Skip to content

[miniconda] Refactor Dockerfile to sync with anaconda devcontianer #741

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 11, 2023
Merged

[miniconda] Refactor Dockerfile to sync with anaconda devcontianer #741

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b2f2d91
Rework Dockerfile
alexander-smolyakov Sep 11, 2023
f17c4ee
Enable tests
alexander-smolyakov Sep 11, 2023
1891f7e
Merge remote-tracking branch 'upstream/main' into miniconda-refactor_…
alexander-smolyakov Sep 11, 2023
44a51cf
Bump `base` image version
alexander-smolyakov Sep 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 21 additions & 20 deletions src/miniconda/.devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,30 @@
FROM continuumio/miniconda3 as upstream

# Temporary: Upgrade python packages due to mentioned CVEs
# They are installed by the base image (continuumio/miniconda3) which does not have the patch.
RUN conda install \
# https://github.com/pyca/cryptography/security/advisories/GHSA-5cpq-8wj7-hf2v
pyopenssl=23.2.0 \
cryptography=41.0.2 \
# https://github.com/advisories/GHSA-j8r2-6x86-q33q
requests=2.31.0

# Reset and copy updated files with updated privs to keep image size down
FROM mcr.microsoft.com/devcontainers/base:0-bullseye

ARG USERNAME=vscode

# Create the conda group and add remote user to the group
RUN groupadd -r conda --gid 900 \
&& usermod -aG conda ${USERNAME}

# Copy opt folder, set ownership and group permissions
COPY --chown=:conda --chmod=775 --from=upstream /opt/conda /opt/conda
RUN chmod =2775 /opt/conda

USER root
COPY --from=upstream /opt /opt/

# Copy scripts to execute
COPY add-notice.sh /tmp/library-scripts/

# Setup conda to mirror contents from https://github.com/ContinuumIO/docker-images/blob/master/miniconda3/debian/Dockerfile
Expand Down Expand Up @@ -39,25 +59,6 @@ COPY environment.yml* noop.txt /tmp/conda-tmp/
RUN if [ -f "/tmp/conda-tmp/environment.yml" ]; then umask 0002 && /opt/conda/bin/conda env update -n base -f /tmp/conda-tmp/environment.yml; fi \
&& rm -rf /tmp/conda-tmp

# Temporary: Upgrade python packages due to mentioned CVEs
# They are installed by the base image (continuumio/miniconda3) which does not have the patch.
RUN conda install \
# https://github.com/pyca/cryptography/security/advisories/GHSA-5cpq-8wj7-hf2v
pyopenssl=23.2.0 \
# cryptography=41.0.2 # Disabled temporarily due to issue with conda \
# https://github.com/advisories/GHSA-j8r2-6x86-q33q
requests=2.31.0

# [Optional] Uncomment this section to install additional OS packages.
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
# && apt-get -y install --no-install-recommends <your-package-list-here>

# Create conda group, update conda directory permissions,
# add user to conda group
# Note: We need to execute these commands after pip install / conda update
# since pip doesn't preserve directory permissions
RUN groupadd -r conda --gid 900 \
&& chown -R :conda /opt/conda \
&& chmod -R g+w /opt/conda \
&& find /opt -type d | xargs -n 1 chmod g+s \
&& usermod -aG conda ${USERNAME}
4 changes: 2 additions & 2 deletions src/miniconda/test-project/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont

check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"

# checkPythonPackageVersion "cryptography" "41.0.0" # Disabled temporarily due to issue with conda
checkPythonPackageVersion "cryptography" "41.0.0"
checkPythonPackageVersion "setuptools" "65.5.1"
checkPythonPackageVersion "wheel" "0.38.1"

# checkCondaPackageVersion "cryptography" "41.0.0" # Disabled temporarily due to issue with conda
checkCondaPackageVersion "cryptography" "41.0.0"
checkCondaPackageVersion "pyopenssl" "23.2.0"
checkCondaPackageVersion "setuptools" "65.5.1"
checkCondaPackageVersion "wheel" "0.38.1"
Expand Down