containers

Versioned OCI images that plug into hardened Kubernetes clusters without internet access. Images are updated automatically on every upstream release (Renovate automerge → CI → registry).

Registry: git.denktmit.tech/denktmit-oss/containers/<name>:<version>; the tag is the version of the bundled software. The CI log prints the digest reference for pinning.

Grafana plugins as image volumes

Image	Upstream
victoriametrics-metrics-datasource	victoriametrics-datasource
victoriametrics-logs-datasource	victorialogs-datasource

The image contains only the plugin files (scratch) and is mounted read-only at /var/lib/grafana/plugins/<plugin-id>. Grafana stays unchanged; no init container, ConfigMaps or runtime downloads are needed.

volumes:
  - name: victoriametrics-metrics-datasource
    image:
      reference: git.denktmit.tech/denktmit-oss/containers/victoriametrics-metrics-datasource:<version>@sha256:<digest>
      pullPolicy: IfNotPresent

containers:
  - name: grafana
    image: <grafana>:<version>-distroless
    volumeMounts:
      - name: victoriametrics-metrics-datasource
        mountPath: /var/lib/grafana/plugins/victoriametrics-metrics-datasource
        readOnly: true

Java agents as image volumes

Image	Upstream
jmx-prometheus-javaagent	jmx_exporter

The image contains only /jmx_prometheus_javaagent.jar (scratch, mode 0644). Mount the file read-only and load it with -javaagent:; no download at pod start.

volumes:
  - name: jmx-prometheus-javaagent
    image:
      reference: git.denktmit.tech/denktmit-oss/containers/jmx-prometheus-javaagent:<version>@sha256:<digest>
      pullPolicy: IfNotPresent

containers:
  - name: app
    volumeMounts:
      - name: jmx-prometheus-javaagent
        mountPath: /opt/jmx/jmx_prometheus_javaagent.jar
        subPath: jmx_prometheus_javaagent.jar
        readOnly: true

Repository prerequisites

• Secrets CI_ACTOR / CI_TOKEN for pushing to the registry.
• Renovate bot with merge permission on main; branch protection must not require approvals or status checks for it.

Details

• Build: one CI per container (.forgejo/workflows/<name>.yaml), triggered only by pushes to main that touch its own directory. PRs do not build.
• Updates: Renovate automerges all updates (plugin, base image digest, actions, including major) without checks; the merge to main builds and pushes the image. Builds are reproducible, so rebuilds without content change keep the digest.
• Complete plugin files: the plugins are signed (MANIFEST.txt), so backend binaries for other platforms stay in the image.