add docker security warning

release/cibuild.py

@@ -312,7 +312,7 @@ def build_docker_image(be: BuildEnviron, whl: str):  # pragma: no cover
         "--tag", be.docker_tag,
         "--build-arg", "WHEEL_MITMPROXY={}".format(whl),
         "--build-arg", "WHEEL_BASENAME_MITMPROXY={}".format(os.path.basename(whl)),
-        "--file", "docker/Dockerfile",
+        "--file", "release/docker/Dockerfile",
         "."
     ])
     subprocess.check_call([
@@ -321,7 +321,7 @@ def build_docker_image(be: BuildEnviron, whl: str):  # pragma: no cover
         "--tag", be.docker_tag + "-ARMv7",
         "--build-arg", "WHEEL_MITMPROXY={}".format(whl),
         "--build-arg", "WHEEL_BASENAME_MITMPROXY={}".format(os.path.basename(whl)),
-        "--file", "docker/DockerfileARMv7",
+        "--file", "release/docker/DockerfileARMv7",
         "."
     ])
 

release/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.7
+FROM alpine:3.8
 
 ENV LANG=en_US.UTF-8
 
@@ -33,7 +33,7 @@ RUN addgroup -S mitmproxy && adduser -S -G mitmproxy mitmproxy \
 
 VOLUME /home/mitmproxy/.mitmproxy
 
-COPY docker/docker-entrypoint.sh /usr/local/bin/
+COPY release/docker/docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
 
 EXPOSE 8080 8081

release/docker/DockerfileARMv7

@@ -37,7 +37,7 @@ RUN [ "cross-build-end" ]
 
 VOLUME /home/mitmproxy/.mitmproxy
 
-COPY docker/docker-entrypoint.sh /usr/local/bin/
+COPY release/docker/docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
 
 EXPOSE 8080 8081

release/docker/README.md

@@ -36,3 +36,12 @@ For further details, please consult the mitmproxy [documentation](http://docs.mi
 # Tags
 
 The available release tags can be seen [here](https://hub.docker.com/r/mitmproxy/mitmproxy/tags/).
+
+* `master` always tracks the git-master branch and represents the unstable development tree.
+* `latest` always points to the same image as the most recent stable release, including bugfix releases (e.g., `4.0.0` and `4.0.1`).
+* `X.Y.Z` tags contain the mitmproxy release with this version number.  
+  - All packages, dependencies, and the base image that were available at the time of the mitmproxy release.
+  - We DO NOT update these images! Use at your own risk!
+  - These images MIGHT BE affected by potential security issues!
+  - Security issues that were made public AFTER the release MIGHT affect these images!
+* `*-ARMv7` are images built for Raspbian / Raspberry Pi