AtlasHorizon PKI-trusted base images

Upstream OS bases with the AtlasHorizon PKI installed in the native system trust store. That is the only change.

Images are built from current CAs fetched at build/CI time from http://pki.atlashorizon.net/certs/. Generated PEMs are not committed.

Images

Image	Upstream
git.atlashorizon.net/atlashorizon/container-base/debian:trixie	debian:trixie
git.atlashorizon.net/atlashorizon/container-base/debian-slim:trixie	debian:trixie-slim
git.atlashorizon.net/atlashorizon/container-base/ubuntu:24.04	ubuntu:24.04
git.atlashorizon.net/atlashorizon/container-base/alpine:3.24	alpine:3.24

On main, each family also gets a :latest tag (debian:latest, debian-slim:latest, ubuntu:latest, alpine:latest).

FROM git.atlashorizon.net/atlashorizon/container-base/debian-slim:trixie
FROM git.atlashorizon.net/atlashorizon/container-base/ubuntu:24.04
FROM git.atlashorizon.net/atlashorizon/container-base/alpine:3.24

Certificates

scripts/refresh-certs.sh downloads and converts (DER → PEM when needed):

• Root: http://pki.atlashorizon.net/certs/AtlasHorizonRootCA.crt (never /root.crt)
• Enterprise: http://pki.atlashorizon.net/certs/AtlasHorizon%20Enterprise%20CA.crt
• Issuing: http://pki.atlashorizon.net/certs/AtlasHorizon%20Issuing%20CA.crt

into certs/AtlasHorizon-*-CA.crt. Those files are gitignored. The Gitea Action runs the script after checkout so every image build embeds the current CAs.

Locally:

sh scripts/refresh-certs.sh
docker buildx bake

Requires curl and openssl.

Gitea Actions and registry

.gitea/workflows/container.yml fetches the CAs, builds all four images with Bake, and publishes to this Gitea instance’s OCI registry.

On main, version tags (v*), and manual Run workflow:

git.atlashorizon.net/atlashorizon/container-base/debian:trixie
git.atlashorizon.net/atlashorizon/container-base/debian:latest    # default branch only
git.atlashorizon.net/atlashorizon/container-base/debian:sha-<short-sha>
git.atlashorizon.net/atlashorizon/container-base/debian:manual   # workflow_dispatch

(and the same tag set for debian-slim, ubuntu, alpine).

The host is taken from the Actions server URL (or vars.REGISTRY if you set one). The image prefix is {registry}/{owner}/{repo} in lowercase, which is what Gitea’s container registry requires.

Pull requests build the images but do not push.

One-time Gitea setup

1. Enable Actions on the repository (Settings → Actions).
2. Enable Packages for the owner (user or org) if it is not already on.
3. Register an act_runner that can build images: Docker socket or privileged dind. A label matching runs-on: ubuntu-latest is enough.
4. If actions/checkout@v4 and the Docker actions cannot be fetched, either set Gitea [actions].DEFAULT_ACTIONS_URL = github or mirror those actions onto this instance and change the uses: lines.

The workflow logs in as the user who triggered the job (github.actor) with secrets.GITEA_TOKEN. Give that token package write if the instance uses restricted token permissions.

If login returns 401, create a PAT with package read/write and add repository secrets:

Secret	Purpose
REGISTRY_TOKEN	PAT used instead of GITEA_TOKEN
REGISTRY_USERNAME	Optional; defaults to the triggering user

Variable	Purpose
REGISTRY	Registry host if it is not the Gitea web hostname

docker login git.atlashorizon.net
docker pull git.atlashorizon.net/atlashorizon/container-base/debian-slim:trixie