All notable changes to this Docker packaging project are documented here. Each entry tracks the upstream XMRig version used and any packaging changes made in this repository.
- BUG: Fixed
Dockerfile.securesilently failing to findconfig.jsonat runtime — xmrig resolves a relative config path against the binary's own location, and the secure variant copies the binary to/usr/local/binwhile the config lives in/home/xmrig.docker-entrypoint.shnow injects an explicit--config=<abs path>unless the caller already passed-c/--config.
- Added a
validatejob todocker-build.yml(matrix overDockerfileandDockerfile.secure) that builds each variant and runs--version,--dry-run, andsecurity-check.shagainst it on every push and pull request tomain. - The push job now re-validates the exact image about to ship before tagging/pushing, and only runs on
pushevents (not pull requests); it is gated on thevalidatejob passing. docker-build.ymlnow also triggers on pull requests tomainfor early feedback, without pushing images.- Pinned
snyk/actions/dockerto a commit SHA (9adf32b.../ v1.0.0) instead of a mutable tag, matching the pinning convention already used for other actions in this repo.
- Added support for RandomX v2 (#3769, #3772, #3774, #3775, #3776, #3782, #3783)
- RISC-V: vectorized RandomX main loop (#3746)
- RISC-V: auto-detect and use vector code for all RandomX AES functions (#3748)
- RISC-V: detect and use hardware AES (#3749)
- RISC-V: use vector hardware AES instead of scalar (#3750)
- RISC-V: fixed scratchpad prefetch, removed unnecessary instruction (#3757)
- RandomX: added VAES-512 support for Zen5 (#3758)
- RandomX: optimized VAES code (#3759)
- Fixed keepalive timer logic (#3762)
- RandomX: ARM64 fixes (#3778)
- Fixed OpenCL address-space mismatch in
keccak_f800_round(#3784) - Don't reset nonce during donation rounds (#3785)
- Added release automation workflow (
release-from-version.yml) - Added agent workspace guide (
AGENTS.md) - Added
CHANGELOG.mdwith full release history - Updated README with release automation docs and Compose usage
- CRITICAL: Fixed
docker-entrypoint.shusing relative path./xmrig— now uses PATH lookup (exec xmrig) for compatibility with both image variants - CRITICAL: Fixed broken quoting in
start_zergpool.shexec line - CRITICAL: Fixed
start-linux-randomx.shhardcoded path/home/xmrig/xmrig— now usesxmrigvia PATH - HIGH: Removed exposed JWT example token from
config.json(access-tokenset tonull) - HIGH: Removed
--no-check-certificatefrom both Dockerfiles — TLS verification now enforced - HIGH: Added
PASSWORDenv var toDockerfile.securefor parity with standard image - HIGH: Removed Quay.io references from CI,
build.sh, andREADME.md(registry was not in use) - HIGH: GHCR login switched from custom secrets to
github.actor+GITHUB_TOKEN - Added SHA256 checksum verification for XMRig binary downloads in both Dockerfiles
- Added
set -euto all shell scripts for fail-fast behavior - Removed unused packages (
curl,gnupg) from Dockerfiles - Removed stale
docker-image.ymlworkflow (triggered on non-existentmasterbranch) - Set login shell to
/usr/sbin/nologinfor container user - Removed redundant
USERdirectives in Dockerfiles - Replaced hardcoded wallet address with
YOUR_WALLET_ADDRESSplaceholder - Added
tls: truetoconfig.jsonfor encrypted pool connections - HEALTHCHECK in
Dockerfile.secureusesxmrig --versionvia PATH instead of absolute path - Added
.env.randomx.examplefor RandomX-specific environment variables - Extended
.dockerignoreto exclude docs and dev files from build context - Made
security-check.shaccept image name as parameter - Added
github-actionsecosystem to Dependabot configuration - Corrected SSL/TLS claim in
SECURITY.md build.shnow exits before security check when called withbuild-only