-
Notifications
You must be signed in to change notification settings - Fork 67
/
Dockerfile.ubi8
140 lines (119 loc) · 5.89 KB
/
Dockerfile.ubi8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
#
# Copyright 2017 Confluent Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
ARG UBI_MINIMAL_VERSION="latest"
FROM registry.access.redhat.com/ubi8/ubi-minimal:${UBI_MINIMAL_VERSION}
ARG PROJECT_VERSION
ARG ARTIFACT_ID
# Remember where we came from
LABEL io.confluent.docker.git.repo="confluentinc/common-docker"
ARG GIT_COMMIT
LABEL io.confluent.docker.git.id=$GIT_COMMIT
ARG BUILD_NUMBER=-1
LABEL io.confluent.docker.build.number=$BUILD_NUMBER
LABEL maintainer="tools@confluent.io"
LABEL vendor="Confluent"
LABEL version=$GIT_COMMIT
LABEL release=$PROJECT_VERSION
LABEL name=$ARTIFACT_ID
LABEL summary="Common base image for Confluent's Docker images."
LABEL description="Common base image for Confluent's Docker images."
LABEL io.confluent.docker=true
# This affects how strings in Java class files are interpreted. We want UTF-8 and this is the only locale in the
# base image that supports it
ENV LANG="C.UTF-8"
# Set the classpath for JARs required by `cub`
ENV CUB_CLASSPATH='"/usr/share/java/cp-base-new/*"'
# These ARGs are left blank indicating to the Dnf package manager to install the latest package
# version that happens to be availible at this time. For reproducible builds, versions should be specified
# as '-1.2.3-4.el8' on the command line. Or more preferibly the 'dockerfile-maven-plugin' is used
# where these arguments are set in base/pom.xml under the <buildArgs> elements based on the commit you're
# building from.
# Redhat Package Versions
ARG OPENSSL_VERSION=""
ARG WGET_VERSION=""
ARG NETCAT_VERSION=""
ARG PYTHON39_VERSION=""
ARG TAR_VERSION=""
ARG PROCPS_VERSION=""
ARG KRB5_WORKSTATION_VERSION=""
ARG IPUTILS_VERSION=""
ARG HOSTNAME_VERSION=""
ARG XZ_LIBS_VERSION=""
ARG GLIBC_VERSION=""
ARG CURL_VERSION=""
# Zulu OpenJDK version
ARG ZULU_OPENJDK_VERSION=""
# Python Module Versions
ARG PYTHON_PIP_VERSION=""
ARG PYTHON_SETUPTOOLS_VERSION=""
# Confluent Docker Utils Version (Namely the tag or branch to grab from git to install)
ARG PYTHON_CONFLUENT_DOCKER_UTILS_VERSION="master"
# This can be overriden for an offline/air-gapped builds
ARG PYTHON_CONFLUENT_DOCKER_UTILS_INSTALL_SPEC="git+https://github.com/confluentinc/confluent-docker-utils@${PYTHON_CONFLUENT_DOCKER_UTILS_VERSION}"
RUN microdnf --nodocs install yum \
&& rpm --import https://www.azul.com/files/0xB1998361219BD9C9.txt \
&& yum --nodocs -y install https://cdn.azul.com/zulu/bin/zulu-repo-1.0.0-1.noarch.rpm \
&& yum --nodocs update -y \
&& yum --nodocs install -y --setopt=install_weak_deps=False \
git \
"openssl${OPENSSL_VERSION}" \
"wget${WGET_VERSION}" \
"nmap-ncat${NETCAT_VERSION}" \
"python39${PYTHON39_VERSION}" \
"python39-pip${PYTHON_PIP_VERSION}" \
"tar${TAR_VERSION}" \
"procps-ng${PROCPS_VERSION}" \
"krb5-workstation${KRB5_WORKSTATION_VERSION}" \
"iputils${IPUTILS_VERSION}" \
"hostname${HOSTNAME_VERSION}" \
"xz-libs${XZ_LIBS_VERSION}" \
"glibc${GLIBC_VERSION}" \
"glibc-common${GLIBC_VERSION}" \
"glibc-minimal-langpack${GLIBC_VERSION}" \
"curl${CURL_VERSION}" \
"libcurl${CURL_VERSION}" \
"findutils${FINDUTILS_VERSION}" \
"crypto-policies-scripts${CRYPTO_POLICIES_SCRIPTS_VERSION}" \
"zulu17-ca-jdk-headless${ZULU_OPENJDK_VERSION}" "zulu17-ca-jre-headless${ZULU_OPENJDK_VERSION}" \
&& alternatives --set python /usr/bin/python3 \
&& python3 -m pip install --upgrade "setuptools${PYTHON_SETUPTOOLS_VERSION}" \
&& python3 -m pip install --prefer-binary --prefix=/usr/local --upgrade "${PYTHON_CONFLUENT_DOCKER_UTILS_INSTALL_SPEC}" \
&& yum remove -y git \
&& yum clean all \
&& rm -rf /tmp/* \
&& mkdir -p /etc/confluent/docker /usr/logs \
&& useradd --no-log-init --create-home --shell /bin/bash appuser \
&& chown appuser:appuser -R /etc/confluent/ /usr/logs
# enable FIPS in docker image, this will only work if underlying OS has FIPS enabled as well else is a NO OP.
RUN update-crypto-policies --set FIPS
# This is a step that will cause the build to fail of the package manager detects a package update is availible and isn't installed.
# The ARG SKIP_SECURITY_UPDATE_CHECK is an "escape" hatch if you want to by-pass this check and build the container anyways, which
# is not advisable in terms of security posture. If set to false (which triggers a shell exit(1) if the check fails from the left
# hand of ||) this check will fail. If true (which triggers a right-hand || shell exit(0)), then this check will pass even if a
# security update is availible. We skip checks from ZuluJDK repos because Confluent pins those upstream versions for various reasons
# such as identified bugs in ZuluJDK's software.
ARG SKIP_SECURITY_UPDATE_CHECK="false"
RUN yum --disablerepo="zulu-openjdk" check-update || "${SKIP_SECURITY_UPDATE_CHECK}"
COPY --chown=appuser:appuser target/${ARTIFACT_ID}-${PROJECT_VERSION}-package/share/doc/* /usr/share/doc/${ARTIFACT_ID}/
COPY --chown=appuser:appuser target/${ARTIFACT_ID}-${PROJECT_VERSION}-package/share/java/${ARTIFACT_ID}/* /usr/share/java/${ARTIFACT_ID}/
COPY --chown=appuser:appuser include/etc/confluent/docker /etc/confluent/docker
COPY --chown=appuser:appuser include/etc/cp-base-new /etc/cp-base-new
RUN mkdir /licenses
COPY license.txt /licenses
# Disable setuid/setgid bits
RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
RUN find / -perm /6000 -type f -exec chmod g-s {} \; || true
USER appuser
WORKDIR /home/appuser