matonb/smtp-oauth-relay repository overview

⁠smtp-oauth-relay (hardened)

A hardened build of smtp-oauth-relay⁠ — a lightweight SMTP-to-Microsoft-Graph relay that lets legacy SMTP clients (printers, NAS, monitoring tools, line-of-business apps) send mail through Microsoft 365 using OAuth 2.0 client credentials, no Basic Auth required.

Built from matonb/smtp-oauth-relay⁠, a live GitHub fork of upstream (not a one-time source import), so upstream security and feature updates flow through automatically.

⁠What's different from upstream's own image

Upstream's published image builds on python:3.14.3-slim — a full Debian userland the app never touches at runtime, carrying whatever CVE backlog is currently unpatched in that base.

This build instead uses Docker Hardened Images⁠ (dhi.io/python:3.13-alpine): a minimal Alpine base maintained specifically to keep that surface small, with no shell and no package manager in the runtime image — nothing to exec into. Check the image's own SBOM/attestations for its current vulnerability status rather than relying on a description that can't stay live.

The app's behaviour is unchanged, only how the image is built differs. See upstream's own README⁠ for environment variables and usage.

⁠Platforms

Built natively for linux/amd64 and linux/arm64 (no QEMU emulation), combined into one multi-arch manifest.

⁠Tags

• latest — most recent build
• vX.Y.Z — matches the upstream relay release this image was built from
• vX.Y.Z-N-gHASH — exact commit this image was built from (git describe)

⁠Source

• Fork (this build): https://github.com/matonb/smtp-oauth-relay⁠
• Upstream: https://github.com/JustinIven/smtp-oauth-relay⁠