Add API-Firewall official image #11100

afr1ka · 2021-10-13T18:34:43Z

Hello,

We would like to add the API-Firewall to the official image repository.

Thanks.

Checklist for Review

NOTE: This checklist is intended for the use of the Official Images maintainers both to track the status of your PR and to help inform you and others of where we're at. As such, please leave the "checking" of items to the repository maintainers. If there is a point below for which you would like to provide additional information or note completion, please do so by commenting on the PR. Thanks! (and thanks for staying patient with us ❤️)

d0znpp

reviewed

d0znpp · 2021-11-04T15:56:44Z

does it fit into one of the common categories? ("service", "language stack", "base distribution") - base distribution
is it reasonably popular, or does it solve a particular use case well? - API firewall have 500M+ docker pulls already, according to the docker hub stats https://hub.docker.com/r/wallarm/api-firewall
passes current tests? any simple new tests that might be appropriate to add? (https://github.com/docker-library/official-images/tree/master/test) - all the tests passed
existing official images have been considered as a base? (ie, if foobar needs Node.js, has FROM node:... instead of grabbing node via other means been considered?) - yes, it's based on an alpine:3.14

afr1ka · 2021-11-04T16:16:25Z

Documentation PR at docker-library/docs#2074

d0znpp · 2021-11-11T20:25:12Z

Hi Docker team!

Could you please advise us on how to meet this requirement?

official-images maintainer dockerization review for best practices and cache gotchas/improvements (ala the official review guidelines)?

d0znpp · 2021-11-15T20:33:00Z

@tianon, could you please have a look?

d0znpp · 2021-12-08T21:29:59Z

API firewall got 1B (!!!) docker pulls. But it's not an official image yet.

tianon · 2021-12-08T21:51:45Z

Sorry for the delay 😩 🙇

I guess my first question is whether API Firewall is free/open source software (https://github.com/docker-library/official-images#what-are-official-images)?

From what I can tell/find, it appears to be freely available, but not open source?

d0znpp · 2021-12-08T21:54:51Z

Hi Tianon, Thank you for your response! API firewall is completely free software and we have a plan to release it as an open-source next year.

…

On Wed, Dec 8, 2021 at 1:51 PM Tianon Gravi ***@***.***> wrote: Sorry for the delay 😩 🙇 I guess my first question is whether API Firewall is free/open source software ( https://github.com/docker-library/official-images#what-are-official-images )? From what I can tell/find, it appears to be freely available, but not open source? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#11100 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB5MMRV5VTK563T2MLMVEB3UP7HPZANCNFSM5F53IEVQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- Ivan Novikov Wallarm, CEO +1.650.454.9339

d0znpp · 2022-01-06T23:32:11Z

Happy New Year! Our pull request survived through 3 seasons on a Planet Earth in 3 months already.

tianon · 2022-01-06T23:44:16Z

Indeed, apologies 🙇

Unfortunately, we've had to enforce a harder line on the Open Source qualification than we've done in the past, so in its current form, I don't think API Firewall is something we can accept in this program, but I think we should revisit as soon as you've got it open sourced!

d0znpp · 2022-01-06T23:48:07Z

Does it mean that you will drop all the previously approved images from the registry?

tianon · 2022-01-07T00:17:12Z

To be clear, I'm only talking about images that are part of the "Official Images" program, ala images accepted into https://github.com/docker-library/official-images -- this does not apply to images on Docker Hub at large. For existing images which have been accepted here already which don't meet that requirement (of which there are only a handful), that's going to be a conversation between the image maintainers and Docker Inc (and unfortunately I can't comment much further than that on those).

d0znpp · 2022-01-07T03:41:51Z

But it was not there when we applied this request. It technically means that we are in the same position as other non-OSS projects approved before. We spent a lot of time on this project to drop the ball now after 3 months of the review.

d0znpp · 2022-01-24T17:11:24Z

@tianon we released the API firewall to OSS completely https://github.com/wallarm/api-firewall. Please proceed with the official repository.

d0znpp · 2022-01-27T17:36:10Z

@tianon please check our project. The PR became huge after releasing the source code and we fixed it by moving from Docker file to docker-entrypoint.sh

The pipeline should be good now, please recheck manually.

tianon · 2022-01-27T17:41:53Z

Unfortunately having the Dockerfile in the root of the upstream repository (while useful for local development) doesn't work well as the target for official-images. Since the Dockerfile uses COPY . ..., it essentially means the entire upstream source code is now part of the Docker build context, and thus becomes part of the reviewed artifacts (see diff-pr.sh for how we generate our diff; it is basically taking all docker build contexts from the starting library/foo file and diffing them to the new contexts from the PR).

What we suggest instead is creating a separate repository to hold the "packaging", especially since you might have, for example, changes to make to the Dockerfile in between upstream releases of the software.

d0znpp · 2022-01-27T17:44:26Z

Do you have any examples of such projects with separate repositories for packaging?

tianon · 2022-01-28T18:02:17Z

I would suggest that golang is probably an example whose Dockerfile is going to be reasonably similar to what you'll want here -- it appears that the API Firewall project publishes official binaries for a variety of architectures, so I would suggest that the Dockerfile for consuming it should be a reasonably straightforward one.

Conceptually, I would expect to see something like, FROM some-base, RUN detect-arch ("dpkg --print-architecture" or "apk --print-arch" are useful utilities for detecting the userspace architecture) + download appropriate release artifact + verify with some Dockerfile-embedded checksum like sha256 + install in appropriate place within the image + CMD ["some-reasonable-default"].

If you want an example that's similar but much simpler than the golang example, you might look at julia:
https://github.com/docker-library/julia/blob/fe407643a5e54f54063d8d67d487cf7997ded40f/1.7/bullseye/Dockerfile

d0znpp · 2022-01-28T18:11:49Z

I would suggest that golang is probably an example whose Dockerfile is going to be reasonably similar to what you'll want here -- it appears that the API Firewall project publishes official binaries for a variety of architectures, so I would suggest that the Dockerfile for consuming it should be a reasonably straightforward one.

Conceptually, I would expect to see something like, FROM some-base, RUN detect-arch ("dpkg --print-architecture" or "apk --print-arch" are useful utilities for detecting the userspace architecture) + download appropriate release artifact + verify with some Dockerfile-embedded checksum like sha256 + install in appropriate place within the image + CMD ["some-reasonable-default"].

If you want an example that's similar but much simpler than the golang example, you might look at julia: https://github.com/docker-library/julia/blob/fe407643a5e54f54063d8d67d487cf7997ded40f/1.7/bullseye/Dockerfile

Thank you! It seems like we got it.

d0znpp · 2022-01-31T16:13:14Z

@tianon we passed all the checks. Please approve pull request

tianon · 2022-02-01T01:32:08Z

Thanks for the update! Overall, this looks much better, and is really close. I've got two very minor comments -- the first is just a suggestion for improvement, but the second is something that'll need to be fixed before we merge:

+ENV APIFIREWALL_VERSION v0.6.7
+
+ENV APIFW_PATH /opt/api-firewall
+ENV PATH $APIFW_PATH:$PATH
+
+RUN set -eux; \
+    adduser -u 1000 -H -h /opt -D -s /bin/sh api-firewall

I would suggest swapping these for better utilization of the Docker build cache, ala:

ENV APIFW_PATH /opt/api-firewall
ENV PATH $APIFW_PATH:$PATH

RUN set -eux; \
    adduser -u 1000 -H -h /opt -D -s /bin/sh api-firewall

ENV APIFIREWALL_VERSION v0.6.7

+# smoke test
+    api-firewall -v
+
+COPY docker-entrypoint.sh $APIFW_PATH/
+
+RUN chmod 755 $APIFW_PATH/api-firewall; \
+    chmod 755 $APIFW_PATH/docker-entrypoint.sh

The api-firewall -v smoke test already verifies that the api-firewall binary itself is executable, so I don't think that chmod is actually necessary, but if it is, it should be up in the layer which added said api-firewall binary (otherwise it'll create a copy of that binary in the lower layer, just to change the permissions).

The other half of this (docker-entrypoint.sh) I would suggest fixing by setting the executable bit on docker-entrypoint.sh in Git instead so that COPY includes it natively. If you need a PR for this (due to being on Windows or something where doing chmod +x in Git is difficult to accomplish appropriately), I'm happy to open one. 👍

tianon · 2022-02-01T01:34:16Z

Oh! Just noticed one more (only suggestion) item that's worth considering:

+if [ "$1" = 'api-firewall' ]; then
+	shift # "api-firewall"
+	set -- api-firewall "$@"
+fi

This entire if block amounts to "if the arguments start with api-firewall, remove it, then add it back", so I think the whole block could just be removed entirely. 😄

(Again, happy to send a PR with all of these suggestions if that's helpful.)

afr1ka · 2022-02-01T03:32:43Z

@tianon thank you for the suggestions. We have updated docs and docker repos.

github-actions · 2022-02-01T03:45:56Z

Diff for 4cdfb34:

diff --git a/_bashbrew-cat b/_bashbrew-cat
index bdfae4a..300e853 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -1 +1,8 @@
-Maintainers: New Image! :D (@docker-library-bot)
+Maintainers: Ivan Novikov <in@wallarm.com> (@d0znpp), Nikolay Tkachenko (@afr1ka)
+GitRepo: https://github.com/wallarm/api-firewall-docker.git
+
+Tags: 0.6.7, latest
+Architectures: amd64, arm64v8, i386
+GitFetch: refs/heads/main
+GitCommit: 5cd07f115f16d10095a385a73568a4e60caf278b
+Directory: 0.6.7
diff --git a/_bashbrew-list b/_bashbrew-list
index e69de29..93f9600 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -0,0 +1,2 @@
+api-firewall:0.6.7
+api-firewall:latest
diff --git a/api-firewall_latest/Dockerfile b/api-firewall_latest/Dockerfile
new file mode 100644
index 0000000..db8e014
--- /dev/null
+++ b/api-firewall_latest/Dockerfile
@@ -0,0 +1,51 @@
+FROM alpine:3.15
+
+ENV APIFW_PATH /opt/api-firewall
+ENV PATH $APIFW_PATH:$PATH
+
+RUN set -eux; \
+    adduser -u 1000 -H -h /opt -D -s /bin/sh api-firewall
+
+ENV APIFIREWALL_VERSION v0.6.7
+
+RUN set -eux; \
+    \
+    apk add --no-cache wget; \
+    \
+    arch="$(apk --print-arch)"; \
+    case "$arch" in \
+        'x86_64') \
+            url="https://github.com/wallarm/api-firewall/releases/download/${APIFIREWALL_VERSION}/api-firewall-amd64-musl.tar.gz"; \
+            sha256='fb61a3ca620340a76f97856ec30190de8422535c31d17ddc89019e87825d60b9'; \
+            ;; \
+        'aarch64') \
+            url="https://github.com/wallarm/api-firewall/releases/download/${APIFIREWALL_VERSION}/api-firewall-arm64-musl.tar.gz"; \
+            sha256='cdcd6679536e3e0fa0d5cdd8f422ef58f31f65c2d279228150c269c32641dd1d'; \
+            ;; \
+        'x86') \
+            url="https://github.com/wallarm/api-firewall/releases/download/${APIFIREWALL_VERSION}/api-firewall-386-musl.tar.gz"; \
+            sha256='0850d87b52624085265554605f46df5cda2a006d7b9dc9a7d369cdb9c9c88305'; \
+            ;; \
+        *) \
+            echo >&2 "error: current architecture ($arch) does not have a corresponding API-Firewall binary release"; \
+            exit 1; \
+            ;; \
+    esac; \
+    \
+    wget -O api-firewall.tar.gz "$url"; \
+    echo "$sha256 *api-firewall.tar.gz" | sha256sum -c; \
+    \
+    mkdir -p "$APIFW_PATH"; \
+    tar -xzf api-firewall.tar.gz -C "$APIFW_PATH" --strip-components 1; \
+    rm api-firewall.tar.gz; \
+    \
+    chmod 755 $APIFW_PATH/api-firewall; \
+    \
+# smoke test
+    api-firewall -v
+
+COPY docker-entrypoint.sh $APIFW_PATH/
+
+USER api-firewall
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["api-firewall"]
diff --git a/api-firewall_latest/docker-entrypoint.sh b/api-firewall_latest/docker-entrypoint.sh
new file mode 100755
index 0000000..9e57b4b
--- /dev/null
+++ b/api-firewall_latest/docker-entrypoint.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+# this if will check if the first argument is a flag
+# but only works if all arguments require a hyphenated flag
+# -v; -SL; -f arg; etc will work, but not arg1 arg2
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- api-firewall "$@"
+fi
+
+exec "$@"

d0znpp · 2022-02-03T17:56:16Z

Hello @tianon , can you please advise us on what to do with the initial repository https://hub.docker.com/r/wallarm/api-firewall? Should we close it? How to move stats from there to an official one?

tianon · 2022-02-04T23:37:03Z

Regarding whether to close it -- that's up to you. Generally, we suggest that you add some kind of deprecation notice to it and maybe even update it with a copy of the built official image copy for a short time so that users can have some kind of transition period, but even that's up to you. Some maintainers like to use a repository like that for pre-releases or for letting users test changes before they push them into the official image.

Regarding the stats, unfortunately that's not something we have access to / visibility of / control over. If you already have a contact at Docker Inc, I'd suggest asking them whether copying the stats is possible (I think other maintainers have tried in the past and there were technical limitations to doing so, but I might be misremembering or that might no longer be the case).

Add API-Firewall official image

4022650

github-actions bot added new-image library/api-firewall labels Oct 13, 2021

Nikolay Tkachenko added 2 commits October 14, 2021 01:55

Update GitCommit

3aecbeb

Update GitCommit and GitFetch

8ba9ec0

d0znpp approved these changes Oct 14, 2021

View reviewed changes

afr1ka mentioned this pull request Nov 4, 2021

Add api-firewall image docs docker-library/docs#2074

Merged

Nikolay Tkachenko and others added 5 commits January 25, 2022 10:36

Update GitCommit and Tags

b507a85

Update api-firewall

875a4d7

Update api-firewall

fbe6f19

Update api-firewall

d7e5ab8

Update api-firewall

be31137

Update api-firewall

bf601ba

Update api-firewall

6ec499c

Update api-firewall

4cdfb34

This comment has been minimized.

Sign in to view

tianon approved these changes Feb 2, 2022

View reviewed changes

yosifkit merged commit c8e11dc into docker-library:master Feb 2, 2022

kikito mentioned this pull request Mar 1, 2022

bump Kong to 2.8.0 #11955

Closed

sampaiodiego mentioned this pull request Mar 31, 2022

Update rocket.chat #12160

Merged

This was referenced Apr 11, 2022

Question on base images #11705

Closed

improve documentation #6282

Open

yosifkit mentioned this pull request Feb 11, 2023

[RFC] Added Unit as an official Library image #11542

Merged

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add API-Firewall official image #11100

Add API-Firewall official image #11100

afr1ka commented Oct 13, 2021 •

edited by yosifkit

Loading

d0znpp left a comment

d0znpp commented Nov 4, 2021 •

edited

Loading

afr1ka commented Nov 4, 2021

d0znpp commented Nov 11, 2021 •

edited

Loading

d0znpp commented Nov 15, 2021

d0znpp commented Dec 8, 2021

tianon commented Dec 8, 2021

d0znpp commented Dec 8, 2021 via email

d0znpp commented Jan 6, 2022

tianon commented Jan 6, 2022

d0znpp commented Jan 6, 2022

tianon commented Jan 7, 2022

d0znpp commented Jan 7, 2022

d0znpp commented Jan 24, 2022

d0znpp commented Jan 27, 2022

tianon commented Jan 27, 2022

d0znpp commented Jan 27, 2022

tianon commented Jan 28, 2022

d0znpp commented Jan 28, 2022

d0znpp commented Jan 31, 2022

tianon commented Feb 1, 2022

tianon commented Feb 1, 2022

afr1ka commented Feb 1, 2022

github-actions bot commented Feb 1, 2022

This comment has been minimized.

d0znpp commented Feb 3, 2022

tianon commented Feb 4, 2022

Add API-Firewall official image #11100

Add API-Firewall official image #11100

Conversation

afr1ka commented Oct 13, 2021 • edited by yosifkit Loading

Checklist for Review

d0znpp left a comment

Choose a reason for hiding this comment

d0znpp commented Nov 4, 2021 • edited Loading

afr1ka commented Nov 4, 2021

d0znpp commented Nov 11, 2021 • edited Loading

d0znpp commented Nov 15, 2021

d0znpp commented Dec 8, 2021

tianon commented Dec 8, 2021

d0znpp commented Dec 8, 2021 via email

d0znpp commented Jan 6, 2022

tianon commented Jan 6, 2022

d0znpp commented Jan 6, 2022

tianon commented Jan 7, 2022

d0znpp commented Jan 7, 2022

d0znpp commented Jan 24, 2022

d0znpp commented Jan 27, 2022

tianon commented Jan 27, 2022

d0znpp commented Jan 27, 2022

tianon commented Jan 28, 2022

d0znpp commented Jan 28, 2022

d0znpp commented Jan 31, 2022

tianon commented Feb 1, 2022

tianon commented Feb 1, 2022

afr1ka commented Feb 1, 2022

github-actions bot commented Feb 1, 2022

This comment has been minimized.

d0znpp commented Feb 3, 2022

tianon commented Feb 4, 2022

afr1ka commented Oct 13, 2021 •

edited by yosifkit

Loading

d0znpp commented Nov 4, 2021 •

edited

Loading

d0znpp commented Nov 11, 2021 •

edited

Loading