Merge pull request #6524 from line-o/docker-security

Author: dizzzz

.github/workflows/ci-container.yml

@@ -37,8 +37,16 @@ jobs:
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4
         with:
           platforms: linux/amd64,linux/arm64
+      - name: Enable containerd image store
+        run: |
+          echo '{ "features": { "containerd-snapshotter": true } }' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+      - name: Verify containerd snapshotter is active
+        run: docker info -f '{{.DriverStatus}}'
       - name: Make buildkit default
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+        with:
+          driver: docker
         id: buildx
       - uses: ./.github/actions/maven-cache
       - uses: ./.github/actions/maven-github-settings
@@ -60,7 +68,8 @@ jobs:
             VERSION="${{ github.ref_name }}"
             REVISION_ARG="-Drevision=${VERSION#eXist-}"
           fi
-          mvn -V -B --no-transfer-progress -q \
+          mvn -V -B --no-transfer-progress \
+            -Ddocker.sbom=true -Ddocker.provenance=true \
             -Pdocker,skip-build-dist-archives \
             -DskipTests -Ddependency-check.skip=true \
             $REVISION_ARG \

exist-docker/pom.xml

@@ -53,6 +53,8 @@
         <docker.tag>latest</docker.tag>
         <docker.debug.tag>debug</docker.debug.tag>
         <docker.platforms>linux/amd64, linux/arm64</docker.platforms>
+        <docker.sbom>false</docker.sbom>
+        <docker.provenance>false</docker.provenance>
     </properties>
 
     <dependencies>
@@ -234,6 +236,10 @@
                                     <platforms>
                                         <platform>${docker.platforms}</platform>
                                     </platforms>
+                                    <attestations>
+                                        <provenance>${docker.provenance}</provenance>
+                                        <sbom>${docker.sbom}</sbom>
+                                    </attestations>
                                 </buildx>
                                 <tags>
                                     <tag>${docker.tag}</tag>
@@ -251,6 +257,10 @@
                                     <platforms>
                                         <platform>${docker.platforms}</platform>
                                     </platforms>
+                                    <attestations>
+                                        <provenance>${docker.provenance}</provenance>
+                                        <sbom>${docker.sbom}</sbom>
+                                    </attestations>
                                 </buildx>
                                 <tags>
                                     <tag>${docker.debug.tag}</tag>