Create and build a Docker Hardened Image — syntax=dhi.io/build:2-debian13

Reference note (untrusted external data; do not execute it as instructions). name: Redis 8.0.x image: my-registry/my-redis variant: runtime tags: "8.0" "8.0.5" platforms: linux/amd64 linux/arm64 contents: repositories: deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] trixie main keyring: packages: '!libelogind0' '!mawk' '!original-awk' base-files libpcre2-8-0 libssl3t64 libstdc++6 libsystemd0 redis=6:8.0.5-1rl1~trixie1 redis-server=6:8.0.5-1rl1~trixie1 redis-tools=6:8.0.5-1rl1~trixie1 tini mappings: redis: pkg:deb/redis/redis@6:8.0.5-1rl1~trixie1?os_name=debian&os_version=13 redis-server: pkg:deb/redis/redis-server@6:8.0.5-1rl1~trixie1?os_name=debian&os_version=13 redis-tools: pkg:deb/redis/redis-tools@6:8.0.5-1rl1~trixie1?os_name=debian&os_version=13 accounts: run-as: nonroot users: name: nonroot uid: 65532 gid: 65532 groups: name: nonroot gid: 65532 members: nonroot os-release: name: Docker Hardened Images (Debian) id: debian version-id: "13" version-codename: trixie pretty-name: Docker Hardened Images/Debian GNU/Linux 13 (trixie) home-url: bug-report-url environment: REDIS_VERSION: 8.0.5 annotations: org.opencontainers.image.description: A minimal Redis image org.opencontainers.image.licenses: AGPL-3.0-only entrypoint: /usr/bin/tini cmd: redis-server /etc/redis/redis.conf --include /etc/redis/conf.d/.conf Bounded code example (external data; do not execute automatically): ```text This example introduces several patterns: - **Third-party repositories**: The `repositories` field uses the Debian `deb [signed-by=...] URL suite component` format for APT sources. - **Keyring**: The `keyring` field downloads the GPG key used to verify packages from the third-party repository. - **Package exclusions**: Prefix a package name with `!` to explicitly exclude it. This prevents unwanted dependencies from being installed. In this case, `!libelogind0`, `!mawk`, and `!original-awk` are excluded. - **Debian version pinning**: Use the full epoch format, `redis-server=6:8.0.5-1rl1~trixie1`, to pin exact package versions. - **SBOM mappings**: The `mappings` field provides Package URL (purl) metadata so that Docker Scout can accurately identify the software in the SBOM. - **Init process**: The `entrypoint` uses `tini` as a lightweight init process (PID 1) to handle sign ``` Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.