Hardened container mirror of Forceu/Gokapi. THEKROLL's internal file-transfer image, published publicly as a reference build.
Each night, a GitHub Actions pipeline in this repository:
- Checks
Forceu/Gokapifor a new release tag - If there is one, clones the upstream source, applies our
Dockerfile.override, and rebuilds the image - Builds the image once, scans it with Trivy (SARIF to the Security tab), produces a CycloneDX SBOM
- If no
CRITICALorHIGHvulnerabilities with an available fix are found: pushes toghcr.io/thekroll-ltd/gokapiand opens a digest-pin PR - If findings are present: blocks the push, opens an issue, retains the full audit bundle for 90 days
The result is an image rebuilt on gcr.io/distroless/static:nonroot rather than the upstream Alpine base, with all artifacts a supply-chain audit requires.
ghcr.io/thekroll-ltd/gokapi:<tag> and ghcr.io/thekroll-ltd/gokapi@sha256:<digest>.
Tags track upstream Gokapi releases. Digests are the authoritative pin.
This is THEKROLL's own internal build, made public as a reference. There is no service-level agreement, no support commitment, no compatibility guarantee. Scheduling, retention, and availability may change without notice.
For production-critical use, fork the template and run your own pipeline: THEKROLL-LTD/oss-mirror-build. Five minutes of setup gets you the same controls under your own ownership, with your own SLA.
The build system in this repository — workflow YAML, Dockerfile override, documentation — is licensed under Apache-2.0. See LICENSE.
The container images produced here contain Gokapi, which is licensed under AGPL-3.0. The images inherit AGPL-3.0. Operators who expose the image over a network must comply with AGPL §13 (Remote Network Interaction). See NOTICE.md for details.
- Upstream: github.com/Forceu/Gokapi (AGPL-3.0)
- Template this repo was forked from: THEKROLL-LTD/oss-mirror-build (Apache-2.0)
- Context and rationale: Stop Pulling Random Docker Images — the post that describes this pipeline and why we run it
THEKROLL — DevOps consultancy from Cyprus. For production-critical use, don't depend on this mirror; fork the template and run your own pipeline at THEKROLL-LTD/oss-mirror-build.