run image without root, optimize image size, fix comparison bug & gen…

…eral cleanup #minor

.github/workflows/bump.yml

@@ -1,19 +1,21 @@
 name: Bump version
+
 on:
   push:
     branches:
       - main
+
 jobs:
-  build:
+  bump:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: '0'
 
     - name: Bump version and push tag
       uses: anothrNick/github-tag-action@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.MY_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.MY_TOKEN }} # not GITHUB_TOKEN because it does not trigger (other) github actions
         WITH_V: true
         DEFAULT_BUMP: patch

.github/workflows/main.yml

@@ -6,16 +6,18 @@ on:
       - 'v*'
 
 jobs:
-  docker:
+  build:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - 
         name: Generate Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ghcr.io/${{ github.repository }}
@@ -29,20 +31,20 @@ jobs:
             latest=true
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Login to GitHub Package Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

Dockerfile

@@ -1,11 +1,16 @@
-FROM python:alpine
-
-WORKDIR /usr/src/app
+FROM python:alpine AS build-image
 
-RUN apk add --no-cache --update curl-dev libressl-dev musl-dev gcc
+RUN apk add --no-cache --update curl-dev musl-dev gcc
 COPY requirements.txt ./
+
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 RUN pip install --no-cache-dir -r requirements.txt
 
+FROM python:alpine
+RUN apk add --no-cache --update curl
+ENV PATH="/opt/venv/bin:$PATH"
+COPY --from=build-image /opt/venv /opt/venv
 COPY auto-dns.py ./
 
 ENV TIMEOUT 5
@@ -14,4 +19,5 @@ ENV REGEX_DOMAIN "k8s-[0-9]+\.oscarr\.nl"
 ENV KUBERNETES_DOMAIN "kubernetes.oscarr.nl"
 ENV TEST_DOMAIN "ninoo.nl"
 
-CMD [ "python", "./auto-dns.py" ]
+USER nobody
+CMD [ "python", "auto-dns.py" ]

LICENSE.md

@@ -1,6 +1,6 @@
-MIT License
+# MIT License
 
-Copyright (c) [2022] [Bierteam]
+Copyright (c) [2023] [Bierteam]
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,4 +1,4 @@
-# Readme
+# README
 
 This container will monitor the available nodes in our kubernetes cluster and will update the dns records accordingly.
 This only supports the cloudflare API
@@ -8,6 +8,7 @@ Then it tries to connect to each of the found records and checks if there is a v
 If there is a succesful connection the ip of the node will be added to the pool (KUBERNETES_DOMAIN) (ipv4 and ipv6)
 
 Env variables:
+
 ```bash
 TIMEOUT=5
 MAIN_DOMAIN="oscarr.nl"
@@ -16,4 +17,5 @@ KUBERNETES_DOMAIN="kubernetes.oscarr.nl"
 TEST_DOMAIN="ninoo.nl"
 CLOUDFLARE_API_TOKEN="SECRET"
 ```
+
 https://dash.cloudflare.com/profile/api-tokens

auto-dns.py

@@ -32,7 +32,7 @@
 kubernetesPool = {}
 # find all regexDomain records
 for record in records:
-    if record['type'] == "A" or "AAAA":
+    if record['type'] == "A" or record['type'] == "AAAA":
         if re.search(regexDomain, record['name']):
             nodes.append({"name": record['name'], "type": record['type'], "ip": record['content']})
         if record['name'] == kubernetesDomain: