed - Cryptographically signed with build provenance attestations
• Secure - Follows security best practices (see below)
• Current - Renovate auto-merges upstream updates

Images

Image	Description	Upstream
autoshift	Automatic SHiFT code redemption for Borderlands	Fabbi/autoshift
changedetection-mcp-sse	ChangeDetection.io MCP server with SSE transport (k8s)	rusty4444/changedetection-mcp
chdman	MAME chdman + unzip for converting disc images to CHD	mamedev/mame
daedalus	Minimal self-owned SSH dev box (sshd + baked kubectl/helm/Claude/Codex toolchain)	OpenSSH
db-backup	Database dump toolbox (PostgreSQL/MariaDB/MongoDB clients + curl/jq) for backup CronJobs	Original
dq8-alchemy-planner	Dragon Quest VIII alchemy planner, static site on unprivileged nginx, plus a watcher that publishes the newest PS2 save	sharkusmanch/dq8-alchemy-planner
envsubst	Environment variable substitution with defaults	a8m/envsubst
flareproxy	HTTP proxy adapter for FlareSolverr	mimnix/FlareProxy
game-companion	Second-screen page showing the current game's guide pages and achievement progress	Original
hass-mcp	Home Assistant MCP server for Claude/LLMs (stdio)	voska/hass-mcp
hass-mcp-sse	Home Assistant MCP server with SSE transport (k8s)	voska/hass-mcp
kindle-ingest	Kindle -> BookOrbit ingest: decrypt, convert, upload	Satsuoni/DeDRM_tools
loseit-mcp-sse	Lose It calorie-tracking MCP server with SSE transport (k8s)	atfinke/loseit-mcp
ludusavi	Ludusavi game-save backup tool for headless CLI use	mtkennerly/ludusavi
mcp-proxy	Bridge stdio MCP servers to SSE/HTTP transport	sparfenyuk/mcp-proxy
miniflux-mcp-sse	Miniflux MCP server with SSE transport (k8s)	tssujt/miniflux-mcp
nextdns-rewrites-sync	Sync Tailscale devices + static entries to NextDNS rewrites API	Original
paseo	Headless Paseo agent-orchestration daemon (claude/codex/kubectl/helm baked)	getpaseo/paseo
pod-reaper	Rule-based Kubernetes pod cleanup controller	target/pod-reaper
podcast-feed-filter	Podcast RSS feed filter preserving enclosures	Original
pokemon-red-mastery-companion	Pokémon Red mastery guide with read-only save and scoped progress feeds	Original
redlib	Private Reddit frontend	redlib-org/redlib (PR #509)
rss-youtube-downloader	RSS feed YouTube video downloader with series routing	Original
steam-wishlist-calendar	ICS calendar from Steam wishlist release dates	icue/SteamWishlistCalendar
tachyon	Tachyon webmail (SnappyMail fork), unprivileged, with gpg for server-side PGP	kimusan/Tachyon
tailscale-hosts-sync	Sync Tailscale devices to hosts file for DNS	Original
twitch-drops-miner	Twitch drops miner web UI (self-maintained: upstream release + PR #62 and a local GQL retry-budget patch; no browser stack)	rangermix/TwitchDropsMiner
vikunja-mcp-sse	Vikunja task-manager MCP server with SSE transport (k8s)	democratize-technology/vikunja-mcp
yamtrack	Media tracker, rootless overlay (drops the PUID/PGID remap that forces root)	FuzzyGrim/Yamtrack

Security Practices

All images follow these security standards:

Image Signing

All container images are signed using GitHub's attest-build-provenance action. This provides cryptographic proof that images were built by this repository's CI pipeline.

Verify with GitHub CLI:

gh attestation verify --repo sharkusmanch/containers \
  oci://ghcr.io/sharkusmanch/containers/redlib:latest

Verify with cosign:

cosign verify-attestation \
  --type https://slsa.dev/provenance/v1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "^https://github.com/sharkusmanch/containers/.github/workflows/build.yml@refs/heads/main$" \
  ghcr.io/sharkusmanch/containers/redlib:latest

Build-time

• Multi-stage builds - Build dependencies don't ship to runtime
• Pinned base images - Versions tracked, updated via Renovate
• Minimal final images - Alpine or distroless where possible
• No secrets in layers - Build args for config, not credentials

Runtime

• Non-root user - Explicit UID/GID (10000:10000)
• No shell where possible - Reduces attack surface
• Health checks - Built-in liveness probes
• OCI labels - Source repo, commit SHA, build date (see below)

Deployment (for your k8s manifests)

Recommended security context:

securityContext:
  runAsNonRoot: true
  runAsUser: 10000
  runAsGroup: 10000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

OCI Labels

All images include OCI standard labels for traceability. These are recognized by container registries (GHCR, Docker Hub, Quay), security scanners, and tooling.

Label	Purpose
org.opencontainers.image.created	Build timestamp
org.opencontainers.image.revision	Git commit SHA of this repo
org.opencontainers.image.version	Upstream version or commit
org.opencontainers.image.source	URL to this repo
org.opencontainers.image.upstream	URL to upstream source
org.opencontainers.image.title	Image name
org.opencontainers.image.description	Short description

Inspect labels with:

docker inspect ghcr.io/sharkusmanch/containers/redlib:latest \
  --format '{{json .Config.Labels}}' | jq

Versioning Strategy

This repo:

• Renovate auto-merges base image updates and upstream version bumps
• Images pushed to ghcr.io/sharkusmanch/containers/<name>:<tag>
• Tags mirror upstream versions where possible, or use commit SHA for unmerged PRs

Your deployment:

• Pin to specific tags in your k8s manifests
• Use a separate Renovate config to control rollout

Adding a New Image

1. Create images/<name>/Dockerfile
2. Create images/<name>/README.md documenting upstream source and any modifications
3. Add Renovate comments for version tracking
4. Submit PR - workflow will build and push on merge

Local Building

# Build a specific image
docker build -t myimage images/autoshift/

# Build with specific version
docker build --build-arg VERSION=v1.2.3 -t myimage images/autoshift/