Add proton-bridge image (multi-arch, k8s-friendly)

Build Proton Bridge from source for amd64/arm64 and ship a simple entrypoint that starts DBus+gnome-keyring, forwards IMAP/SMTP via socat, and execs bridge so container lifecycle matches the main process.

Author: mgarratt

images/README.md

@@ -5,3 +5,6 @@ Each subdirectory in `images/` is one Docker image.
 - Create a new image by copying `images/_template/` to `images/<image>/` and editing.
 - CI only builds directories that contain both `Dockerfile` and `image.toml`.
 
+## Available
+
+- `proton-bridge`: Proton Bridge built from source (multi-arch) with a k8s-friendly entrypoint.

images/proton-bridge/.dockerignore

@@ -0,0 +1,7 @@
+.git
+.github
+node_modules
+npm-debug.log
+dist
+build
+.DS_Store

images/proton-bridge/Dockerfile

@@ -0,0 +1,76 @@
+# syntax=docker/dockerfile:1
+
+ARG BRIDGE_VERSION=v3.21.2
+
+FROM golang:1.24.2-bookworm AS build
+ARG BRIDGE_VERSION
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    gcc \
+    git \
+    libsecret-1-dev \
+    libc6-dev \
+    pkg-config \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+
+# Upstream generates `internal/bridge/credits.go` during their release build, but
+# the tagged source doesn't ship it. The CLI references it, so create a minimal
+# stub if missing.
+RUN git clone --depth 1 --branch "${BRIDGE_VERSION}" https://github.com/ProtonMail/proton-bridge.git . \
+  && if [ ! -f internal/bridge/credits.go ]; then \
+    printf '%s\n' \
+      '// Code generated during container build. DO NOT EDIT.' \
+      '' \
+      'package bridge' \
+      '' \
+      'const Credits = ""' \
+      > internal/bridge/credits.go; \
+  fi
+
+# Build the headless bridge binary (no GUI).
+# Upstream uses `./cmd/Desktop-Bridge/` for v3.x; keep fallbacks for older layouts.
+RUN if [ -d ./cmd/Desktop-Bridge ]; then pkg=./cmd/Desktop-Bridge; \
+  elif [ -d ./cmd/bridge ]; then pkg=./cmd/bridge; \
+  elif [ -d ./cmd/protonmail-bridge ]; then pkg=./cmd/protonmail-bridge; \
+  else echo "unknown bridge cmd package; expected ./cmd/Desktop-Bridge or ./cmd/bridge or ./cmd/protonmail-bridge" >&2; exit 1; \
+  fi \
+  && go build -trimpath -ldflags "-s -w" -o /out/bridge "$pkg"
+
+
+FROM debian:bookworm-slim
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    dbus \
+    gnome-keyring \
+    libsecret-1-0 \
+    socat \
+    tini \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -d /home/bridge -s /usr/sbin/nologin -u 1000 bridge \
+  && mkdir -p /data \
+  && chown -R bridge:bridge /data
+
+COPY --from=build /out/bridge /usr/local/bin/bridge
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod 0755 /usr/local/bin/bridge /usr/local/bin/entrypoint.sh
+
+USER bridge:bridge
+
+ENV XDG_CONFIG_HOME=/data/config \
+  XDG_DATA_HOME=/data/data \
+  XDG_CACHE_HOME=/data/cache
+
+# Defaults are unprivileged ports.
+EXPOSE 1025 1143
+
+ENTRYPOINT ["tini", "-g", "--", "/usr/local/bin/entrypoint.sh"]
+CMD ["run"]

images/proton-bridge/README.md

@@ -0,0 +1,41 @@
+# proton-bridge
+
+Builds Proton Bridge from source for multi-arch (`linux/amd64`, `linux/arm64`) and runs it headlessly for IMAP/SMTP.
+
+## Runtime Notes
+
+- State lives under `/data` (mount a persistent volume there).
+- By default this image avoids privileged ports. It listens on:
+  - SMTP: `1025` (forwarded to bridge on `127.0.0.1:1026`)
+  - IMAP: `1143` (forwarded to bridge on `127.0.0.1:1144`)
+- If you want to expose standard ports (`25`/`143`), set `CONTAINER_SMTP_PORT=25` and `CONTAINER_IMAP_PORT=143`
+  and grant `NET_BIND_SERVICE` (or run as root, not recommended).
+
+## One-Time Login / Init
+
+You need to initialize credentials once with a writable `/data` volume mounted:
+
+```bash
+docker run --rm -it \
+  -v proton-bridge-data:/data \
+  ghcr.io/<owner>/<repo>/proton-bridge:latest init
+```
+
+In Kubernetes, prefer a one-off init pod/job (because `kubectl exec` won’t inherit the
+entrypoint-provisioned DBus/keyring environment):
+
+- Run a temporary pod with `args: ["init"]` and the same PVC mounted at `/data`.
+- Complete login (supports 2FA interactively), then delete the pod.
+
+After that, start normally (default command is `run`).
+
+## Configuration
+
+Environment variables:
+
+- `CONTAINER_SMTP_PORT` (default `1025`)
+- `CONTAINER_IMAP_PORT` (default `1143`)
+- `PROTON_BRIDGE_SMTP_PORT` (default `1026`)
+- `PROTON_BRIDGE_IMAP_PORT` (default `1144`)
+- `SOCAT_OPTS` (extra args appended to each `socat` invocation, optional)
+- `KEYRING_PASSWORD` (optional; used to best-effort unlock gnome-keyring on startup)

images/proton-bridge/entrypoint.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+set -eu
+
+cmd="${1:-run}"
+
+export HOME="${HOME:-/home/bridge}"
+
+# Persist everything under /data by default (works well with k8s PVCs).
+export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-/data/config}"
+export XDG_DATA_HOME="${XDG_DATA_HOME:-/data/data}"
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-/data/cache}"
+
+mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
+
+uid="$(id -u)"
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/runtime-$uid}"
+mkdir -p "$XDG_RUNTIME_DIR"
+chmod 700 "$XDG_RUNTIME_DIR"
+
+DBUS_SOCKET="${DBUS_SOCKET:-$XDG_RUNTIME_DIR/dbus-session.sock}"
+export DBUS_SESSION_BUS_ADDRESS="unix:path=$DBUS_SOCKET"
+
+start_dbus_and_keyring() {
+  # Start a private session bus and gnome-keyring (Secret Service) so the bridge
+  # can store/retrieve credentials.
+  rm -f "$DBUS_SOCKET"
+  dbus-daemon --session --address="unix:path=$DBUS_SOCKET" --nofork --nopidfile &
+
+  # gnome-keyring-daemon prints shell exports. Keep output quiet.
+  # shellcheck disable=SC2046
+  eval "$(gnome-keyring-daemon --start --components=secrets 2>/dev/null)"
+
+  # Best-effort unlock. If the keyring is configured with an empty password this
+  # will succeed; otherwise Bridge may prompt/require manual unlock.
+  printf '%s' "${KEYRING_PASSWORD:-}" | gnome-keyring-daemon --unlock >/dev/null 2>&1 || true
+}
+
+start_socat_forwarders() {
+  container_smtp="${CONTAINER_SMTP_PORT:-1025}"
+  container_imap="${CONTAINER_IMAP_PORT:-1143}"
+  bridge_smtp="${PROTON_BRIDGE_SMTP_PORT:-1026}"
+  bridge_imap="${PROTON_BRIDGE_IMAP_PORT:-1144}"
+  socat_opts="${SOCAT_OPTS:-}"
+
+  socat "TCP-LISTEN:${container_smtp},fork,reuseaddr${socat_opts:+,${socat_opts}}" \
+    "TCP:127.0.0.1:${bridge_smtp}" &
+  socat "TCP-LISTEN:${container_imap},fork,reuseaddr${socat_opts:+,${socat_opts}}" \
+    "TCP:127.0.0.1:${bridge_imap}" &
+}
+
+bridge_cli_args() {
+  # Proton Bridge has used both "--cli" and "-c" for interactive CLI mode across versions.
+  if bridge --help 2>&1 | grep -q -- "--cli"; then
+    printf '%s\n' "--cli"
+    return 0
+  fi
+  printf '%s\n' "-c"
+}
+
+start_dbus_and_keyring
+
+case "$cmd" in
+  init)
+    shift || true
+    exec bridge "$(bridge_cli_args)" "$@"
+    ;;
+  run)
+    shift || true
+    start_socat_forwarders
+    add_noninteractive=1
+    for a in "$@"; do
+      case "$a" in
+        --noninteractive|-n|--cli|-c)
+          add_noninteractive=0
+          ;;
+      esac
+    done
+    if [ "$add_noninteractive" -eq 1 ]; then
+      set -- --noninteractive "$@"
+    fi
+    exec bridge "$@"
+    ;;
+  *)
+    # Allow running arbitrary commands (debug, etc).
+    exec "$@"
+    ;;
+esac

images/proton-bridge/image.toml

@@ -0,0 +1,4 @@
+image = "proton-bridge"
+version = "3.21.2"
+platforms = ["linux/amd64", "linux/arm64"]
+