aneurinandClaude Sonnet 5
264478e0dc
Every real caller (code.aneur.in/cloud/cloud's deploy workflows) runs a mounted-in script against pass-cli, not bare pass-cli args, so an ENTRYPOINT override was needed on every invocation. With no ENTRYPOINT, `docker run this-image sh /script.sh` just replaces CMD directly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
60 lines
2.1 KiB
Markdown
60 lines
2.1 KiB
Markdown
# pass-cli Docker image
|
|
|
|
A prebuilt, glibc-based container image for [Proton Pass
|
|
CLI](https://protonpass.github.io/pass-cli/) (`pass-cli`).
|
|
|
|
## Why this exists
|
|
|
|
`pass-cli`'s official Linux binary is dynamically linked against glibc. It
|
|
does not run under Alpine/musl, even with `gcompat` or `libc6-compat`
|
|
installed — some of the symbols it needs (`fcntl64`, `__res_init`, ...) are
|
|
glibc-specific and aren't shimmed. There's no official musl build and no
|
|
official pass-cli image, so CI jobs that otherwise run in an Alpine-based
|
|
container (like `docker:cli`) can't just `apk add pass-cli` or run the
|
|
binary directly.
|
|
|
|
This image is a small `debian:bookworm-slim` base with a pinned,
|
|
checksum-verified `pass-cli` binary installed, published so that kind of job
|
|
can pull it and run `pass-cli` (or a script that calls it) without needing
|
|
its own glibc environment.
|
|
|
|
## Usage
|
|
|
|
There's no `ENTRYPOINT` -- just `CMD ["pass-cli"]`. Run bare:
|
|
|
|
```sh
|
|
docker run --rm code.aneur.in/cloud/pass-cli:<tag>
|
|
```
|
|
|
|
To run your own script against `pass-cli` instead (login, fetch an item,
|
|
parse the result, etc.), mount it in and pass it as the command -- it
|
|
replaces `CMD` entirely, no `--entrypoint` override needed:
|
|
|
|
```sh
|
|
docker run --rm \
|
|
-e PROTON_PASS_PERSONAL_ACCESS_TOKEN \
|
|
-v "$PWD/my-script.sh:/script.sh:ro" \
|
|
code.aneur.in/cloud/pass-cli:<tag> \
|
|
sh /script.sh
|
|
```
|
|
|
|
For one-off interactive use, prefix `pass-cli` explicitly, since args
|
|
replace `CMD` rather than appending to it:
|
|
|
|
```sh
|
|
docker run --rm code.aneur.in/cloud/pass-cli:<tag> pass-cli --version
|
|
```
|
|
|
|
`PROTON_PASS_KEY_PROVIDER` is set to `fs` in the image by default, since a
|
|
container has no kernel keyring for `pass-cli`'s usual session storage.
|
|
|
|
See [code.aneur.in/cloud/cloud](https://code.aneur.in/cloud/cloud)'s
|
|
`bin/ci/` and `.gitea/workflows/*.yml` for a real caller of this image.
|
|
|
|
## Updating the pinned version
|
|
|
|
`PASS_CLI_VERSION` and `PASS_CLI_SHA256` are build args at the top of the
|
|
`Dockerfile`. Bump both together — get the new version's hash from
|
|
`https://proton.me/download/pass-cli/versions.json`, or download the binary
|
|
and check it yourself with `sha256sum`.
|