vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Remove the container deployment
9bce37233413e6a56c38d5cf90e79dfa496649b2 · Keenan Nemetz · 3d ago · parent c1edfd3c
Remove the container deployment A Vole instance is one process whose state is a directory on local disk. A container therefore adds a layer without removing one, and it costs something real: the service unit's hardening, and the CI half, which needs an OCI runtime the container does not have without mounting the host's socket — the thing the runner docs refuse. It was also the weakest path in practice. No image is published, so an upgrade meant a source checkout and a Go build where the package is one `apt install`. CI never ran the container; it was tested by hand once, which is a surface that rots quietly. So the Dockerfile, the compose file, the entrypoint, the image's configuration, and the guide go. The deployment checker loses its compose and COPY checks, and the render script is the only shipped script left. Every other mention of Docker in the repository means the CI container runtime, and those stay. Users who manage their machines with Compose or Kubernetes are told where they stand: give the forge a small virtual machine of its own, and the first-boot file works there unchanged.
deploy/docker/Dockerfile −67
| @@ -1,67 +0,0 @@ | |||
| 1 | # A Vole instance in one container: the server, its own SSH listener, and the | ||
| 2 | # Git it shells out to. Build it from the repository root, because the compiler | ||
| 3 | # needs the source: | ||
| 4 | # | ||
| 5 | # docker build -f deploy/docker/Dockerfile -t vole . | ||
| 6 | # | ||
| 7 | # The base images are pinned the same way .vole/images pins them, so a rebuild | ||
| 8 | # compiles with the toolchain the release uses. The builder is the exact image | ||
| 9 | # the release workflow builds in; the runtime is the distribution the .deb and | ||
| 10 | # .rpm are made for. | ||
| 11 | # | ||
| 12 | # This image is the server only. A CI runner executes repository code in | ||
| 13 | # containers and needs a real OCI runtime on the host, so it belongs on the | ||
| 14 | # machine, not in here. See docs/runner.md. | ||
| 15 | |||
| 16 | FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build | ||
| 17 | |||
| 18 | # The package links SQLite dynamically, so the binary is built against the | ||
| 19 | # system library rather than the driver's bundled copy; the runtime image | ||
| 20 | # installs the matching library below. | ||
| 21 | RUN apt-get update && apt-get install -y --no-install-recommends gcc libsqlite3-dev && rm -rf /var/lib/apt/lists/* | ||
| 22 | |||
| 23 | WORKDIR /src | ||
| 24 | COPY go.mod go.sum ./ | ||
| 25 | RUN go mod download | ||
| 26 | COPY . . | ||
| 27 | |||
| 28 | ARG VERSION=dev | ||
| 29 | RUN CGO_ENABLED=1 go build -tags libsqlite3,sqlite_fts5 -trimpath \ | ||
| 30 | -ldflags "-s -w -X main.version=${VERSION}" -o /out/vole ./cmd/vole | ||
| 31 | |||
| 32 | FROM debian:13-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 | ||
| 33 | |||
| 34 | # git is what the server runs for every push and clone; curl is the health | ||
| 35 | # check. Nothing else is needed: Vole is one process with no database server | ||
| 36 | # beside it. | ||
| 37 | RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| 38 | ca-certificates curl git libsqlite3-0 \ | ||
| 39 | && rm -rf /var/lib/apt/lists/* | ||
| 40 | |||
| 41 | # The same layout the packages install: a service account that owns the instance | ||
| 42 | # and nothing else, and a state directory under it. Creating the data directory | ||
| 43 | # in the image is what lets a fresh named volume start out owned by that account. | ||
| 44 | RUN groupadd --system vole \ | ||
| 45 | && useradd --system --gid vole --home-dir /var/lib/vole --no-create-home \ | ||
| 46 | --shell /usr/sbin/nologin --comment "Vole software forge" vole \ | ||
| 47 | && install -d -o vole -g vole -m 0750 /var/lib/vole /var/lib/vole/data /etc/vole | ||
| 48 | |||
| 49 | COPY --from=build /out/vole /usr/bin/vole | ||
| 50 | COPY deploy/docker/vole.toml /etc/vole/vole.toml | ||
| 51 | COPY deploy/docker/entrypoint.sh /usr/local/bin/vole-entrypoint | ||
| 52 | |||
| 53 | # Every command in the container finds the instance without being told where it | ||
| 54 | # is: `docker run --rm <image> admin account list` works. | ||
| 55 | ENV VOLE_CONFIG=/etc/vole/vole.toml | ||
| 56 | |||
| 57 | USER vole | ||
| 58 | |||
| 59 | # 2222 is Git over SSH, the only write transport. 8080 is the web interface and | ||
| 60 | # anonymous clone; put a TLS proxy in front of it, or switch the configuration to | ||
| 61 | # https_addr and publish 80 and 443 instead. | ||
| 62 | EXPOSE 2222 8080 | ||
| 63 | |||
| 64 | VOLUME ["/var/lib/vole"] | ||
| 65 | |||
| 66 | ENTRYPOINT ["/usr/local/bin/vole-entrypoint"] | ||
| 67 | CMD ["serve"] | ||