Hugo v0.111.0 (and Alpine v3.17)

The failure occurs when a git operation triggers recently added safe directory checks to alert the user when there is a UID or GID mismatch.  Because the ENTRYPOINT of the hugo-extended container is a call to `hugo`, there is no ability for the end user of the container to tell git to trust the /src directory before hugo is started.

It is possible to override the UID and GID when using the container, but this causes permission errors and does not seem like a user-friendly path forward.

After this change, the hugo-extended container will contain a global git configuration to trust the /src directory.  This may have security implications that have not been considered, but since only the project directory is mounted to /src, this approach seems to respect the intent of git safe directory checks.

.github/workflows/build.yml

@@ -6,13 +6,15 @@ on:
       - master
     tags:
       - 'v*'
+  workflow_dispatch:
 
 jobs:
   docker:
     runs-on: ubuntu-latest
+    if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Prepare tags
         id: tag
@@ -32,16 +34,16 @@ jobs:
           echo ::set-output name=tags::${TAGS}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@master
+        uses: docker/setup-qemu-action@v2
         with:
-          platforms: all
+          platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@master
+        uses: docker/setup-buildx-action@v2
 
       - name: Cache Docker layers
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -50,14 +52,14 @@ jobs:
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: jakejarvis
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -65,7 +67,7 @@ jobs:
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: ./

Dockerfile

@@ -1,12 +1,15 @@
 # the following version can be overridden at image build time with --build-arg
-ARG HUGO_VERSION=0.82.0
+ARG HUGO_VERSION=0.111.0
 # remove/comment the following line completely to compile vanilla Hugo:
 ARG HUGO_BUILD_TAGS=extended
 
+# Hugo >= v0.81.0 requires Go 1.16+ to build
+ARG GO_VERSION=1.19
+ARG ALPINE_VERSION=3.17
+
 # ---
 
-# Hugo >= v0.81.0 requires Go 1.16+ to build
-FROM golang:1.16-alpine3.13 AS build
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS build
 
 # renew global args from above
 # https://docs.docker.com/engine/reference/builder/#scope
@@ -21,13 +24,11 @@ ENV GO111MODULE=on
 WORKDIR /go/src/github.com/gohugoio/hugo
 
 # gcc/g++ are required to build SASS libraries for extended version
-RUN apk update && \
-    apk add --no-cache \
+RUN apk add --update --no-cache \
       gcc \
       g++ \
       musl-dev \
-      git && \
-    go get github.com/magefile/mage
+      git
 
 # clone source from Git repo:
 RUN git clone \
@@ -36,24 +37,25 @@ RUN git clone \
       --depth 1 \
       https://github.com/gohugoio/hugo.git ./
 
-# download source from GitHub release (old method):
-# RUN wget https://github.com/gohugoio/hugo/archive/v${HUGO_VERSION}.tar.gz && \
-#     tar xf v${HUGO_VERSION}.tar.gz --strip-components=1 && \
-#     rm v${HUGO_VERSION}.tar.gz
-
-RUN mage -v hugo && mage install
+# https://github.com/gohugoio/hugo/commit/241481931f5f5f2803cd4be519936b26d8648dfd
+RUN go build -v -ldflags "-X github.com/gohugoio/hugo/common/hugo.vendorInfo=docker" -tags "$HUGO_BUILD_TAGS" && \
+    mv ./hugo /go/bin/hugo
 
 # fix potential stack size problems on Alpine
 # https://github.com/microsoft/vscode-dev-containers/blob/fb63f7e016877e13535d4116b458d8f28012e87f/containers/hugo/.devcontainer/Dockerfile#L19
-RUN go get github.com/yaegashi/muslstack && \
+RUN go install github.com/yaegashi/muslstack@latest && \
     muslstack -s 0x800000 /go/bin/hugo
 
 # ---
 
-FROM alpine:3.13
+FROM alpine:${ALPINE_VERSION}
 
-# renew global args from above
+# renew global args from above & pin any dependency versions
 ARG HUGO_VERSION
+# https://github.com/jgm/pandoc/releases
+ARG PANDOC_VERSION=2.19.2
+# https://github.com/sass/dart-sass-embedded/releases
+ARG DART_SASS_VERSION=1.58.3
 
 LABEL version="${HUGO_VERSION}"
 LABEL repository="https://github.com/jakejarvis/hugo-docker"
@@ -64,17 +66,26 @@ LABEL maintainer="Jake Jarvis <jake@jarv.is>"
 LABEL org.opencontainers.image.source="https://github.com/jakejarvis/hugo-docker"
 
 # bring over patched binary from build stage
-COPY --from=build /go/bin/hugo /usr/local/bin/hugo
+COPY --from=build /go/bin/hugo /usr/bin/hugo
 
-# libc6-compat & libstdc++ are required for extended SASS libraries
-# ca-certificates are required to fetch outside resources (like Twitter oEmbeds)
-RUN apk update && \
-    apk add --no-cache \
+# this step is intentionally a bit of a mess to minimize the number of layers in the final image
+RUN set -euo pipefail && \
+    if [ "$(uname -m)" = "x86_64" ]; then \
+      ARCH="amd64"; \
+    elif [ "$(uname -m)" = "aarch64" ]; then \
+      ARCH="arm64"; \
+    else \
+      echo "Unknown build architecture, quitting." && exit 2; \
+    fi && \
+    # alpine packages
+    # libc6-compat & libstdc++ are required for extended SASS libraries
+    # ca-certificates are required to fetch outside resources (like Twitter oEmbeds)
+    apk add --update --no-cache \
       ca-certificates \
+      tzdata \
       git \
       nodejs \
       npm \
-      yarn \
       go \
       python3 \
       py3-pip \
@@ -82,24 +93,50 @@ RUN apk update && \
       libc6-compat \
       libstdc++ && \
     update-ca-certificates && \
+    # npm packages
     npm install --global --production \
+      yarn \
       postcss \
       postcss-cli \
       autoprefixer \
       @babel/core \
       @babel/cli && \
+    npm cache clean --force && \
+    # ruby gems
     gem install asciidoctor && \
-    pip3 install --upgrade Pygments==2.*
-
-# verify everything's OK, exit otherwise
-RUN hugo env && \
+    # python packages
+    python3 -m pip install --no-cache-dir --upgrade Pygments==2.* docutils && \
+    # manually fetch pandoc binary
+    wget -O pandoc.tar.gz https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-linux-${ARCH}.tar.gz && \
+    tar xf pandoc.tar.gz && \
+    mv ./pandoc-${PANDOC_VERSION}/bin/pandoc /usr/bin/ && \
+    chmod +x /usr/bin/pandoc && \
+    rm -rf pandoc.tar.gz pandoc-${PANDOC_VERSION} && \
+    # manually fetch Dart SASS binary (on x64 only)
+    if [ "$ARCH" = "amd64" ]; then \
+      wget -O sass-embedded.tar.gz https://github.com/sass/dart-sass-embedded/releases/download/${DART_SASS_VERSION}/sass_embedded-${DART_SASS_VERSION}-linux-x64.tar.gz && \
+      tar xf sass-embedded.tar.gz && \
+      mv ./sass_embedded/dart-sass-embedded /usr/bin/ && \
+      chmod +x /usr/bin/dart-sass-embedded && \
+      rm -rf sass-embedded.tar.gz sass_embedded; \
+    fi && \
+    # clean up some junk
+    rm -rf /tmp/* /var/tmp/* /var/cache/apk/* && \
+    # tell git to trust /src
+    git config --global --add safe.directory /src && \
+    # make super duper sure that everything went OK, exit otherwise
+    hugo env && \
     go version && \
     node --version && \
+    npm --version && \
+    yarn --version && \
     postcss --version && \
     autoprefixer --version && \
     babel --version && \
     pygmentize -V && \
-    asciidoctor --version
+    asciidoctor --version && \
+    pandoc --version && \
+    rst2html.py --version
 
 # add site source as volume
 VOLUME /src

README.md

@@ -1,8 +1,8 @@
-# ✏️ [Hugo Extended](https://github.com/gohugoio/hugo) via Docker 
+# ✏️ [Hugo Extended](https://github.com/gohugoio/hugo) via Docker
 
 [![Build](https://github.com/jakejarvis/hugo-docker/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/jakejarvis/hugo-docker/actions/workflows/build.yml)
 
-A base image to ease local development of Hugo sites, including [Hugo Extended](https://gohugo.io/troubleshooting/faq/#i-get-tocss-this-feature-is-not-available-in-your-current-hugo-version) (with SASS/SCSS support) and optional third-party tools ([listed below](#third-party-software)). Now includes native support for both AMD64 and ARM64 platforms!
+A base image to ease local development of Hugo sites, including [Hugo Extended](https://gohugo.io/troubleshooting/faq/#i-get-tocss-this-feature-is-not-available-in-your-current-hugo-version) (with SASS/SCSS support) and optional third-party tools ([listed below](#third-party-software)). Now with [multi-architecture images](https://docs.docker.com/docker-for-mac/multi-arch/) for native AMD64 and ARM64 support!
 
 ## Usage
 
@@ -42,8 +42,11 @@ Just in case, the final Alpine Linux container includes a few small third-party
 - [Babel](https://babeljs.io/)
 - [Pygments](https://pygments.org/)
 - [Asciidoctor](https://asciidoctor.org/)
+- [Pandoc](https://pandoc.org/)
+- [Docutils](https://docutils.sourceforge.io/) / [RST](https://docutils.sourceforge.io/rst.html)
+- [Embedded Dart Sass](https://github.com/sass/dart-sass-embedded) (amd64 only)
 
-Node (with NPM and Yarn) and Go (for [Hugo Modules](https://gohugo.io/hugo-modules/) support) are also pre-installed.
+Node (with NPM and Yarn), Go (for [Hugo Modules](https://gohugo.io/hugo-modules/) support), and Python are also pre-installed.
 
 ## Licenses