Skip to content

2026-07-05 — Sepia Dockerfile Hygiene

Summary

Completed the Dockerfile hygiene pass for the custom Sepia builds and verified the resulting images.

Context

This work follows the active Sepia Dockerfile hygiene plan. The goal was to bring the custom Dockerfiles closer to reproducible, lower-risk builds before continuing with the broader infrastructure hardening plan.

Changes

Change 1: Caddy base image bump

  • Files: /opt/caddy/Dockerfile
  • What: Updated the build and runtime base images to Caddy 2.11.4 so the custom plugins resolve against a compatible Caddy version.
  • Verification: docker build -t caddy-test ./caddy and docker run --rm caddy-test caddy version

Change 2: Collectd Dockerfile rewrite

  • Files: /opt/collectd/docker/Dockerfile
  • What: Reworked the image to use a cleaner non-root runtime, combined package installation, removed the sudo-based runtime pattern, added a simple healthcheck, and switched the PMT source fetch to a direct clone from the upstream GitLab repo.
  • Verification: docker build -t collectd-test . and docker run --rm collectd-test collectd -h

Change 3: PMT source availability

  • Files: /opt/collectd/docker/PMT
  • What: Fetched the PMT source into the build context so the collectd image can now build from a concrete source tree instead of failing on a missing COPY target.

Decisions

  • Kept the collectd rebuild focused on making the image buildable and safer, rather than attempting a full functional refactor of collectd itself.
  • Switched PMT from a missing local build-context dependency to a direct upstream clone so the Dockerfile is self-contained for the current workspace.

Issues Encountered

  • The original collectd Dockerfile failed because COPY PMT /pmt had no PMT directory in the build context.
  • The Caddy plugin set required a newer Caddy release; bumping the base image resolved the version mismatch.

Next Steps

  • Commit the Dockerfile changes and document them in the Sepia journal.
  • Continue to the remaining active plans in order after phase 1 is fully closed out.

Generated: 2026-07-05