-
Notifications
You must be signed in to change notification settings - Fork 71
/
Dockerfile.ubi8
103 lines (75 loc) · 4.21 KB
/
Dockerfile.ubi8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
#---------------------------------------------------------------------
# STAGE 1: Build skopeo inside a temporary container
#---------------------------------------------------------------------
FROM fedora:32 AS skopeo-build
RUN dnf install -y skopeo
#---------------------------------------------------------------------
# STAGE 2: Build credential helpers inside a temporary container
#---------------------------------------------------------------------
FROM golang:alpine AS cred-helpers-build
RUN apk update
RUN apk upgrade
RUN apk --no-cache add git
RUN go install github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login@69c85dc22db6511932bbf119e1a0cc5c90c69a7f
RUN go install github.com/chrismellard/docker-credential-acr-env@fb789970a885098fb386e1d938499d9eb9449821
#---------------------------------------------------------------------
# STAGE 3: Build kubernetes-monitor application
#---------------------------------------------------------------------
FROM node:gallium-alpine AS build
ENV NODE_ENV production
WORKDIR /srv/app
# Add manifest files and install before adding anything else to take advantage of layer caching
ADD package.json package-lock.json ./
RUN npm ci
# add the rest of the app files
ADD . .
# Build typescript
RUN npm run build
#---------------------------------------------------------------------
# STAGE 4: Build the kubernetes-monitor final image
#---------------------------------------------------------------------
FROM registry.access.redhat.com/ubi8/ubi:8.7
LABEL name="Snyk Controller" \
maintainer="support@snyk.io" \
vendor="Snyk Ltd" \
summary="Snyk integration for Kubernetes" \
description="Snyk Controller enables you to import and test your running workloads and identify vulnerabilities in their associated images and configurations that might make those workloads less secure."
COPY LICENSE /licenses/LICENSE
ENV NODE_ENV production
RUN yum upgrade -y
ARG NODE_16_LATEST_VERSION
ARG NODE_16_LATEST_VERSION_TAR_GZ_FILE_SHASUM256
RUN curl --fail -o "/tmp/${NODE_16_LATEST_VERSION}.tar.gz" "https://nodejs.org/dist/latest-v16.x/${NODE_16_LATEST_VERSION}.tar.gz" && \
echo "${NODE_16_LATEST_VERSION_TAR_GZ_FILE_SHASUM256} /tmp/${NODE_16_LATEST_VERSION}.tar.gz" | sha256sum --check --status && \
tar -xf "/tmp/${NODE_16_LATEST_VERSION}.tar.gz" -C "/tmp/" && \
cp "/tmp/${NODE_16_LATEST_VERSION}/bin/node" /usr/local/bin/ && \
rm -rf "/tmp/${NODE_16_LATEST_VERSION}.tar.gz" "/tmp/${NODE_16_LATEST_VERSION}/"
RUN curl -L -o /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_x86_64
RUN chmod 755 /usr/bin/dumb-init
RUN groupadd -g 10001 snyk
RUN useradd -g snyk -d /srv/app -u 10001 snyk
# Install gcloud
RUN yum install -y python3
RUN curl -sL https://sdk.cloud.google.com > /install.sh
RUN bash /install.sh --disable-prompts --install-dir=/ && rm /google-cloud-sdk/bin/anthoscli && rm -rf /google-cloud-sdk/platform
ENV PATH=/google-cloud-sdk/bin:$PATH
RUN rm /install.sh
# Copy credential helpers
COPY --chown=snyk:snyk --from=cred-helpers-build /go/bin/docker-credential-ecr-login /usr/bin/docker-credential-ecr-login
COPY --chown=snyk:snyk --from=cred-helpers-build /go/bin/docker-credential-acr-env /usr/bin/docker-credential-acr-env
WORKDIR /srv/app
COPY --chown=snyk:snyk --from=skopeo-build /usr/bin/skopeo /usr/bin/skopeo
COPY --chown=snyk:snyk --from=skopeo-build /etc/containers/registries.d/default.yaml /etc/containers/registries.d/default.yaml
COPY --chown=snyk:snyk --from=skopeo-build /etc/containers/policy.json /etc/containers/policy.json
# The `.config` directory is used by `snyk protect` and we also mount a K8s volume there at runtime.
# This clashes with OpenShift 3 which mounts things differently and prevents access to the directory.
# TODO: Remove this line once OpenShift 3 comes out of support.
RUN mkdir -p .config
# Copy app
COPY --chown=snyk:snyk --from=build /srv/app /srv/app
# OpenShift 4 doesn't allow dumb-init access the app folder without this permission.
RUN chmod 755 /srv/app && chmod 755 /srv/app/bin && chmod +x /srv/app/bin/start
# This must be in the end for Red Hat Build Service
RUN chown -R snyk:snyk .
USER 10001:10001
ENTRYPOINT ["/usr/bin/dumb-init", "--", "bin/start"]