Dockerfile

############################################################
# Dockerfile to build borgbackup server images
# Based on Debian trixie
############################################################
ARG BASE_IMAGE=debian:trixie-slim
FROM ${BASE_IMAGE}

# borgbackup (1.4.x) or borgbackup2 (2.0.x); BORG_BIN must match the package.
ARG BORG_PACKAGE=borgbackup
ARG BORG_SERIES=1.4
ARG BORG_BIN=/usr/bin/borg
# Fingerprint of the resolved apt package set. It only changes when a package
# in the closure changes, so it keys the cache of the layer below: unrelated
# edits reuse it, a security update busts it.
ARG APT_SNAPSHOT=unknown
ARG FINGERPRINT=unknown

LABEL org.opencontainers.image.source="https://github.com/ls1admin/borgserver" \
      org.opencontainers.image.description="BorgBackup server over SSH, Debian trixie, borg ${BORG_SERIES}" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${BORG_SERIES}" \
      de.tum.cit.aet.borgserver.fingerprint="${FINGERPRINT}"

# Volume for SSH-Keys
VOLUME /sshkeys

# Volume for borg repositories
VOLUME /backup

ENV DEBIAN_FRONTEND=noninteractive
ENV BORG_SERIES=${BORG_SERIES}
ENV BORG_BIN=${BORG_BIN}

RUN echo "apt snapshot: ${APT_SNAPSHOT}" && \
		apt-get update && apt-get -y dist-upgrade && \
		apt-get -y --no-install-recommends install ${BORG_PACKAGE} openssh-server && \
		apt-get clean && \
		useradd -s /bin/bash -m -U -p '*' borg && \
		# -p '*' sets an unmatchable hash ("no password") without marking the
		# account locked the way a bare useradd (shadow field '!') would; with
		# UsePAM no in sshd_config, sshd itself enforces the locked-account
		# check, so a locked account would be rejected before publickey auth.
		mkdir /home/borg/.ssh && \
		chmod 700 /home/borg/.ssh && \
		chown borg:borg /home/borg/.ssh && \
		mkdir -p /run/sshd && \
		rm -f /etc/ssh/ssh_host*key* && \
		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*

# Fail the build rather than publish an image whose tag lies about its borg
# major version.
RUN set -eu ; \
		if [ ! -x "${BORG_BIN}" ] ; then \
			echo "ERROR: ${BORG_BIN} is missing or not executable" >&2 ; exit 1 ; \
		fi ; \
		installed="$(${BORG_BIN} -V | awk '{print $2}')" ; \
		series="$(echo "${installed}" | cut -d. -f1,2)" ; \
		if [ "${series}" != "${BORG_SERIES}" ] ; then \
			echo "ERROR: expected borg ${BORG_SERIES}.x, image has ${installed}" >&2 ; exit 1 ; \
		fi ; \
		echo "borg version check ok: ${installed}"

COPY --chmod=0755 ./data/run.sh /run.sh
COPY --chmod=0644 ./data/sshd_config /etc/ssh/sshd_config

# Default SSH-Port for clients
EXPOSE 22

HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
	CMD bash -c 'exec 3<>/dev/tcp/127.0.0.1/22' || exit 1

STOPSIGNAL SIGTERM

ENTRYPOINT ["/run.sh"]