Add proton-bridge image (multi-arch, k8s-friendly)

Build Proton Bridge from source for amd64/arm64 and ship a simple entrypoint that starts DBus+gnome-keyring, forwards IMAP/SMTP via socat, and execs bridge so container lifecycle matches the main process.

Author: mgarratt

.github/workflows/pr.yml

@@ -72,6 +72,7 @@ jobs:
           context: ${{ matrix.dir }}
           file: ${{ matrix.dir }}/Dockerfile
           platforms: ${{ join(matrix.platforms, ',') }}
+          build-args: ${{ join(matrix.build_args, '\n') }}
           push: false
           tags: local/${{ matrix.image_name }}:pr-${{ github.sha }}
           cache-from: type=gha

.github/workflows/publish.yml

@@ -99,6 +99,7 @@ jobs:
           context: ${{ matrix.dir }}
           file: ${{ matrix.dir }}/Dockerfile
           platforms: ${{ join(matrix.platforms, ',') }}
+          build-args: ${{ join(matrix.build_args, '\n') }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: |

AGENTS.md

@@ -24,13 +24,15 @@ Optional keys:
 
 - `version` (string): if set, CI publishes this tag as well (example: `"1.2.3"` or `"v1.2.3"`).
 - `platforms` (array of strings): defaults to `["linux/amd64", "linux/arm64"]`.
+- `build_args` (table of string keys/values): passed to `docker build` as `--build-arg KEY=VALUE`.
 
 Example:
 
 ```toml
 image = "kube-tools"
 version = "1.30.4"
 platforms = ["linux/amd64", "linux/arm64"]
+build_args = { TOOL_VERSION = "v1.30.4" }
 ```
 
 ## Publishing Rules

README.md

@@ -26,7 +26,7 @@ See `AGENTS.md` for the full standards.
 Build the image for your host architecture and load it into your local Docker daemon:
 
 ```bash
-./scripts/build-one.sh <image>
+./scripts/build-one.py <image>
 ```
 
 ## Adding An Image

images/README.md

@@ -5,3 +5,6 @@ Each subdirectory in `images/` is one Docker image.
 - Create a new image by copying `images/_template/` to `images/<image>/` and editing.
 - CI only builds directories that contain both `Dockerfile` and `image.toml`.
 
+## Available
+
+- `proton-bridge`: Proton Bridge built from source (multi-arch) with a k8s-friendly entrypoint.

images/_template/image.toml

@@ -1,4 +1,4 @@
 image = "example"
 # version = "1.2.3"
 platforms = ["linux/amd64", "linux/arm64"]
-
+# build_args = { EXAMPLE_ARG = "value" }

images/proton-bridge/.dockerignore

@@ -0,0 +1,7 @@
+.git
+.github
+node_modules
+npm-debug.log
+dist
+build
+.DS_Store

images/proton-bridge/Dockerfile

@@ -0,0 +1,98 @@
+# syntax=docker/dockerfile:1.7
+
+FROM --platform=$TARGETPLATFORM golang:alpine3.21@sha256:b4dbd292a0852331c89dfd64e84d16811f3e3aae4c73c13d026c4d200715aff6 AS build
+
+ARG ENV_PROTONMAIL_BRIDGE_VERSION
+ARG TARGETPLATFORM
+
+# Install dependencies
+RUN set -eux; \
+    apk add --no-cache \
+      bash=5.2.37-r0 \
+      g++=14.2.0-r4 \
+      git=2.47.3-r0 \
+      grep=3.11-r0 \
+      libsecret-dev=0.21.7-r0 \
+      make=4.4.1-r2 \
+      sed=4.9-r2
+
+WORKDIR /build/
+RUN set -eux; \
+    : "${ENV_PROTONMAIL_BRIDGE_VERSION:?build arg ENV_PROTONMAIL_BRIDGE_VERSION is required}"; \
+    git clone --depth 1 --single-branch --branch "$ENV_PROTONMAIL_BRIDGE_VERSION" https://github.com/ProtonMail/proton-bridge.git; \
+    printf '%s\n' "$ENV_PROTONMAIL_BRIDGE_VERSION" > /build/BRIDGE_VERSION
+WORKDIR /build/proton-bridge/
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    set -eux; \
+    make build-nogui vault-editor
+
+# Working stage image
+FROM --platform=$TARGETPLATFORM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
+
+# Define arguments and env variables
+ARG TARGETPLATFORM
+# Indicate (NOT define) the ports/network interface really used by Proton bridge mail.
+# It should be 1025/tcp and 1143/tcp but on some k3s instances it could be 1026 and 1144 (why ?)
+# Launch `netstat -ltnp` on a running container to be sure.
+ARG ENV_BRIDGE_SMTP_PORT=1025
+ARG ENV_BRIDGE_IMAP_PORT=1143
+ARG ENV_BRIDGE_HOST=127.0.0.1
+# Change ENV_CONTAINER_SMTP_PORT only if you have a docker port conflict on host network namespace.
+ARG ENV_CONTAINER_SMTP_PORT=1026
+ARG ENV_CONTAINER_IMAP_PORT=1144
+ENV PROTON_BRIDGE_SMTP_PORT=$ENV_BRIDGE_SMTP_PORT \
+    PROTON_BRIDGE_IMAP_PORT=$ENV_BRIDGE_IMAP_PORT \
+    PROTON_BRIDGE_HOST=$ENV_BRIDGE_HOST \
+    CONTAINER_SMTP_PORT=$ENV_CONTAINER_SMTP_PORT \
+    CONTAINER_IMAP_PORT=$ENV_CONTAINER_IMAP_PORT \
+    ENV_TARGET_PLATFORM=$TARGETPLATFORM
+LABEL org.opencontainers.image.source="https://github.com/ProtonMail/proton-bridge" \
+      org.opencontainers.image.version="$ENV_PROTONMAIL_BRIDGE_VERSION" \
+      org.opencontainers.image.title="proton-bridge" \
+      org.opencontainers.image.description="Headless Proton Mail Bridge with CLI tooling"
+
+# Install dependencies
+RUN set -eux; \
+    apk add --no-cache \
+      bash=5.2.37-r0 \
+      ca-certificates=20250911-r0 \
+      gpg=2.4.9-r0 \
+      gpg-agent=2.4.9-r0 \
+      gnupg-keyboxd=2.4.9-r0 \
+      libsecret=0.21.7-r0 \
+      net-tools=2.10-r3 \
+      pass=1.7.4-r3 \
+      socat=1.8.0.3-r0
+
+RUN set -eux; \
+    addgroup -S bridge; \
+    adduser -S -G bridge -h /home/bridge bridge; \
+    mkdir -p /home/bridge /app; \
+    chown -R bridge:bridge /home/bridge /app
+
+# RUN rc-update add dbus
+# RUN touch /run/openrc/softlevel
+# RUN rc-service dbus start
+
+# Copy executables made during previous stage
+WORKDIR /usr/bin/
+COPY --from=build /build/proton-bridge/bridge /build/proton-bridge/proton-bridge /build/proton-bridge/vault-editor /usr/bin/
+
+# Install needed scripts and files
+WORKDIR /app/
+COPY --chmod=0755 entrypoint.sh /app/entrypoint.sh
+COPY GPGparams.txt /app/GPGparams.txt
+COPY --from=build /build/BRIDGE_VERSION /app/VERSION
+
+# SMTP and IMAP ports are not exposed by default, so you could adjust them if necessary with ENV
+# variables CONTAINER_SMTP_PORT and CONTAINER_IMAP_PORT.
+# See README.md and/or compose.yaml file.
+# EXPOSE ${ENV_CONTAINER_SMTP_PORT}/tcp
+# EXPOSE ${ENV_CONTAINER_IMAP_PORT}/tcp
+
+# Volume to save pass and bridge configurations/data
+VOLUME /home/bridge
+
+USER bridge:bridge
+ENTRYPOINT ["/app/entrypoint.sh"]

images/proton-bridge/GPGparams.txt

@@ -0,0 +1,8 @@
+%no-protection
+%echo Generating a basic OpenPGP key
+Key-Type: RSA
+Key-Length: 2048
+Name-Real: ProtonMailBridge
+Expire-Date: 0
+%commit
+%echo done

images/proton-bridge/entrypoint.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -ex
+
+# Check if the gpg key exist, if not created it. Should be run only on first launch.
+if [ ! -d "${HOME}/.password-store/" ]; then
+  gpg --generate-key --batch /app/GPGparams.txt
+  gpg --list-keys
+  pass init ProtonMailBridge
+  sleep 1
+fi
+
+# Check if some env variables exist.
+if ! [[ -v PROTON_BRIDGE_SMTP_PORT ]]; then
+  echo "WARNING! Environment variable PROTON_BRIDGE_SMTP_PORT is not defined!"
+fi
+if ! [[ -v PROTON_BRIDGE_IMAP_PORT ]]; then
+  echo "WARNING! Environment variable PROTON_BRIDGE_IMAP_PORT is not defined!"
+fi
+if ! [[ -v PROTON_BRIDGE_HOST ]]; then
+  echo "WARNING! Environment variable PROTON_BRIDGE_HOST is not defined!"
+fi
+if ! [[ -v CONTAINER_SMTP_PORT ]]; then
+  echo "WARNING! Environment variable CONTAINER_SMTP_PORT is not defined!"
+fi
+if ! [[ -v CONTAINER_IMAP_PORT ]]; then
+  echo "WARNING! Environment variable CONTAINER_IMAP_PORT is not defined!"
+fi
+
+echo "Build for ${ENV_TARGET_PLATFORM} platform."
+
+# Proton mail bridge listen only on 127.0.0.1 interface, we need to forward TCP traffic on SMTP and IMAP ports:
+socat TCP-LISTEN:"$CONTAINER_SMTP_PORT",fork TCP:"$PROTON_BRIDGE_HOST":"$PROTON_BRIDGE_SMTP_PORT" &
+socat TCP-LISTEN:"$CONTAINER_IMAP_PORT",fork TCP:"$PROTON_BRIDGE_HOST":"$PROTON_BRIDGE_IMAP_PORT" &
+
+# Alpine GPG / keyboxd bug
+#if [ -f "${HOME}/.gnupg/S.keyboxd" ]; then
+echo "Killing previous gpg keyboxd programs..."
+pkill keyboxd || true
+pkill gpg || true
+#rm "${HOME}/.gnupg/S.keyboxd"
+rm "${HOME}"/.gnupg/S.* || true
+rm "${HOME}"/.gnupg/*/*.lock || true
+sleep 1
+gpg-agent --daemon --allow-preset-passphrase
+#fi
+
+# Start a default Proton Mail Bridge on a fake tty, so it won't stop because of EOF
+rm -f faketty
+mkfifo faketty
+cat faketty | /usr/bin/bridge --cli
+
+echo "Done."