Add Renovate config for automated p2pool version bumps

Adds .github/renovate.json based on the gold-standard config in
sethforprivacy/simple-monerod-docker, plus a `# renovate:` annotation
above ARG P2POOL_BRANCH so Renovate tracks the upstream p2pool release.

- renovate.json: same extends + customManager regex as monerod. The
  customManager already matches `ARG ..._BRANCH=<value>` patterns, so it
  picks up P2POOL_BRANCH directly. The docker manager (via
  docker:enableMajor) will also keep the pinned ubuntu base image current.
- Dockerfile: add
  `# renovate: datasource=github-releases depName=SChernykh/p2pool`
  immediately above `ARG P2POOL_BRANCH=v4.17`.

Validated with `renovate-config-validator` (renovate@latest):
"Config validated successfully". (Note: the field `managerFilePatterns`
requires Renovate >= 39; the hosted Mend app on this owner runs current
Renovate, matching the live monerod config.)

The hosted Mend Renovate app is already active on this owner's repos and
will pick this up automatically once merged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"

.github/renovate.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:enableMajor",
+    "mergeConfidence:all-badges",
+    ":disableRateLimiting",
+    ":semanticCommits"
+  ],
+  "rebaseWhen": "conflicted",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/(^|/)Dockerfile$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sARG .*?_VERSION=(?<currentValue>.*)(\\sARG .*?_CHECKSUM=(?<currentDigest>.*))?\\s",
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sARG .*?_BRANCH=(?<currentValue>.*)(\\sARG .*?_COMMIT_HASH=(?<currentDigest>.*))?\\s"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{versioning}}{{/if}}"
+    }
+  ]
+}

.github/workflows/build-image-on-push.yml

@@ -0,0 +1,60 @@
+name: "Test build of image when Dockerfile is changed"
+
+on:
+  push:
+    paths:
+    - 'Dockerfile'
+    branches-ignore:
+    - main
+  pull_request:
+    paths:
+    - 'Dockerfile'
+  workflow_dispatch:
+
+env:
+  GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
+
+jobs:
+  rebuild-container:
+    name: "Build image with cache"
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Prepare platform matrix for arm64
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "PLATFORM=linux/arm64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=arm64" >> $GITHUB_ENV
+      - name: Prepare platform matrix for amd64
+        if: runner.arch == 'X64'
+        run: |
+          echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=amd64" >> $GITHUB_ENV
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+      -
+        name: Checkout repository
+        uses: actions/checkout@v7
+      -
+        name: Test build of image
+        id: build
+        uses: docker/build-push-action@v7.2.0
+        with:
+          push: false
+          load: true
+          platforms: ${{ env.PLATFORM }}
+          tags: p2pool:testing
+          cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
+      - 
+        name: Test-run image
+        run: |
+          docker run --rm p2pool:testing --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R &
+          PID=$!
+          sleep 30
+          kill -SIGINT $PID # this will return a non-zero exit code if the container dies early on

.github/workflows/trivy-analysis.yml

@@ -1,37 +0,0 @@
-name: Build and scan container for vulnerabilities with Trivy
-
-on:
-  push:
-    paths:
-    - 'Dockerfile'
-  pull_request:
-    paths:
-    - 'Dockerfile'
-  schedule:
-    - cron: '22 14 * * 0'
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Build an image from Dockerfile
-        run: |
-          docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/update-base-image.yml

@@ -1,59 +0,0 @@
-name: "Update image and push to Github Packages and Docker Hub weekly"
-on:
-  schedule:
-    - cron: "0 12 * * 1" # Run every Monday at noon.
-  workflow_dispatch:
-
-jobs:
-  rebuild-container:
-    name: "Rebuild Container with the latest base image"
-    runs-on: ubuntu-latest
-    steps:
-      - 
-        name: Prepare outputs
-        id: prep
-        run: |
-          echo "::set-output name=created::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-      - 
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
-        with:
-          platforms: linux/arm64
-      - 
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.7.0
-      -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@v2.2.0 
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Login to DockerHub
-        uses: docker/login-action@v2.2.0 
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: "Checkout repository"
-        uses: "actions/checkout@v3"
-      - 
-        name: "Get p2pool Release Tag"
-        id: get_tag
-        run: echo "::set-output name=tag::$(awk -F "=" '/P2POOL_BRANCH=/ {print $2}' Dockerfile)"
-      - 
-        name: Build and push to Docker Hub and GitHub Packages Docker Registry
-        id: docker_build
-        uses: docker/build-push-action@v4.1.1
-        with:
-          push: true
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/p2pool:latest
-            ghcr.io/${{ github.repository_owner }}/p2pool:${{ steps.get_tag.outputs.tag }}
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:latest
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          labels: |
-            org.opencontainers.image.source=${{ github.event.repository.html_url }}
-            org.opencontainers.image.created=${{ steps.prep.outputs.created }}
-            org.opencontainers.image.revision=${{ github.sha }}

.github/workflows/update-image-on-push.yml

@@ -6,58 +6,120 @@ on:
     - main
     paths:
     - 'Dockerfile'
+  workflow_dispatch:
+
+env:
+  GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
+
 jobs:
-  rebuild-container:
-    name: "Rebuild Container with the latest base image"
-    runs-on: ubuntu-latest
+  build:
+    name: "Build container for multiple architectures and push by digest"
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+    runs-on: ${{ matrix.os }}
     steps:
-      - 
-        name: Prepare outputs
-        id: prep
+      - name: Prepare platform matrix for arm64
+        if: runner.arch == 'ARM64'
         run: |
-          echo "::set-output name=created::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-      - 
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.2.0
+          echo "PLATFORM=linux/arm64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=arm64" >> $GITHUB_ENV
+      - name: Prepare platform matrix for amd64
+        if: runner.arch == 'X64'
+        run: |
+          echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=amd64" >> $GITHUB_ENV
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
         with:
-          platforms: linux/arm64
-      - 
+          images: |
+            ${{ env.GHCR_REPO }}
+      -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.7.0
+        uses: docker/setup-buildx-action@v4.1.0
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v2.2.0 
+        uses: docker/login-action@v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
-        name: Login to DockerHub
-        uses: docker/login-action@v2.2.0 
+        name: Checkout repository
+        uses: actions/checkout@v7
+      -
+        name: Build and and push by digest
+        uses: docker/build-push-action@v7.2.0
+        id: build
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: "Checkout repository"
-        uses: "actions/checkout@v3"
-      - 
-        name: "Get p2pool Release Tag"
-        id: get_tag
-        run: echo "::set-output name=tag::$(awk -F "=" '/P2POOL_BRANCH=/ {print $2}' Dockerfile)"
-      - 
-        name: Build and push to Docker Hub and GitHub Packages Docker Registry
-        uses: docker/build-push-action@v4.1.1
-        id: docker_build_push
+          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          platforms: ${{ env.PLATFORM }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v7
         with:
-          push: true
-          platforms: linux/amd64,linux/arm64
+          name: digests-${{ env.DIGEST_NAME }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      
+      - name: Get p2pool release tag
+        run: echo P2POOL_TAG="$(awk -F '=' '/P2POOL_BRANCH=/ {print $2}' Dockerfile)" >> $GITHUB_ENV
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.GHCR_REPO }}
           tags: |
-            ghcr.io/${{ github.repository_owner }}/p2pool:latest
-            ghcr.io/${{ github.repository_owner }}/p2pool:${{ steps.get_tag.outputs.tag }}
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:latest
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          labels: |
-            org.opencontainers.image.source=${{ github.event.repository.html_url }}
-            org.opencontainers.image.created=${{ steps.prep.outputs.created }}
-            org.opencontainers.image.revision=${{ github.sha }}
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/simple-monerod:latest
-          cache-to: type=inline
+            type=sha
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ env.P2POOL_TAG }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }}

Dockerfile

@@ -1,4 +1,5 @@
-ARG P2POOL_BRANCH=v3.4
+# renovate: datasource=github-releases depName=SChernykh/p2pool
+ARG P2POOL_BRANCH=v4.17
 
 # Select latest Ubuntu LTS for the build image base
 FROM ubuntu:latest as build

README.md

@@ -3,21 +3,11 @@ A simple and straightforward Dockerized [p2pool](https://github.com/SChernykh/p2
 
 ## Actions
 
-[![Daily Update Rebuild](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-daily.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-daily.yml)  
-[![Weekly Update Rebuild](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-base-image.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-base-image.yml)  
-[![Latest Dockerfile build](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-image-on-push.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-image-on-push.yml)  
-[![Container security scan with Trivy](https://github.com/sethsimmons/p2pool-docker//actions/workflows/trivy-analysis.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/trivy-analysis.yml)
-
-## Docker
-
-![Docker Pulls](https://img.shields.io/docker/pulls/sethsimmons/p2pool)  
-![Docker Image Size (latest by date)](https://img.shields.io/docker/image-size/sethsimmons/p2pool)  
-![Docker Image Version (latest by date)](https://img.shields.io/docker/v/sethsimmons/p2pool)  
+[![Daily Update Rebuild](https://github.com/sethforprivacy/p2pool-docker//actions/workflows/update-daily.yml/badge.svg)](https://github.com/sethforprivacy/p2pool-docker/actions/workflows/update-daily.yml)  
+[![Weekly Update Rebuild](https://github.com/sethforprivacy/p2pool-docker//actions/workflows/update-base-image.yml/badge.svg)](https://github.com/sethforprivacy/p2pool-docker/actions/workflows/update-base-image.yml)  
 
 # Docker Hub
-This repo is used to build the images available at:
-
-https://hub.docker.com/r/sethsimmons/p2pool
+This repo is used to build the images available here on GHCR.
 
 # Tags
 
@@ -28,7 +18,7 @@ https://hub.docker.com/r/sethsimmons/p2pool
 *NOTE: Remember to replace the host address with your own node (if desired) as well as the Monero address for the `--wallet` flag, or else you'll be making a kind hashrate donation to me.*
 
 ```bash
-docker run -d --name="p2pool" -p 3333:3333 -p 37889:37889 -v p2pool-data:/home/p2pool -v /dev/hugepages:/dev/hugepages:rw sethsimmons/p2pool:latest --host 5.9.120.18 --rpc-port 18089 --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R --stratum 0.0.0.0:3333 --p2p 0.0.0.0:37889 --addpeers 65.21.227.114:37889,node.sethforprivacy.com:37889
+docker run -d --name="p2pool" -p 3333:3333 -p 37889:37889 -v p2pool-data:/home/p2pool -v /dev/hugepages:/dev/hugepages:rw ghcr.io/sethforprivacy/p2pool:latest --host 5.9.120.18 --rpc-port 18089 --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R --stratum 0.0.0.0:3333 --p2p 0.0.0.0:37889 --addpeers 65.21.227.114:37889,node.sethforprivacy.com:37889
 ```
 
 # Copyrights

examples/docker-compose.yml

@@ -1,7 +1,6 @@
-version: '3.5'
 services:
   monerod:
-    image: sethsimmons/simple-monerod:latest
+    image: ghcr.io/sethforprivacy/simple-monerod:latest
     restart: unless-stopped
     container_name: monerod
     volumes:
@@ -21,7 +20,7 @@ services:
       - "--out-peers=50"
   
   p2pool:
-    image: sethsimmons/p2pool:latest
+    image: ghcr.io/sethforprivacy/p2pool:latest
     restart: unless-stopped
     container_name: p2pool
     tty: true
@@ -52,15 +51,6 @@ services:
     volumes:
         - tor-keys:/var/lib/tor/hidden_service/
 
-  autoheal:
-    image: willfarrell/autoheal:latest
-    container_name: autoheal
-    restart: unless-stopped
-    environment:
-        AUTOHEAL_CONTAINER_LABEL: all
-    volumes:
-        - "/var/run/docker.sock:/var/run/docker.sock"
-
   watchtower:
     image: containrrr/watchtower:latest
     container_name: watchtower