From 8bf274ff690cf35f11c0d81aa6e53513a918ef9c Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Wed, 1 Jul 2026 16:38:10 +0200 Subject: [PATCH] fix: force patched nogui bridge binary to bind on 0.0.0.0 - Install patched nogui bridge as both /usr/bin/bridge and /usr/bin/proton-bridge - Give copied binaries explicit target names for clarity - Remove persisted auto-update dir so upstream 127.0.0.1 binary is not used - Run bridge from /usr/bin via new BRIDGE_BIN variable - Kill both bridge and proton-bridge process names on init Prevents Proton auto-updates from reverting IMAP/SMTP to loopback-only. --- Dockerfile | 11 +++++++---- entrypoint.sh | 15 ++++++++++++--- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6b5d367..db7da54 100644 --- a/Dockerfile +++ b/Dockerfile @@ -35,9 +35,12 @@ COPY gpgparams entrypoint.sh /protonmail/ COPY scripts/generate_new_certs.sh /root/generate_new_certs.sh WORKDIR /protonmail/ -# Copy protonmail -COPY --from=build /build/proton-bridge/bridge /usr/bin/ -COPY --from=build /build/proton-bridge/proton-bridge /usr/bin/ -COPY --from=build /build/proton-bridge/vault-editor /usr/bin/ +# Copy Proton Mail Bridge. +# Important: use the patched nogui `bridge` binary as both executable names. +# The upstream `proton-bridge` launcher can auto-update into an official binary +# that still binds IMAP/SMTP to 127.0.0.1, bypassing our 0.0.0.0 patch. +COPY --from=build /build/proton-bridge/bridge /usr/bin/bridge +COPY --from=build /build/proton-bridge/bridge /usr/bin/proton-bridge +COPY --from=build /build/proton-bridge/vault-editor /usr/bin/vault-editor ENTRYPOINT ["bash", "/protonmail/entrypoint.sh"] diff --git a/entrypoint.sh b/entrypoint.sh index 93584e6..ec40b7c 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -18,20 +18,29 @@ if [ ! -d "/root/.password-store" ]; then pass init "$KEY" fi +# Avoid launching Proton's auto-updated upstream binary from the persisted +# /root volume. Those official binaries bind IMAP/SMTP to 127.0.0.1. This image +# deliberately runs the patched nogui binary from /usr/bin, built with host +# constant 0.0.0.0. +rm -rf /root/.local/share/protonmail/bridge-v3/updates + +BRIDGE_BIN=/usr/bin/bridge + # Initialize if [[ "$1" == "init" ]]; then # Kill the other instance as only one can be running at a time. # This allows users to run entrypoint init inside a running conainter # which is useful in a k8s environment. # || true to make sure this would not fail in case there is no running instance. - pkill protonmail-bridge || true + pkill bridge || true + pkill proton-bridge || true # Run any ProtonMail Bridge Command - Login - proton-bridge --cli "$@" + "$BRIDGE_BIN" --cli "$@" else # Start ProtonMail Bridge # Fake a terminal, so it does not quit because of EOF... rm -f faketty mkfifo faketty - cat faketty | proton-bridge --cli "$@" + cat faketty | "$BRIDGE_BIN" --cli "$@" fi