build(docker): Alpine 3.24.1 runtime with Mosquitto 2.1 compatibility

Dockerfile

@@ -57,7 +57,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
     go build -ldflags="-s -w" -o /corescope-decrypt .
 
 # Runtime image
-FROM alpine:3.20
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add --no-cache mosquitto mosquitto-clients supervisor caddy wget
 

Dockerfile.go

@@ -21,7 +21,7 @@ COPY cmd/ingestor/ ./
 RUN go build -o /corescope-ingestor .
 
 # Runtime image
-FROM alpine:3.20
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add --no-cache mosquitto mosquitto-clients supervisor caddy wget
 

docker/mosquitto.conf

@@ -4,6 +4,13 @@ allow_anonymous true
 persistence true
 persistence_location /var/lib/mosquitto/
 
+# Mosquitto >= 2.1 defaults allow_duplicate_messages to true: a client with
+# overlapping subscriptions (the ingestor's meshcore/+/+/packets + meshcore/#)
+# then receives every message once per matching subscription. Keep one
+# delivery per client. Deprecated upstream (removal planned for Mosquitto 3.0);
+# the broker logs a deprecation warning at startup.
+allow_duplicate_messages false
+
 # Logging
 log_dest stdout
 log_type warning

docker/supervisord-go-no-caddy.conf

@@ -6,7 +6,10 @@ logfile_maxbytes=0
 pidfile=/var/run/supervisord.pid
 
 [program:mosquitto]
-command=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
+; Mosquitto >= 2.1 drops privileges to PUID/PGID when they are set, and
+; entrypoint-go.sh exports /app/data/.env. Strip them for the broker only so it
+; keeps running as the mosquitto user that owns /var/lib/mosquitto.
+command=/usr/bin/env -u PUID -u PGID /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
 autostart=true
 autorestart=true
 stdout_logfile=/dev/stdout

docker/supervisord-go.conf

@@ -6,7 +6,10 @@ logfile_maxbytes=0
 pidfile=/var/run/supervisord.pid
 
 [program:mosquitto]
-command=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
+; Mosquitto >= 2.1 drops privileges to PUID/PGID when they are set, and
+; entrypoint-go.sh exports /app/data/.env. Strip them for the broker only so it
+; keeps running as the mosquitto user that owns /var/lib/mosquitto.
+command=/usr/bin/env -u PUID -u PGID /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
 autostart=true
 autorestart=true
 stdout_logfile=/dev/stdout