A custom Komodo Periphery image with SOPS and age, published to GHCR with a public Docker Hub mirror and rebuilt automatically when upstream components change.
This repository publishes a Docker image based on ghcr.io/moghtech/komodo-periphery:2 with sops, age, and age-keygen preinstalled. It is intended for self-hosted environments that want a ready-to-use Periphery image for encrypted secrets and configuration handling without maintaining a custom build pipeline from scratch.
Registries:
- GHCR (canonical):
ghcr.io/smoochy/komodo-periphery-sops-age - Docker Hub (public mirror):
smoochy84/komodo-periphery-sops-age
If this project saves you time or helps your setup, you can support ongoing maintenance via Coindrop, Ko-fi, or Buy Me a Coffee.
Komodo Periphery does not include every tool needed for encrypted configuration workflows out of the box. This project provides a maintained image variant with SOPS and age preinstalled so those workflows can be used directly.
- Builds a custom Docker image based on
ghcr.io/moghtech/komodo-periphery:2 - Adds:
sopsageage-keygen
- Publishes the image to:
- GHCR (canonical):
ghcr.io/smoochy/komodo-periphery-sops-age:<major>ghcr.io/smoochy/komodo-periphery-sops-age:<major.minor>ghcr.io/smoochy/komodo-periphery-sops-age:<major.minor.patch>
- Docker Hub (public mirror):
smoochy84/komodo-periphery-sops-age:<major>smoochy84/komodo-periphery-sops-age:<major.minor>smoochy84/komodo-periphery-sops-age:<major.minor.patch>
- GHCR (canonical):
- Tracks upstream updates and rebuilds only when needed
The workflow is triggered in three ways:
-
Push to
main, but only when one of these files changes:Dockerfile*.dockerignore.github/workflows/build.yml
This prevents rebuilds for documentation-only changes such as
README.md. -
Scheduled run:
- Runs a daily check for upstream changes such as the base digest, SOPS release, and age release
- Builds only if something changed
-
Manual run with
workflow_dispatch:- Optional
force=trueinput to rebuild even if nothing changed
- Optional
The Dockerfile:
- Uses
ghcr.io/moghtech/komodo-periphery:2as the base image - Installs minimal dependencies such as
curl,tar, and CA certificates - Downloads and installs:
- SOPS from
getsops/sopsGitHub releases - age and
age-keygenfromFiloSottile/ageGitHub releases
- SOPS from
- Supports multi-arch builds for:
linux/amd64linux/arm64
- Stores the selected versions as OCI labels
The Dockerfile does not decide which versions to install. Version selection is done by the workflow and passed in via build args.
build.yml does the following:
- Logs into GHCR and sets up Buildx.
- Fetches upstream versions using authenticated GitHub API calls.
- Reads metadata from the currently published image when it exists.
- Compares:
- komodo-periphery base digest
- SOPS latest release version
- age latest release version
- Builds once, pushes to GHCR, and mirrors the published tags to Docker Hub when Docker Hub secrets are configured.
- Publishes only when:
- a push-triggered run happens
- an upstream change is detected
- a manual run is forced
- Publishes three SemVer tags for the selected Komodo release:
- the floating major tag, for example
2 - the floating major/minor tag, for example
2.0 - the exact release tag, for example
2.0.0
- the floating major tag, for example
Every workflow run writes a summary that includes:
- The reason the build ran
- Which upstream component changed
- Direct links to upstream release notes for SOPS and age
- The selected versions for this run
- The current versions from the already published image
- Whether the Docker Hub mirror was updated or skipped
This makes it obvious why a new image was published and what changed.
Each published image includes OCI labels used for traceability and change detection, for example:
org.opencontainers.image.base.tagorg.opencontainers.image.base.digestorg.opencontainers.image.sops.versionorg.opencontainers.image.age.version
This image is published with:
<x>: tracks the current upstream Komodo major line, for example2<x.y>: tracks the current upstream Komodo minor line, for example2.0<x.y.z>: matches the exact upstream Komodo Periphery release and is useful for reproducible deployments pinned to a specific Komodo release
The exact <x.y.z> tag is resolved from the digest currently served by ghcr.io/moghtech/komodo-periphery:2. For the current upstream v2 release, that means the custom image publishes 2, 2.0, and 2.0.0.
Pull the published image from GHCR (canonical) or Docker Hub (public mirror):
docker pull ghcr.io/smoochy/komodo-periphery-sops-age:2If you want to follow the Komodo v2 line without pinning to one exact patch release, use the floating major tag:
docker pull smoochy84/komodo-periphery-sops-age:2docker pull ghcr.io/smoochy/komodo-periphery-sops-age:2.0docker pull smoochy84/komodo-periphery-sops-age:2.0If you need a specific Komodo release, pull the matching exact version tag instead:
docker pull ghcr.io/smoochy/komodo-periphery-sops-age:<x.y.z>docker pull smoochy84/komodo-periphery-sops-age:<x.y.z>If you are upgrading an existing Komodo v1 deployment to v2, follow the official Komodo upgrade guide.
Example docker-compose.yml:
services:
periphery:
image: ghcr.io/smoochy/komodo-periphery-sops-age:2or
services:
periphery:
image: ghcr.io/smoochy/komodo-periphery-sops-age:2.0.0The same tags are mirrored to Docker Hub at smoochy84/komodo-periphery-sops-age.
The code, documentation, and related project materials in this repository were created and refined with AI assistance. All generated output was reviewed and adapted before publication.
- No secrets are baked into the image
- GitHub Actions uses the built-in
GITHUB_TOKENfor:- GHCR authentication
- authenticated GitHub API calls
- Optional Docker Hub publishing uses
DOCKERHUB_USERNAMEandDOCKERHUB_TOKENrepository secrets - Only release metadata is queried from upstream projects
- smoochy
Issues and pull requests are welcome. Keep Dockerfile, workflow, and README changes aligned so the published image behavior remains easy to audit.