jfxs/alpine-tokei repository overview

⁠Tokei

A Tokei⁠ Docker image that displays statistics about your code:

• lightweight image based on a alpine,
• multiarch with support of amd64 and arm64,
• runs as a non-root user (UID 10010),
• includes go-task⁠ (task command) to run your Taskfiles in the same image,
• automatically updated: Renovate tracks the Alpine, Tokei and go-task versions and opens the merge requests,
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Running Tokei

docker run -t --rm -v "$(pwd)":/workdir jfxs/alpine-tokei /bin/sh -c "tokei ."

The container runs as UID 10010, so mounted files must be readable by that user. Add --user $(id -u):$(id -g) to run as yourself instead.

⁠Running Tokei in Gitlab-CI

Example of usage with Gitlab-CI:

 ...
code-statistics:
  image: jfxs/alpine-tokei
  stage: lint
  script:
    - tokei .

⁠Built with

Docker latest tag is 14.0.0-r0-001, 14.0, 14⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component alpine-tokei.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the Tokei apk package version used (including the Alpine revision, e.g. 14.0.0-r0),
• a dash
• an increment to differentiate build with the same version starting at 001

<tokei_version>-<increment>

Example: 14.0.0-r0-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the software bill of materials (SBOM) attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.