hitoma-uptime-kuma

louislam/uptime-kuma rebuilt from its latest 2.x release, so Debian, Go and module CVE fixes land without waiting for an upstream release. It's based on upstream's slim image (louislam/uptime-kuma:2-slim), with these differences:

• No embedded MariaDB. mariadb-server isn't installed. SQLite and external MariaDB work as before.
• No Chromium. Real Browser monitors need a separate browser container; see Real Browser monitors.
• Debian trixie instead of bookworm. Trixie is the current Debian stable release, so it gets security fixes ahead of bookworm, and its python3-paho-mqtt 2.1 is what the Apprise 2.x MQTT plugin requires (bookworm's 1.6 is too old). Everything is installed and full-upgraded fresh on each build (DEBIAN_RELEASE in the Dockerfile).
• Patched npm dependencies. Flagged packages are bumped (NPM_DEPENDENCIES in the Dockerfile) or overridden (NPM_OVERRIDES) before installing. This includes two major bumps, nodemailer 10 and tar 7.
• No npm, npx, corepack or yarn. The server only needs node, and npm's bundled dependencies were a large share of the findings. Run the maintenance scripts with node directly, e.g. docker exec -it <container> node extra/reset-password.js instead of npm run reset-password.
• Rebuilt healthcheck. extra/healthcheck is compiled from upstream's healthcheck.go with the current stable Go. Upstream's prebuilt binary uses Go 1.20.
• Rebuilt cloudflared. It's built from its latest release with the current stable Go and the latest golang.org/x/net, x/sys and x/crypto. Its self-updater is disabled.

Ports, volumes, environment variables and the default root user all match upstream, so this is a drop-in replacement for louislam/uptime-kuma:2, as long as embedded MariaDB and local Real Browser monitors aren't in use.

docker pull forgejo.hitoma.com/root/hitoma-uptime-kuma:2

Real Browser monitors

Chromium is left out because it brings hundreds of short-lived CVEs: Google ships them in batches and Debian's update follows days or weeks later. To use Real Browser monitors, run a browser in its own container (for example browserless) and add it under Settings → Remote Browsers. The browser can then be updated and network-restricted separately from Uptime Kuma.

Tests

Every build has to pass both of these before it's pushed:

• test/verify-image.sh, which needs no network:
  • the app version matches the image's version label, and the native SQLite driver loads
  • the monitor and notification tools are there (ping, setpriv, dumb-init, nscd, apprise with paho-mqtt 2.1 or later, cloudflared and extra/healthcheck)
  • cloudflared's self-updater is off
  • npm, npx, corepack, yarn, Chromium and MariaDB are left out
• test/smoke.sh, on SQLite:
  • the image's healthcheck passes
  • test/smoke/checks.js creates an admin account over the socket.io API, logs in, and adds HTTP, ping and TCP port monitors, which all have to come up
  • the logs show no errors

Both run locally too: test/verify-image.sh IMAGE, then test/smoke.sh IMAGE.

CI

.forgejo/workflows/build.yml builds on every push to main, weekly (Monday 07:47 UTC, without cache, so Debian, Go and module updates are picked up), and on manual dispatch. Dispatch takes optional version and cloudflared_version inputs to build specific tags. Pull requests are built and tested but not pushed. The workflow only resolves the versions below. Building, testing, scanning and pushing happen in the shared hitoma-image-ci pipeline.

• Uptime Kuma version: the newest non-prerelease tag in UPTIME_KUMA_MAJOR (currently 2). A new major is never picked up automatically; bump UPTIME_KUMA_MAJOR in the workflow to move to it.
• cloudflared version: the latest GitHub release.
• Go version: the current stable Go (golang:alpine). It isn't pinned to cloudflared's go.mod minimum because the latest golang.org/x modules only support the two newest Go releases.
• Node version: the Node major from upstream's docker/debian-base.dockerfile.

If a module bump or a dependency change breaks the build, the job fails and latest stays on the last good image.

Tags: latest, the major (2), the upstream release (e.g. 2.5.6), YYYYMMDD, and sha-<short>.

Each build is scanned with Trivy after it passes the tests. Builds of main force-push the badge above and the full JSON report to the single-commit badges branch. The run fails when there are fixable HIGH or CRITICAL findings, and a failed run emails whoever triggered it (the repo owner for scheduled runs). The image is still pushed, but the red run shows that an update is needed. For an npm package, add it to NPM_DEPENDENCIES if Uptime Kuma depends on it directly, otherwise to NPM_OVERRIDES. The build log lists every installed copy of those packages. Most Debian findings have no fix in Debian yet, so they're counted on the badge but don't fail the run.

Setup:

• Repository secrets REGISTRY_USER and REGISTRY_TOKEN (a Forgejo access token with write:package scope).
• A Forgejo runner with the docker label whose job containers can reach a Docker daemon, such as a docker:dind sidecar through DOCKER_HOST.
• Actions enabled on the repository (Settings → Units → Actions).