mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-12 17:05:01 +03:00
MHSanaei
eb498a3c13
Anthropic's OSS Scanner builds .oss-scanner/Dockerfile from this repository and audits the image offline. The image keeps the source, the Go module and npm caches, the debug panel binary, Xray-core and the sidecars, so tests, the xray gRPC e2e suite, the master+node e2e and a live panel all run with the network disabled. threat_model.md lists the trust boundaries, entry points and the severity rubric the scanner should report against.
60 lines
2.5 KiB
Docker
60 lines
2.5 KiB
Docker
# Build environment for Anthropic's OSS Scanner (https://github.com/anthropics/oss-scanner).
|
|
# The scanner builds this with the repository as the context, then audits the image offline:
|
|
# everything the build, the tests and a reproducer need must be fetched here.
|
|
|
|
FROM node:26-trixie-slim AS node
|
|
|
|
FROM golang:1.27.2-trixie
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
CGO_ENABLED=1 \
|
|
CGO_CFLAGS="-D_LARGEFILE64_SOURCE" \
|
|
GOTOOLCHAIN=local
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential ca-certificates curl git jq procps sqlite3 unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node 26 is required: `make gen` imports .ts files directly and needs its type stripping.
|
|
COPY --from=node /usr/local/bin/node /usr/local/bin/node
|
|
COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
|
|
RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
|
|
&& ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
|
|
&& node --version && npm --version
|
|
|
|
# scanner contract: the checkout lives inside the image, at /src
|
|
COPY . /src
|
|
WORKDIR /src
|
|
|
|
RUN go mod download && go mod verify
|
|
|
|
# The Go binary embeds the Vite build from internal/web/dist, so the frontend goes first.
|
|
# HUSKY=0 skips the git-hook install, which needs a .git directory the build context may lack.
|
|
RUN cd frontend && HUSKY=0 npm ci && npm run build
|
|
|
|
# Debug info and no inlining, so stack traces and debuggers map straight to the source.
|
|
RUN go build -gcflags=all="-N -l" -o /usr/local/bin/x-ui . \
|
|
&& ln -s /usr/local/bin/x-ui /src/x-ui
|
|
|
|
# Xray-core, the mtg-multi MTProto sidecar and the geo databases, exactly as the release image ships them.
|
|
RUN ./DockerInit.sh "$(dpkg --print-architecture)" \
|
|
&& ln -s "/src/build/bin/xray-linux-$(dpkg --print-architecture)" /usr/local/bin/xray \
|
|
&& xray version
|
|
|
|
# Turns on the xray gRPC end-to-end tests (internal/xray, internal/amneziawgnet) against the real core.
|
|
ENV XRAY_E2E_BINARY=/usr/local/bin/xray
|
|
|
|
# Baseline tests: also warms the build cache. A failure is logged, never fatal.
|
|
RUN go test -count=1 -timeout 30m ./... > /src/.oss-scanner-go-test.log 2>&1 \
|
|
|| echo "WARNING: go test reported failures, see /src/.oss-scanner-go-test.log"
|
|
RUN cd frontend && npx vitest run --project unit --project components > /src/.oss-scanner-vitest.log 2>&1 \
|
|
|| echo "WARNING: vitest reported failures, see /src/.oss-scanner-vitest.log"
|
|
|
|
# Reproducers and patches must build with the network gone.
|
|
ENV GOPROXY=off \
|
|
GOSUMDB=off \
|
|
GOFLAGS=-mod=readonly \
|
|
npm_config_offline=true
|
|
|
|
CMD ["bash"]
|