Migrate to s6v3

.github/workflows/external_trigger.yml

@@ -18,7 +18,7 @@ jobs:
           fi
           echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_OPENSSH_SERVER_MASTER\". ****"
           echo "**** Retrieving external version ****"
-          EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
+          EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
             && awk '/^P:'"openssh-server-pam"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://')
           if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
             echo "**** Can't retrieve external version, exiting ****"

Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine:3.15
+FROM ghcr.io/linuxserver/baseimage-alpine:3.16
 
 # set version label
 ARG BUILD_DATE
@@ -10,14 +10,13 @@ LABEL maintainer="aptalca"
 RUN \
   echo "**** install runtime packages ****" && \
   apk add --no-cache --upgrade \
-    curl \
     logrotate \
     nano \
     netcat-openbsd \
     sudo && \
   echo "**** install openssh-server ****" && \
   if [ -z ${OPENSSH_RELEASE+x} ]; then \
-    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp && \
+    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp && \
     awk '/^P:openssh-server-pam$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
   fi && \
   apk add --no-cache \

Dockerfile.aarch64

@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.15
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.16
 
 # set version label
 ARG BUILD_DATE
@@ -10,14 +10,13 @@ LABEL maintainer="aptalca"
 RUN \
   echo "**** install runtime packages ****" && \
   apk add --no-cache --upgrade \
-    curl \
     logrotate \
     nano \
     netcat-openbsd \
     sudo && \
   echo "**** install openssh-server ****" && \
   if [ -z ${OPENSSH_RELEASE+x} ]; then \
-    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/main/aarch64/APKINDEX.tar.gz" | tar -xz -C /tmp && \
+    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/main/aarch64/APKINDEX.tar.gz" | tar -xz -C /tmp && \
     awk '/^P:openssh-server-pam$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
   fi && \
   apk add --no-cache \

Dockerfile.armhf

@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine:arm32v7-3.15
+FROM ghcr.io/linuxserver/baseimage-alpine:arm32v7-3.16
 
 # set version label
 ARG BUILD_DATE
@@ -10,14 +10,13 @@ LABEL maintainer="aptalca"
 RUN \
   echo "**** install runtime packages ****" && \
   apk add --no-cache --upgrade \
-    curl \
     logrotate \
     nano \
     netcat-openbsd \
     sudo && \
   echo "**** install openssh-server ****" && \
   if [ -z ${OPENSSH_RELEASE+x} ]; then \
-    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/main/armhf/APKINDEX.tar.gz" | tar -xz -C /tmp && \
+    OPENSSH_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/main/armhf/APKINDEX.tar.gz" | tar -xz -C /tmp && \
     awk '/^P:openssh-server-pam$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
   fi && \
   apk add --no-cache \

Jenkinsfile

@@ -25,8 +25,8 @@ pipeline {
     DEV_DOCKERHUB_IMAGE = 'lsiodev/openssh-server'
     PR_DOCKERHUB_IMAGE = 'lspipepr/openssh-server'
     DIST_IMAGE = 'alpine'
-    DIST_TAG = '3.15'
-    DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.15/main/'
+    DIST_TAG = '3.16'
+    DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.16/main/'
     DIST_REPO_PACKAGES = 'openssh-server-pam'
     MULTIARCH='true'
     CI='true'

README.md

@@ -283,6 +283,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **11.10.22:** - Rebase to Alpine 3.16, migrate to s6v3.
 * **15.09.22:** - add netcat-openbsd with support for proxies.
 * **18.07.22:** - Fix service perms to comply with upgrade to s6 v3.
 * **16.04.22:** - Rebase to alpine 3.15.

jenkins-vars.yml

@@ -15,8 +15,8 @@ repo_vars:
   - DEV_DOCKERHUB_IMAGE = 'lsiodev/openssh-server'
   - PR_DOCKERHUB_IMAGE = 'lspipepr/openssh-server'
   - DIST_IMAGE = 'alpine'
-  - DIST_TAG = '3.15'
-  - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.15/main/'
+  - DIST_TAG = '3.16'
+  - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.16/main/'
   - DIST_REPO_PACKAGES = 'openssh-server-pam'
   - MULTIARCH='true'
   - CI='true'

readme-vars.yml

@@ -93,6 +93,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "11.10.22:", desc: "Rebase to Alpine 3.16, migrate to s6v3."}
   - { date: "15.09.22:", desc: "add netcat-openbsd with support for proxies."}
   - { date: "18.07.22:", desc: "Fix service perms to comply with upgrade to s6 v3."}
   - { date: "16.04.22:", desc: "Rebase to alpine 3.15."}

root/etc/s6-overlay/s6-rc.d/init-openssh-server-config/run

@@ -1,5 +1,7 @@
 #!/usr/bin/with-contenv bash
 
+# shellcheck shell=bash
+
 # create folders
 mkdir -p \
     /config/{.ssh,ssh_host_keys,logs/openssh}
@@ -9,8 +11,8 @@ echo "User name is set to $USER_NAME"
 
 # set password for abc to unlock it and set sudo access
 sed -i "/${USER_NAME} ALL.*/d" /etc/sudoers
-if [ "$SUDO_ACCESS" == "true" ]; then
-    if [ -n "$USER_PASSWORD" ] || [ -n "$USER_PASSWORD_FILE" ] && [ -f "$USER_PASSWORD_FILE" ]; then
+if [[ "$SUDO_ACCESS" == "true" ]]; then
+    if [[ -n "$USER_PASSWORD" ]] || [[ -n "$USER_PASSWORD_FILE" ]] && [[ -f "$USER_PASSWORD_FILE" ]]; then
         echo "${USER_NAME} ALL=(ALL) ALL" >> /etc/sudoers
         echo "Sudo is enabled with password."
     else
@@ -20,14 +22,17 @@ if [ "$SUDO_ACCESS" == "true" ]; then
 else
     echo "Sudo is disabled."
 fi
-[[ -n "$USER_PASSWORD_FILE" ]] && [[ -f "$USER_PASSWORD_FILE" ]] && \
-    USER_PASSWORD=$(cat "$USER_PASSWORD_FILE") && \
+
+if [[ -n "$USER_PASSWORD_FILE" ]] && [[ -f "$USER_PASSWORD_FILE" ]]; then
+    USER_PASSWORD=$(cat "$USER_PASSWORD_FILE")
     echo "User password is retrieved from file."
+fi
+
 USER_PASSWORD=${USER_PASSWORD:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c"${1:-8}";echo;)}
 echo "${USER_NAME}:${USER_PASSWORD}" | chpasswd
 
 # symlink out ssh config directory
-if [ ! -L /etc/ssh ];then
+if [[ ! -L /etc/ssh ]]; then
     if [ ! -f /config/ssh_host_keys/sshd_config ]; then
         sed -i '/#PidFile/c\PidFile \/config\/sshd.pid' /etc/ssh/sshd_config
         cp -a /etc/ssh/sshd_config /config/ssh_host_keys/
@@ -38,7 +43,7 @@ if [ ! -L /etc/ssh ];then
 fi
 
 # password access
-if [ "$PASSWORD_ACCESS" == "true" ]; then
+if [[ "$PASSWORD_ACCESS" == "true" ]]; then
     sed -i '/^#PasswordAuthentication/c\PasswordAuthentication yes' /etc/ssh/sshd_config
     sed -i '/^PasswordAuthentication/c\PasswordAuthentication yes' /etc/ssh/sshd_config
     chown root:"${USER_NAME}" \
@@ -56,44 +61,53 @@ UMASK=${UMASK:-022}
 sed -i "s|/usr/lib/ssh/sftp-server$|/usr/lib/ssh/sftp-server -u ${UMASK}|g" /etc/ssh/sshd_config
 
 # set key auth in file
-if [ ! -f /config/.ssh/authorized_keys ];then
+if [[ ! -f /config/.ssh/authorized_keys ]]; then
     touch /config/.ssh/authorized_keys
 fi
 
-[[ -n "$PUBLIC_KEY" ]] && \
-    [[ ! $(grep "${PUBLIC_KEY}" /config/.ssh/authorized_keys) ]] && \
-    echo "$PUBLIC_KEY" >> /config/.ssh/authorized_keys && \
-    echo "Public key from env variable added"
+if [[ -n "$PUBLIC_KEY" ]]; then
+    if ! grep -q "${PUBLIC_KEY}" /config/.ssh/authorized_keys; then
+        echo "$PUBLIC_KEY" >> /config/.ssh/authorized_keys
+        echo "Public key from env variable added"
+    fi
+fi
 
-[[ -n "$PUBLIC_KEY_URL" ]] && \
-    PUBLIC_KEY_DOWNLOADED=$(curl -s "$PUBLIC_KEY_URL") && \
-    [[ ! $(grep "$PUBLIC_KEY_DOWNLOADED" /config/.ssh/authorized_keys) ]] && \
-    echo "$PUBLIC_KEY_DOWNLOADED" >> /config/.ssh/authorized_keys && \
-    echo "Public key downloaded from '$PUBLIC_KEY_URL' added"   
+if [[ -n "$PUBLIC_KEY_URL" ]]; then
+    PUBLIC_KEY_DOWNLOADED=$(curl -s "$PUBLIC_KEY_URL")
+    if ! grep -q "$PUBLIC_KEY_DOWNLOADED" /config/.ssh/authorized_keys; then
+        echo "$PUBLIC_KEY_DOWNLOADED" >> /config/.ssh/authorized_keys
+        echo "Public key downloaded from '$PUBLIC_KEY_URL' added"
+    fi
+fi
 
-[[ -n "$PUBLIC_KEY_FILE" ]] && [[ -f "$PUBLIC_KEY_FILE" ]] && \
-    PUBLIC_KEY2=$(cat "$PUBLIC_KEY_FILE") && \
-    [[ ! $(grep "$PUBLIC_KEY2" /config/.ssh/authorized_keys) ]] && \
-    echo "$PUBLIC_KEY2" >> /config/.ssh/authorized_keys && \
-    echo "Public key from file added"
+if [[ -n "$PUBLIC_KEY_FILE" ]] && [[ -f "$PUBLIC_KEY_FILE" ]]; then
+    PUBLIC_KEY2=$(cat "$PUBLIC_KEY_FILE")
+    if ! grep -q "$PUBLIC_KEY2" /config/.ssh/authorized_keys; then
+        echo "$PUBLIC_KEY2" >> /config/.ssh/authorized_keys
+        echo "Public key from file added"
+    fi
+fi
 
-if [ -d "$PUBLIC_KEY_DIR" ];then
-    for F in "${PUBLIC_KEY_DIR}"/*;do
-        PUBLIC_KEYN=$(cat "$F") && \
-        [[ ! $(grep "$PUBLIC_KEYN" /config/.ssh/authorized_keys) ]] && \
-        echo "$PUBLIC_KEYN" >> /config/.ssh/authorized_keys && \
-        echo "Public key from file '$F' added"
+if [[ -d "$PUBLIC_KEY_DIR" ]]; then
+    for F in "${PUBLIC_KEY_DIR}"/*; do
+        PUBLIC_KEYN=$(cat "$F")
+        if ! grep -q "$PUBLIC_KEYN" /config/.ssh/authorized_keys; then
+            echo "$PUBLIC_KEYN" >> /config/.ssh/authorized_keys
+            echo "Public key from file '$F' added"
+        fi
     done
 fi
 
 # back up old log files processed by logrotate
-[[ -f /config/logs/openssh/openssh.log ]] && \
-    mv /config/logs/openssh /config/logs/openssh.old.logs && \
+if [[ -f /config/logs/openssh/openssh.log ]]; then
+    mv /config/logs/openssh /config/logs/openssh.old.logs
     mkdir -p /config/logs/openssh
+fi
 
 # add log file info
-[[ ! -f /config/logs/loginfo.txt ]] && \
+if [[ ! -f /config/logs/loginfo.txt ]]; then
     echo "The current log file is named \"current\". The rotated log files are gzipped, named with a TAI64N timestamp and a \".s\" extension" > /config/logs/loginfo.txt
+fi
 
 # permissions
 chown -R "${USER_NAME}":"${USER_NAME}" \

root/etc/s6-overlay/s6-rc.d/init-openssh-server-config/type

@@ -0,0 +1 @@
+oneshot

root/etc/s6-overlay/s6-rc.d/init-openssh-server-config/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-openssh-server-config/run

root/etc/s6-overlay/s6-rc.d/log-openssh-server/consumer-for

@@ -0,0 +1 @@
+svc-openssh-server

root/etc/s6-overlay/s6-rc.d/log-openssh-server/pipeline-name

@@ -0,0 +1 @@
+pipeline-openssh-server

root/etc/s6-overlay/s6-rc.d/log-openssh-server/run

@@ -3,4 +3,4 @@
 USER_NAME=${USER_NAME:-linuxserver.io}
 
 exec \
-    s6-setuidgid "${USER_NAME}" s6-log n30 s10000000 S30000000 T !"gzip -nq9" /config/logs/openssh
+    s6-setuidgid "${USER_NAME}" s6-log n30 s10000000 S30000000 T !"gzip -nq9" /config/logs/openssh

root/etc/s6-overlay/s6-rc.d/log-openssh-server/type

@@ -0,0 +1 @@
+longrun

root/etc/s6-overlay/s6-rc.d/svc-openssh-server/notification-fd

@@ -0,0 +1 @@
+3

root/etc/s6-overlay/s6-rc.d/svc-openssh-server/producer-for

@@ -0,0 +1 @@
+log-openssh-server

root/etc/s6-overlay/s6-rc.d/svc-openssh-server/run

@@ -0,0 +1,7 @@
+#!/usr/bin/with-contenv bash
+
+USER_NAME=${USER_NAME:-linuxserver.io}
+
+exec 2>&1 \
+    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 2222" \
+        s6-setuidgid "${USER_NAME}" /usr/sbin/sshd.pam -D -e -p 2222

root/etc/s6-overlay/s6-rc.d/svc-openssh-server/type

@@ -0,0 +1 @@
+longrun

root/etc/services.d/openssh-server/run

@@ -1,6 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-USER_NAME=${USER_NAME:-linuxserver.io}
-
-exec 2>&1 \
-    s6-setuidgid "${USER_NAME}" /usr/sbin/sshd.pam -D -e -p 2222