Dockerfile

FROM debian:trixie

# Borg is installed from the upstream signed release binary rather than Debian's
# package (which lags the borg 1.4.x line the backup server runs). The binary is
# GPG-verified against the borg release signing key:
#   Thomas Waldmann <tw@waldmann-edv.de>
#   fingerprint 6D5B EF9A DD20 7580 5747 B70F 9F88 FB52 FAF7 B393
# The glibc-2.31 build is the GPG-signed x86_64 asset and runs on trixie's newer
# glibc (glibc is backward compatible). Keep this on the 1.4.x line — do NOT move
# to borg 2.x, which changes the on-disk repository format and would require
# migrating every repo.
ARG BORG_VERSION=1.4.4
ARG BORG_ASSET=borg-linux-glibc231-x86_64
ARG BORG_GPG_FINGERPRINT=6D5BEF9ADD2075805747B70F9F88FB52FAF7B393

RUN set -eux; \
    apt-get update; \
    apt-get -y install --no-install-recommends \
        openssh-client \
        tini \
        procps \
        ca-certificates \
        gnupg \
        dirmngr \
        wget \
    ; \
    # Fetch and GPG-verify the borg binary; fail the build if no keyserver works.
    borgUrl="https://github.com/borgbackup/borg/releases/download/${BORG_VERSION}"; \
    export GNUPGHOME="$(mktemp -d)"; \
    for ks in hkps://keys.openpgp.org hkps://keyserver.ubuntu.com hkps://pgp.mit.edu; do \
        gpg --batch --keyserver "$ks" --recv-keys "${BORG_GPG_FINGERPRINT}" && break; \
    done; \
    wget -q -O /usr/local/bin/borg "${borgUrl}/${BORG_ASSET}"; \
    wget -q -O /tmp/borg.asc "${borgUrl}/${BORG_ASSET}.asc"; \
    gpg --batch --verify /tmp/borg.asc /usr/local/bin/borg; \
    chmod 0755 /usr/local/bin/borg; \
    borg --version; \
    gpgconf --kill all || true; \
    rm -rf "${GNUPGHOME}" /tmp/borg.asc; \
    # Drop build-only packages so they don't bloat the runtime image.
    apt-get purge -y --auto-remove gnupg dirmngr wget; \
    apt-get clean; \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*; \
    echo "    ServerAliveInterval 10" >> /etc/ssh/ssh_config \
    && echo "    ServerAliveCountMax 30" >> /etc/ssh/ssh_config \
    && echo "    UserKnownHostsFile /dev/null" >> /etc/ssh/ssh_config \
    && echo "    StrictHostKeyChecking no" >> /etc/ssh/ssh_config

# tini as PID 1: forwards SIGTERM to the container's process group and reaps
# orphaned `docker exec` children. Replaces openrc-init, which ignored SIGTERM
# and cost a full stop-timeout (15s) on every teardown.
#
# The agent only ever `docker exec`s into this container and never overrides Cmd
# or Entrypoint, so the ENTRYPOINT is transparent to it. `docker run <image> borg
# ...` by hand also still works — tini runs the given command as its child.
#
# Do NOT drop tini and leave `sleep infinity` as PID 1: a bare command as PID 1
# installs no SIGTERM handler, so the container goes back to waiting out the full
# stop timeout and leaks a zombie for every orphaned exec child.
ENTRYPOINT ["/usr/bin/tini", "-g", "--"]
CMD ["sleep", "infinity"]