Add: Alpine image as option for build

[geekgonecrazy]

Background

Running existing image through Clair shows several CVE's mostly in glibc. I tried upgrading the packages but very few went away and more were added. Tried switching rocketchat/base to debian:stretch... but most of the glibc CVE's persisted.

So ditched Debian all together and put it on an alpine base.

Doing this does require a couple of hacks to get sharp running.

1. For some reason when meteor build happens it is installing and including sharp in bundle/programs/server/npm/node_modules it I guess pre-compiled so is not compatible with the libc libraries included in the alpine image.
2. Installing in bundle/programs/server/npm does not work with out git, not sure what's going on.. but I didn't want more dependencies.. so installed bundle/programs/server and then moved it into place.
3. Installing 0.21.0 instead of our 0.20.3 because it includes pre-built for alpine preventing the need to install libvips from alpine leading to a lot of other issues.
4. Doing exact same procedure with grpc. I think sharp actually depends on it, so included it in the hack for sharp section 😉. But the one bundled is not compatible.
5. Running npm rebuild bcrypt --build-from-source with out this any time it ran bcrypt it would segment fault.

For what its worth.. all of these are similar issues compiling on different cpu architectures also. Many i've wrestled with to get our snap compiling on arm

We might should reconsider bundling sharp and grpc inside and instead having them be installed with npm install in the installation process.

Summary

All of this being said.. goes from a nice list of CVE's down to none reported with clair

Its published to docker hub for testing as rocketchat/rocket.chat:0.71.1-1 currently if anyone wants to test

Todo

• Add user rocketchat back

[rodrigok]

I'm afraid to approve it since I didn't test, but the code seems good 😄

[geekgonecrazy]

I just added to the description, but its published at this tag: rocketchat/rocket.chat:0.71.1-1 If you want to test the result

[geekgonecrazy]

@LuluGO I know you had to update the alpine image recently can you drop your changes as a commit here?

[LuluGO]

I tested latest version of the Dockerfile alpine with the enterprise (2.4.5) and community (2.4.9) bundles

[sampaiodiego]

oh, this needs an update =)

[geekgonecrazy]

@sampaiodiego @rodrigok updated :)

For testing I do:

cd .docker
curl -L https://releases.rocket.chat/latest/download -o rc.tar
tar xvf rc.tar
docker build -f Dockerfile.alpine -t rc-alpine .

If we end up replacing main.. we might have to tweak a few things and then of course rename

[sampaiodiego]

that's great @geekgonecrazy .. I'll give it a try

[sampaiodiego]

I was able to get it running with latest rocket.chat with those few changes..

I would if we should publish the bundle/tarball without sharp, so instead of removing it before build the Docker image we would do it before publishing.. wdyt? this would be a breaking change though, so we'd target the next major.

we also could start publishing the alpine version under its own tag so we can start dog fooding, wdyt?

[sampaiodiego]

better wait for #24075

[debdutdeb]

Suggested change

	# Start hack for sharp...
	&& rm -rf npm/node_modules/sharp \
	&& npm install sharp@0.29.3 \
	&& mv node_modules/sharp npm/node_modules/sharp \
	# End hack for sharp
	# Start hack for sharp...
	&& npm install --no-save sharp@$(node -pe 'require("./npm/node_modules/sharp/package.json").version') \
	&& mv node_modules/sharp npm/node_modules/sharp \
	# End hack for sharp

[debdutdeb]

this won't be effective anymore though if sharp doesn't get bundled anymore as @sampaiodiego said -

I would if we should publish the bundle/tarball without sharp

[sampaiodiego]

yep.. I realised my phrase was misspelled 😂 what I meant was that really would like to not ship sharp with the tarball, so this hack would not be required.. but the on current scenario this hack is required :(

[sampaiodiego]

I've added the changes to GitHub workflow file.. it will now create alpine variants for releases and develop image builds.. =)