Add Renovate config for automated p2pool version bumps

Adds .github/renovate.json based on the gold-standard config in
sethforprivacy/simple-monerod-docker, plus a `# renovate:` annotation
above ARG P2POOL_BRANCH so Renovate tracks the upstream p2pool release.

- renovate.json: same extends + customManager regex as monerod. The
  customManager already matches `ARG ..._BRANCH=<value>` patterns, so it
  picks up P2POOL_BRANCH directly. The docker manager (via
  docker:enableMajor) will also keep the pinned ubuntu base image current.
- Dockerfile: add
  `# renovate: datasource=github-releases depName=SChernykh/p2pool`
  immediately above `ARG P2POOL_BRANCH=v4.17`.

Validated with `renovate-config-validator` (renovate@latest):
"Config validated successfully". (Note: the field `managerFilePatterns`
requires Renovate >= 39; the hosted Mend app on this owner runs current
Renovate, matching the live monerod config.)

The hosted Mend Renovate app is already active on this owner's repos and
will pick this up automatically once merged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"

.github/renovate.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:enableMajor",
+    "mergeConfidence:all-badges",
+    ":disableRateLimiting",
+    ":semanticCommits"
+  ],
+  "rebaseWhen": "conflicted",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/(^|/)Dockerfile$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sARG .*?_VERSION=(?<currentValue>.*)(\\sARG .*?_CHECKSUM=(?<currentDigest>.*))?\\s",
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sARG .*?_BRANCH=(?<currentValue>.*)(\\sARG .*?_COMMIT_HASH=(?<currentDigest>.*))?\\s"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{versioning}}{{/if}}"
+    }
+  ]
+}

.github/workflows/build-image-on-push.yml

@@ -0,0 +1,60 @@
+name: "Test build of image when Dockerfile is changed"
+
+on:
+  push:
+    paths:
+    - 'Dockerfile'
+    branches-ignore:
+    - main
+  pull_request:
+    paths:
+    - 'Dockerfile'
+  workflow_dispatch:
+
+env:
+  GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
+
+jobs:
+  rebuild-container:
+    name: "Build image with cache"
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Prepare platform matrix for arm64
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "PLATFORM=linux/arm64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=arm64" >> $GITHUB_ENV
+      - name: Prepare platform matrix for amd64
+        if: runner.arch == 'X64'
+        run: |
+          echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=amd64" >> $GITHUB_ENV
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+      -
+        name: Checkout repository
+        uses: actions/checkout@v7
+      -
+        name: Test build of image
+        id: build
+        uses: docker/build-push-action@v7.2.0
+        with:
+          push: false
+          load: true
+          platforms: ${{ env.PLATFORM }}
+          tags: p2pool:testing
+          cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
+      - 
+        name: Test-run image
+        run: |
+          docker run --rm p2pool:testing --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R &
+          PID=$!
+          sleep 30
+          kill -SIGINT $PID # this will return a non-zero exit code if the container dies early on

.github/workflows/trivy-analysis.yml

@@ -1,37 +0,0 @@
-name: Build and scan container for vulnerabilities with Trivy
-
-on:
-  push:
-    paths:
-    - 'Dockerfile'
-  pull_request:
-    paths:
-    - 'Dockerfile'
-  schedule:
-    - cron: '22 14 * * 0'
-
-jobs:
-  build:
-    name: Build
-    runs-on: "ubuntu-18.04"
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Build an image from Dockerfile
-        run: |
-          docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/update-base-image.yml

@@ -1,56 +0,0 @@
-name: "Update image and push to Github Packages and Docker Hub weekly"
-on:
-  schedule:
-    - cron: "0 12 * * 1" # Run every Monday at noon.
-  workflow_dispatch:
-jobs:
-  rebuild-container:
-    name: "Rebuild Container with the latest base image"
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1.6.0
-      -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@v1.10.0 
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Login to DockerHub
-        uses: docker/login-action@v1.10.0 
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: "Checkout repository"
-        uses: "actions/checkout@v2.3.4"
-      - 
-        name: "Get p2pool Release Tag"
-        id: get_tag
-        run: echo "::set-output name=tag::$(awk -F "=" '/P2POOL_BRANCH=/ {print $2}' Dockerfile)"
-      -
-        name: Build and push to Docker Hub and Github Packages Docker Registry
-        id: docker_build
-        uses: docker/build-push-action@v2.7.0
-        with:
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/p2pool:latest
-            ghcr.io/${{ github.repository_owner }}/p2pool:${{ steps.get_tag.outputs.tag }}
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:latest
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          labels: |
-            org.opencontainers.image.source=${{ github.event.repository.html_url }}
-            org.opencontainers.image.created=${{ steps.prep.outputs.created }}
-            org.opencontainers.image.revision=${{ github.sha }}
-      - 
-        name: Scan new image and output results
-        uses: Azure/container-scan@v0
-        with:
-          image-name: ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          severity-threshold: HIGH
-      -
-        name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}

.github/workflows/update-image-on-push.yml

@@ -2,56 +2,124 @@ name: "Update image and push to Github Packages and Docker Hub when Dockerfile i
 # Run this workflow every time a new commit pushed to your repository
 on:
   push:
+    branches:
+    - main
     paths:
     - 'Dockerfile'
+  workflow_dispatch:
+
+env:
+  GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
+
 jobs:
-  rebuild-container:
-    name: "Rebuild Container with the latest base image"
-    runs-on: ubuntu-latest
+  build:
+    name: "Build container for multiple architectures and push by digest"
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+    runs-on: ${{ matrix.os }}
     steps:
+      - name: Prepare platform matrix for arm64
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "PLATFORM=linux/arm64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=arm64" >> $GITHUB_ENV
+      - name: Prepare platform matrix for amd64
+        if: runner.arch == 'X64'
+        run: |
+          echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
+          echo "DIGEST_NAME=amd64" >> $GITHUB_ENV
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.GHCR_REPO }}
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1.6.0
+        uses: docker/setup-buildx-action@v4.1.0
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v1.10.0 
+        uses: docker/login-action@v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
-        name: Login to DockerHub
-        uses: docker/login-action@v1.10.0 
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: "Checkout repository"
-        uses: "actions/checkout@v2.3.4"
+        name: Checkout repository
+        uses: actions/checkout@v7
       -
-        name: "Get p2pool Release Tag"
-        id: get_tag
-        run: echo "::set-output name=tag::$(awk -F "=" '/P2POOL_BRANCH=/ {print $2}' Dockerfile)"
-      -
-        name: Build and push to Docker Hub and Github Packages Docker Registry
-        id: docker_build
-        uses: docker/build-push-action@v2.7.0
+        name: Build and and push by digest
+        uses: docker/build-push-action@v7.2.0
+        id: build
         with:
-          push: true
+          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          platforms: ${{ env.PLATFORM }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: digests-${{ env.DIGEST_NAME }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Login to GHCR
+        uses: docker/login-action@v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      
+      - name: Get p2pool release tag
+        run: echo P2POOL_TAG="$(awk -F '=' '/P2POOL_BRANCH=/ {print $2}' Dockerfile)" >> $GITHUB_ENV
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.GHCR_REPO }}
           tags: |
-            ghcr.io/${{ github.repository_owner }}/p2pool:latest
-            ghcr.io/${{ github.repository_owner }}/p2pool:${{ steps.get_tag.outputs.tag }}
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:latest
-            ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          labels: |
-            org.opencontainers.image.source=${{ github.event.repository.html_url }}
-            org.opencontainers.image.created=${{ steps.prep.outputs.created }}
-            org.opencontainers.image.revision=${{ github.sha }}
-      - 
-        name: Scan new image and output results
-        uses: Azure/container-scan@v0
-        with:
-          image-name: ${{ secrets.DOCKER_USERNAME }}/p2pool:${{ steps.get_tag.outputs.tag }}
-          severity-threshold: HIGH
-      -
-        name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
+            type=sha
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ env.P2POOL_TAG }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }}

Dockerfile

@@ -1,7 +1,8 @@
-ARG P2POOL_BRANCH=v1.3.1
+# renovate: datasource=github-releases depName=SChernykh/p2pool
+ARG P2POOL_BRANCH=v4.17
 
-# Select Ubuntu 20.04LTS for the build image base
-FROM ubuntu:20.04 as build
+# Select latest Ubuntu LTS for the build image base
+FROM ubuntu:latest as build
 LABEL author="sethforprivacy@protonmail.com" \
       maintainer="sethforprivacy@protonmail.com"
 
@@ -10,7 +11,7 @@ RUN apt-get update \
     && apt-get upgrade -y \
     && DEBIAN_FRONTEND=noninteractive apt-get -y install --no-install-recommends git \
     build-essential cmake libuv1-dev libzmq3-dev libsodium-dev libpgm-dev libnorm-dev \
-    libgss-dev ca-certificates\
+    libgss-dev libcurl4-openssl-dev libidn2-0-dev ca-certificates \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
@@ -30,13 +31,14 @@ RUN git clone --recursive --branch ${P2POOL_BRANCH} https://github.com/SChernykh
 ARG NPROC
 RUN test -z "$NPROC" && nproc > /nproc || echo -n "$NPROC" > /nproc && mkdir build && cd build && cmake .. && make -j"$(cat /nproc)"
 
-# Select Ubuntu 20.04LTS for the image base
-FROM ubuntu:20.04
+# Select latest Ubuntu LTS for the image base
+FROM ubuntu:latest
 
 # Install remaining dependencies
 RUN apt-get update \
     && apt-get upgrade -y \
-    && apt-get install --no-install-recommends -y libuv1-dev libzmq3-dev libsodium-dev libpgm-dev libnorm-dev libgss-dev \
+    && apt-get install --no-install-recommends -y libuv1-dev libzmq3-dev libsodium-dev \
+    libpgm-dev libnorm-dev libgss-dev libcurl4-openssl-dev libidn2-0-dev \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 

README.md

@@ -3,21 +3,11 @@ A simple and straightforward Dockerized [p2pool](https://github.com/SChernykh/p2
 
 ## Actions
 
-[![Daily Update Rebuild](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-daily.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-daily.yml)  
-[![Weekly Update Rebuild](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-base-image.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-base-image.yml)  
-[![Latest Dockerfile build](https://github.com/sethsimmons/p2pool-docker//actions/workflows/update-image-on-push.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/update-image-on-push.yml)  
-[![Container security scan with Trivy](https://github.com/sethsimmons/p2pool-docker//actions/workflows/trivy-analysis.yml/badge.svg)](https://github.com/sethsimmons/p2pool-docker/actions/workflows/trivy-analysis.yml)
-
-## Docker
-
-![Docker Pulls](https://img.shields.io/docker/pulls/sethsimmons/p2pool)  
-![Docker Image Size (latest by date)](https://img.shields.io/docker/image-size/sethsimmons/p2pool)  
-![Docker Image Version (latest by date)](https://img.shields.io/docker/v/sethsimmons/p2pool)  
+[![Daily Update Rebuild](https://github.com/sethforprivacy/p2pool-docker//actions/workflows/update-daily.yml/badge.svg)](https://github.com/sethforprivacy/p2pool-docker/actions/workflows/update-daily.yml)  
+[![Weekly Update Rebuild](https://github.com/sethforprivacy/p2pool-docker//actions/workflows/update-base-image.yml/badge.svg)](https://github.com/sethforprivacy/p2pool-docker/actions/workflows/update-base-image.yml)  
 
 # Docker Hub
-This repo is used to build the images available at:
-
-https://hub.docker.com/r/sethsimmons/p2pool
+This repo is used to build the images available here on GHCR.
 
 # Tags
 
@@ -28,7 +18,7 @@ https://hub.docker.com/r/sethsimmons/p2pool
 *NOTE: Remember to replace the host address with your own node (if desired) as well as the Monero address for the `--wallet` flag, or else you'll be making a kind hashrate donation to me.*
 
 ```bash
-docker run -d --name="p2pool" -p 3333:3333 -p 37889:37889 -v p2pool-data:/home/p2pool -v /dev/hugepages:/dev/hugepages:rw sethsimmons/p2pool:latest --host 5.9.120.18 --rpc-port 18089 --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R --stratum 0.0.0.0:3333 --p2p 0.0.0.0:37889 --addpeers 65.21.227.114:37889,node.sethforprivacy.com:37889
+docker run -d --name="p2pool" -p 3333:3333 -p 37889:37889 -v p2pool-data:/home/p2pool -v /dev/hugepages:/dev/hugepages:rw ghcr.io/sethforprivacy/p2pool:latest --host 5.9.120.18 --rpc-port 18089 --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R --stratum 0.0.0.0:3333 --p2p 0.0.0.0:37889 --addpeers 65.21.227.114:37889,node.sethforprivacy.com:37889
 ```
 
 # Copyrights

examples/docker-compose.yml

@@ -1,7 +1,6 @@
-version: '3.5'
 services:
   monerod:
-    image: sethsimmons/simple-monerod:p2pool-api-v0.17
+    image: ghcr.io/sethforprivacy/simple-monerod:latest
     restart: unless-stopped
     container_name: monerod
     volumes:
@@ -21,7 +20,7 @@ services:
       - "--out-peers=50"
   
   p2pool:
-    image: sethsimmons/p2pool:latest
+    image: ghcr.io/sethforprivacy/p2pool:latest
     restart: unless-stopped
     container_name: p2pool
     tty: true
@@ -34,7 +33,7 @@ services:
       - 37889:37889
     command: >-
       --wallet "468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R"
-      --stratum "0.0.0.0:3333" --p2p "0.0.0.0:37889"
+      --stratum "0.0.0.0:3333" --p2p "0.0.0.0:37889" --rpc-port "18089"
       --addpeers "65.21.227.114:37889,node.sethforprivacy.com:37889" --host "monerod"
 
   tor:
@@ -52,15 +51,6 @@ services:
     volumes:
         - tor-keys:/var/lib/tor/hidden_service/
 
-  autoheal:
-    image: willfarrell/autoheal:latest
-    container_name: autoheal
-    restart: unless-stopped
-    environment:
-        AUTOHEAL_CONTAINER_LABEL: all
-    volumes:
-        - "/var/run/docker.sock:/var/run/docker.sock"
-
   watchtower:
     image: containrrr/watchtower:latest
     container_name: watchtower