Postfix smarthost for the k8s mail namespace: takes inbound mail from the DMZ gateways over WireGuard, delivers it to Stalwart over LMTP, and relays outbound mail to the gateways. Built on each container-base distro image and published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/postfix:<version>-<suffix>; the default distro's build is retagged as the unsuffixed :<version>, so both resolve to one digest. Only explicit versions are published; never a floating tag.

distro	from	tag suffix	default
`alma9`	`docker-internal/almalinux9:<base version>`	`alma9`	yes

Ships only postfix, postfix-lmdb and postfix-pcre: hash, lmdb, regexp, pcre (plus texthash/inline) maps and TLS. No site config is baked in.

Running

CMD is postfix start-fg; logs go to stdout (maillog_file = /dev/stdout, which a mounted main.cf must keep).
Mount main.cf, master.cf and maps from ConfigMaps as individual files (subPath) under /etc/postfix; a whole-directory mount hides dynamicmaps.cf, which the lmdb and pcre modules need. ConfigMaps are read-only, so prefer texthash:/regexp:/pcre:; hash:/lmdb: maps need postmap into a writable path.
Put /var/spool/postfix on a volume; missing queue directories are created on start.
Postfix's master must run as root (it drops to postfix per service); minimum capabilities: CHOWN DAC_OVERRIDE FOWNER SETUID SETGID NET_BIND_SERVICE.

Tests

test/smoke.sh runs in the Dockerfile's test stage (CI build, make test): postfix check on a sample config, then one STARTTLS message via swaks through every map type to an smtp-sink LMTP listener, from an empty spool.

The container-base release this image builds on is BASE_VERSION in the Dockerfile.

Adding a distro

distros/<name>/distro.env — BASE_IMAGE_NAME, IMAGE, TAG_SUFFIX, DEFAULT, PACKAGES.
One include entry in each of .woodpecker/{build,docker}.yaml.

The check-distros pre-commit hook fails if step 1 or 2 is incomplete, or if more than one distro claims DEFAULT.

Make

make build          # build every distro
make test           # build every distro's test stage
make pre-commit     # uvx pre-commit run --all-files
make build-alma9    # one distro
make patch|minor|major