Dockerfile.ubi8

#
# Copyright 2017 Confluent Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
ARG UBI_MINIMAL_VERSION="latest"
FROM registry.access.redhat.com/ubi8/ubi-minimal:${UBI_MINIMAL_VERSION}

ARG PROJECT_VERSION
ARG ARTIFACT_ID

# Remember where we came from
LABEL io.confluent.docker.git.repo="confluentinc/common-docker"

ARG GIT_COMMIT
LABEL io.confluent.docker.git.id=$GIT_COMMIT

ARG BUILD_NUMBER=-1
LABEL io.confluent.docker.build.number=$BUILD_NUMBER

LABEL maintainer="tools@confluent.io"
LABEL vendor="Confluent"
LABEL version=$GIT_COMMIT
LABEL release=$PROJECT_VERSION
LABEL name=$ARTIFACT_ID
LABEL summary="Common base image for Confluent's Docker images."
LABEL description="Common base image for Confluent's Docker images."
LABEL io.confluent.docker=true

# This affects how strings in Java class files are interpreted.  We want UTF-8 and this is the only locale in the
# base image that supports it
ENV LANG="C.UTF-8"

# Set the classpath for JARs required by `cub`
ENV CUB_CLASSPATH='"/usr/share/java/cp-base-new/*"'

# These ARGs are left blank indicating to the Dnf package manager to install the latest package
# version that happens to be availible at this time. For reproducible builds, versions should be specified
# as '-1.2.3-4.el8' on the command line. Or more preferibly the 'dockerfile-maven-plugin' is used
# where these arguments are set in base/pom.xml under the <buildArgs> elements based on the commit you're
# building from.

# Redhat Package Versions
ARG OPENSSL_VERSION=""
ARG WGET_VERSION=""
ARG NETCAT_VERSION=""
ARG PYTHON39_VERSION=""
ARG TAR_VERSION=""
ARG PROCPS_VERSION=""
ARG KRB5_WORKSTATION_VERSION=""
ARG IPUTILS_VERSION=""
ARG HOSTNAME_VERSION=""
ARG XZ_LIBS_VERSION=""
ARG GLIBC_VERSION=""
ARG CURL_VERSION=""

# Zulu OpenJDK version
ARG ZULU_OPENJDK_VERSION=""

# Python Module Versions
ARG PYTHON_PIP_VERSION=""
ARG PYTHON_SETUPTOOLS_VERSION=""

# Confluent Docker Utils Version (Namely the tag or branch to grab from git to install)
ARG PYTHON_CONFLUENT_DOCKER_UTILS_VERSION="master"

# This can be overriden for an offline/air-gapped builds
ARG PYTHON_CONFLUENT_DOCKER_UTILS_INSTALL_SPEC="git+https://github.com/confluentinc/confluent-docker-utils@${PYTHON_CONFLUENT_DOCKER_UTILS_VERSION}"

RUN microdnf --nodocs install yum \
    && rpm --import https://www.azul.com/files/0xB1998361219BD9C9.txt \
    && yum --nodocs -y install https://cdn.azul.com/zulu/bin/zulu-repo-1.0.0-1.noarch.rpm \
    && yum --nodocs update -y \
    && yum --nodocs install -y --setopt=install_weak_deps=False \
        git \
        "openssl${OPENSSL_VERSION}" \
        "wget${WGET_VERSION}" \
        "nmap-ncat${NETCAT_VERSION}" \
        "python39${PYTHON39_VERSION}" \
        "python39-pip${PYTHON_PIP_VERSION}" \
        "tar${TAR_VERSION}" \
        "procps-ng${PROCPS_VERSION}" \
        "krb5-workstation${KRB5_WORKSTATION_VERSION}" \
        "iputils${IPUTILS_VERSION}" \
        "hostname${HOSTNAME_VERSION}" \
        "xz-libs${XZ_LIBS_VERSION}" \
        "glibc${GLIBC_VERSION}" \
        "glibc-common${GLIBC_VERSION}" \
        "glibc-minimal-langpack${GLIBC_VERSION}" \
        "curl${CURL_VERSION}" \
        "libcurl${CURL_VERSION}" \
        "findutils${FINDUTILS_VERSION}" \
        "crypto-policies-scripts${CRYPTO_POLICIES_SCRIPTS_VERSION}" \
        "zulu17-ca-jdk-headless${ZULU_OPENJDK_VERSION}" "zulu17-ca-jre-headless${ZULU_OPENJDK_VERSION}" \
    && alternatives --set python /usr/bin/python3 \
    && python3 -m pip install --upgrade "setuptools${PYTHON_SETUPTOOLS_VERSION}" \
    && python3 -m pip install --prefer-binary --prefix=/usr/local --upgrade "${PYTHON_CONFLUENT_DOCKER_UTILS_INSTALL_SPEC}" \
    && yum remove -y git \
    && yum clean all \
    && rm -rf /tmp/* \
    && mkdir -p /etc/confluent/docker /usr/logs \
    && useradd --no-log-init --create-home --shell /bin/bash appuser \
    && chown appuser:appuser -R /etc/confluent/ /usr/logs

# enable FIPS in docker image, this will only work if underlying OS has FIPS enabled as well else is a NO OP.
RUN update-crypto-policies --set FIPS

# This is a step that will cause the build to fail of the package manager detects a package update is availible and isn't installed.
# The ARG SKIP_SECURITY_UPDATE_CHECK is an "escape" hatch if you want to by-pass this check and build the container anyways, which
# is not advisable in terms of security posture. If set to false (which triggers a shell exit(1) if the check fails from the left
# hand of ||) this check will fail. If true (which triggers a right-hand || shell exit(0)), then this check will pass even if a
# security update is availible. We skip checks from ZuluJDK repos because Confluent pins those upstream versions for various reasons 
# such as identified bugs in ZuluJDK's software.
ARG SKIP_SECURITY_UPDATE_CHECK="false"
RUN yum --disablerepo="zulu-openjdk" check-update || "${SKIP_SECURITY_UPDATE_CHECK}"

COPY --chown=appuser:appuser target/${ARTIFACT_ID}-${PROJECT_VERSION}-package/share/doc/* /usr/share/doc/${ARTIFACT_ID}/
COPY --chown=appuser:appuser target/${ARTIFACT_ID}-${PROJECT_VERSION}-package/share/java/${ARTIFACT_ID}/* /usr/share/java/${ARTIFACT_ID}/

COPY --chown=appuser:appuser include/etc/confluent/docker /etc/confluent/docker
COPY --chown=appuser:appuser include/etc/cp-base-new /etc/cp-base-new

RUN mkdir /licenses
COPY license.txt /licenses

# Disable setuid/setgid bits
RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
RUN find / -perm /6000 -type f -exec chmod g-s {} \; || true

USER appuser
WORKDIR /home/appuser