chore: 🔧 switch Containerfile to Project Hummingbird base images #140

Merged

goern merged 0 commits from refs/pull/140/head into main

2026-05-24 06:46:49 +00:00

goern commented

2026-05-24 06:45:16 +00:00

(Migrated from codeberg.org)

Summary

Replaces docker.io/library/golang:1.26-alpine + alpine:edge with Project Hummingbird hardened, distroless-style base images.

Stage	Before	After
Build	`golang:1.26-alpine`	`registry.access.redhat.com/hi/go:1.25.10-builder`
Runtime	`alpine:edge`	`registry.access.redhat.com/hi/core-runtime:2.42`

Both pinned by sha256 digest for reproducibility.

Changes

Package manager: Hummingbird is RHEL-based — apk add make → dnf install -y make git && dnf clean all. git is required because the Makefile's VERSION calls git describe.
Runtime layer dropped: apk add ca-certificates tzdata removed; hi/core-runtime ships these baked in and is distroless (no shell, no package manager).
Build invocation fix: RUN ... make → RUN ... make build. The Makefile sets .DEFAULT_GOAL := help, so the previous form ran the help target and built nothing meaningful — pre-existing bug surfaced while migrating.

Notes

Hummingbird's hi/go is currently capped at 1.25.10 (no 1.26 published yet). go.mod declares go 1.25.0, so the toolchain is compatible. Bump to 1.26 once Hummingbird publishes it.
Resulting image size: ~53 MB. Smoke-tested locally with podman build + podman run --rm <image> --version.

Test plan

podman build -t forgejo-mcp:hummingbird-test -f Containerfile . succeeds
podman run --rm forgejo-mcp:hummingbird-test --version outputs version string
CI builds green
Reviewer verifies pinned digests resolve on Red Hat registry

## Summary Replaces `docker.io/library/golang:1.26-alpine` + `alpine:edge` with [Project Hummingbird](https://hummingbird-project.io/) hardened, distroless-style base images. | Stage | Before | After | |---|---|---| | Build | `golang:1.26-alpine` | `registry.access.redhat.com/hi/go:1.25.10-builder` | | Runtime | `alpine:edge` | `registry.access.redhat.com/hi/core-runtime:2.42` | Both pinned by `sha256` digest for reproducibility. ## Changes - **Package manager**: Hummingbird is RHEL-based — `apk add make` → `dnf install -y make git && dnf clean all`. `git` is required because the Makefile's `VERSION` calls `git describe`. - **Runtime layer dropped**: `apk add ca-certificates tzdata` removed; `hi/core-runtime` ships these baked in and is distroless (no shell, no package manager). - **Build invocation fix**: `RUN ... make` → `RUN ... make build`. The Makefile sets `.DEFAULT_GOAL := help`, so the previous form ran the help target and built nothing meaningful — pre-existing bug surfaced while migrating. ## Notes - Hummingbird's `hi/go` is currently capped at **1.25.10** (no 1.26 published yet). `go.mod` declares `go 1.25.0`, so the toolchain is compatible. Bump to 1.26 once Hummingbird publishes it. - Resulting image size: **~53 MB**. Smoke-tested locally with `podman build` + `podman run --rm <image> --version`. ## Test plan - [x] `podman build -t forgejo-mcp:hummingbird-test -f Containerfile .` succeeds - [x] `podman run --rm forgejo-mcp:hummingbird-test --version` outputs version string - [ ] CI builds green - [ ] Reviewer verifies pinned digests resolve on Red Hat registry

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!140

No description provided.

Rows
Columns