containers

Custom container images for homelab and office infrastructure, published to ghcr.io/astrateam-net.

Images are built for linux/amd64 and linux/arm64, versioned with semver tags, and updated automatically by Renovate.

---

Images

App	Image	Version
actions-runner	ghcr.io/astrateam-net/actions-runner	2.336.0
astrapdf	ghcr.io/astrateam-net/astrapdf	2.14.2
astravaultnet	ghcr.io/astrateam-net/astravaultnet	0.43.121
bird-maxmind	ghcr.io/astrateam-net/bird-maxmind	0.1.2
ci-ansible	ghcr.io/astrateam-net/ci-ansible	1.2.0
ci-opentofu	ghcr.io/astrateam-net/ci-opentofu	1.12.5
cnpg-pg-cron	ghcr.io/astrateam-net/cnpg-pg-cron	1.6.7
gerbil-traefik-s6	ghcr.io/astrateam-net/gerbil-traefik-s6	1.4.3
gh-actions-runner	ghcr.io/astrateam-net/gh-actions-runner	0.3.0
gotenberg	ghcr.io/astrateam-net/gotenberg	8.34.0
k8s-sidecar	ghcr.io/astrateam-net/k8s-sidecar	2.10.1
n8n-mcp	ghcr.io/astrateam-net/n8n-mcp	2.47.12
netbox	ghcr.io/astrateam-net/netbox	4.6.8
newt-swarm	ghcr.io/astrateam-net/newt-swarm	1.14.0
obsync	ghcr.io/astrateam-net/obsync	3.5.2
orb-agent	ghcr.io/astrateam-net/orb-agent	2.11.0
pangolin	ghcr.io/astrateam-net/pangolin	1.21.1
postgres-pgbackrest	ghcr.io/astrateam-net/postgres-pgbackrest	17.8.0
postiz	ghcr.io/astrateam-net/postiz	v2.22.1
vlmcsd	ghcr.io/astrateam-net/vlmcsd	svn1113
xtrabackup	ghcr.io/astrateam-net/xtrabackup	8.4.0-6.1

---

Using Images

Tags

Each image is published with the following tags:

Tag	Example	Mutable
Full version	2.332.0	No
Minor version	2.332	Yes
Major version	2	Yes
Rolling	rolling	Yes

Pin to a sha256 digest for true immutability:

docker pull ghcr.io/astrateam-net/actions-runner:2.332.0@sha256:<digest>

Verify Attestation

Images are signed with GitHub's attest-build-provenance. Verify with:

gh attestation verify --repo astrateam-net/containers \
  oci://ghcr.io/astrateam-net/<app>:<tag>

---

Adding an App

1. Create apps/<name>/ with these files:

   apps/<name>/
   ├── Dockerfile
   ├── docker-bake.hcl
   └── tests.yaml
   

2. docker-bake.hcl — follow the standard pattern:

   target "docker-metadata-action" {}
   
   variable "VERSION" {
     // renovate: datasource=docker depName=<upstream-image>
     default = "1.2.3"
   }
   
   variable "SOURCE" {
     default = "https://github.com/upstream/repo"
   }
   
   group "default" {
     targets = ["image-local"]
   }
   
   target "image" {
     inherits = ["docker-metadata-action"]
     args = { VERSION = "${VERSION}" }
     labels = { "org.opencontainers.image.source" = "${SOURCE}" }
   }
   
   target "image-local" {
     inherits = ["image"]
     output = ["type=docker"]
   }
   
   target "image-all" {
     inherits = ["image"]
     platforms = ["linux/amd64", "linux/arm64"]
   }

3. tests.yaml — use GOSS format (default) or Container Structure Test format (requires schemaVersion key). The Taskfile auto-detects which to use.

4. Renovate — the // renovate: datasource=... comment in docker-bake.hcl enables automatic version updates. See Renovate docs for datasource options.

5. Push to main — the Release workflow triggers automatically on changes to apps/**.

---

Local Development

# Install test tools (goss/dgoss)
task init

# Build and test locally
task local-build-<app-name>

# Trigger remote build via GitHub Actions (no release)
task remote-build-<app-name>

# Trigger remote build + publish release
task remote-build-<app-name> RELEASE=true

Prerequisites: docker, gh, jq, yq, container-structure-test (for CST apps)