Merge pull request #358 from razee-io/non-root

Non root

.dockerignore

@@ -1,4 +1,2 @@
 *
 !.build
-!private/scripts
-build-tools/

.yamllint

@@ -0,0 +1,8 @@
+extends: relaxed
+
+rules:
+  line-length:
+    max: 180
+    level: warning
+  empty-lines:
+    max: 1

Dockerfile

@@ -1,26 +1,52 @@
-FROM node:12-alpine
+###############################################################################
+# Copyright 2019 IBM Corp. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+#######################################
+# Build the preliminary image
+#######################################
+FROM node:12-alpine as buildImg
 
-LABEL maintainer="Michael McKay <mckaymic@us.ibm.com>"
+RUN apk update
+RUN apk add python3 make g++
 
-ARG BUILD_ID
-ARG LAST_COMMIT_ID
 
-ENV METEORD_DIR="/opt/meteord" BUILD_PACKAGES="python3 make g++"
+USER node
+WORKDIR /home/node
+
+COPY --chown=node .build/bundle /home/node/app
 
-WORKDIR /root
+RUN cd app/programs/server/ && npm install
 
-COPY ./private/scripts $METEORD_DIR
-COPY .build/bundle /app
+#######################################
+# Build the production image
+#######################################
+FROM node:12-alpine
+LABEL maintainer="Michael McKay <mckaymic@us.ibm.com>"
+
+USER node
+WORKDIR /home/node
+
+ARG BUILD_ID
+ARG LAST_COMMIT_ID
+ENV BUILD_ID="${BUILD_ID}"
+ENV LAST_COMMIT_ID="${LAST_COMMIT_ID}"
+ENV PORT="${PORT:-3000}"
+ENV NODE_ENV="production"
 
-RUN apk update \
-	&& apk add ${BUILD_PACKAGES} \
-	&& mkdir -p /root \
-	&& mkdir -p /app \
-    && $METEORD_DIR/build_app.sh \
-	&& apk del --purge ${BUILD_PACKAGES} \
-    && $METEORD_DIR/clean-final.sh
+RUN mkdir -p /home/node/app
+COPY --chown=node --from=buildImg /home/node /home/node
 
-EXPOSE 3000
-ENV BUILD_ID=${BUILD_ID}
-ENV LAST_COMMIT_ID=${LAST_COMMIT_ID}
-ENTRYPOINT sh $METEORD_DIR/run_app.sh
+EXPOSE "${PORT}"
+CMD ["node", "/home/node/app/main.js"]

build/process-template.sh

@@ -23,6 +23,11 @@ export TRAVIS_COMMIT
 GIT_REMOTE="$(git remote get-url origin)"
 export GIT_REMOTE
 
+NODE_USER_ID="$(docker run -it node:lts-alpine /usr/bin/id -u node | tr -d '\r' | tr -d '\n')"
+export NODE_USER_ID
+NODE_GROUP_ID="$(docker run -it node:lts-alpine /usr/bin/id -g node | tr -d '\r' | tr -d '\n')"
+export NODE_GROUP_ID
+
 envsubst <"${THIS_DIR}/viewTemplate.json" >/tmp/view.json
 
 npx mustache /tmp/view.json "${FILE}"

build/viewTemplate.json

@@ -1,5 +1,7 @@
 {
   "TRAVIS_COMMIT": "${TRAVIS_COMMIT}",
   "TRAVIS_TAG": "${TRAVIS_TAG}",
-  "GIT_REMOTE": "${GIT_REMOTE}"
+  "GIT_REMOTE": "${GIT_REMOTE}",
+  "NODE_USER_ID": "${NODE_USER_ID}",
+  "NODE_GROUP_ID": "${NODE_GROUP_ID}"
 }

kubernetes/razeedash/resource.yaml

@@ -37,85 +37,85 @@ items:
             fsGroup: 999
             runAsUser: 999
           containers:
-          - env:
-            - name: MONGO_URL
-              valueFrom:
-                secretKeyRef:
-                  name: razeedash-secret
-                  key: mongo_url
-            - name: MONGO_OPTIONS
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: mongo_options
-                  optional: true
-            - name: OAUTH_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: razeedash-secret
-                  key: oauth_secret_key
-                  optional: true
-            - name: BITBUCKET_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: bitbucket_url
-                  optional: true
-            - name: BITBUCKET_API
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: bitbucket_api
-                  optional: true
-            - name: MAIL_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: mail_url
-                  optional: true
-            - name: ROOT_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: root_url
-            - name: RAZEEDASH_API_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: razeedash_api_url
-            - name: LOGIN_TYPE
-              valueFrom:
-                configMapKeyRef:
-                  name: razeedash-config
-                  key: login_type
-                  optional: true
-            - name: app_name
-              value: Razeedash
-            image: "quay.io/razee/razeedash:{{TRAVIS_TAG}}"
-            workingDir: /app
-            imagePullPolicy: Always
-            name: razeedash
-            ports:
-            - containerPort: 3000
-              protocol: TCP
-            livenessProbe:
-              httpGet:
-                path: /login
-                port: 3000
-              initialDelaySeconds: 3
-              periodSeconds: 20
-              timeoutSeconds: 5
-              failureThreshold: 2
-            readinessProbe:
-              httpGet:
-                path: /login
-                port: 3000
-              initialDelaySeconds: 3
-              periodSeconds: 20
-            resources:
-              requests:
-                cpu: 100m
-                memory: 80Mi
-              limits:
-                cpu: 500m
-                memory: 256Mi
+            - env:
+                - name: MONGO_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: razeedash-secret
+                      key: mongo_url
+                - name: MONGO_OPTIONS
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: mongo_options
+                      optional: true
+                - name: OAUTH_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: razeedash-secret
+                      key: oauth_secret_key
+                      optional: true
+                - name: BITBUCKET_URL
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: bitbucket_url
+                      optional: true
+                - name: BITBUCKET_API
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: bitbucket_api
+                      optional: true
+                - name: MAIL_URL
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: mail_url
+                      optional: true
+                - name: ROOT_URL
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: root_url
+                - name: RAZEEDASH_API_URL
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: razeedash_api_url
+                - name: LOGIN_TYPE
+                  valueFrom:
+                    configMapKeyRef:
+                      name: razeedash-config
+                      key: login_type
+                      optional: true
+                - name: app_name
+                  value: Razeedash
+              image: "quay.io/razee/razeedash:{{TRAVIS_TAG}}"
+              workingDir: /app
+              imagePullPolicy: Always
+              name: razeedash
+              ports:
+                - containerPort: 3000
+                  protocol: TCP
+              livenessProbe:
+                httpGet:
+                  path: /login
+                  port: 3000
+                initialDelaySeconds: 3
+                periodSeconds: 20
+                timeoutSeconds: 5
+                failureThreshold: 2
+              readinessProbe:
+                httpGet:
+                  path: /login
+                  port: 3000
+                initialDelaySeconds: 3
+                periodSeconds: 20
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 80Mi
+                limits:
+                  cpu: 500m
+                  memory: 256Mi