Docker-signapk

create image:
    docker build -t signapk:latest .

sign apk:
    docker run --rm -e OPTION="-w" -v $PWD:/data signapk:latest ./update.zip ./update_signed.zip

Dockerfile

FROM alpine:3.12 AS setup
ARG BRANCH=oreo-release

RUN apk --no-cache add git
RUN git clone --filter=blob:none --sparse -b ${BRANCH} https://android.googlesource.com/platform/build /build && \
    cd /build && \
    git sparse-checkout add /target/product/security

RUN git clone --filter=blob:none --sparse -b ${BRANCH} https://android.googlesource.com/platform/prebuilts/sdk /sdk && \
    cd /sdk && \
    git sparse-checkout add /tools/lib /tools/linux/lib64

FROM openjdk:16-slim
COPY --from=setup /build/target/product/security /security
COPY --from=setup /sdk/tools /tools
COPY --chmod=755 ./sign.sh /sign.sh
WORKDIR /data
ENV LD_LIBRARY_PATH=/tools/linux/lib64
ENV _JAVA_OPTIONS="--illegal-access=permit"
ENTRYPOINT [ "/sign.sh" ]

LICENSE

            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
                    Version 2, December 2004

 Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>

 Everyone is permitted to copy and distribute verbatim or modified
 copies of this license document, and changing it is allowed as long
 as the name is changed.

            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. You just DO WHAT THE FUCK YOU WANT TO.

sign.sh

#!/bin/sh

INPUT=${1}
OUTPUT=${2:-$(basename $INPUT .zip)_signed.zip}  
OPTION=${OPTION:=""}
PUBLIC_KEY=${PUBLIC_KEY:=/security/testkey.x509.pem}
PRIVATE_KEY=${PRIVATE_KEY:=/security/testkey.pk8}

set -eux
java -jar /tools/lib/signapk.jar $OPTION $PUBLIC_KEY $PRIVATE_KEY $INPUT $OUTPUT