Skip to content

Docker security upgrades #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
codeadict wants to merge 3 commits into from
Closed

Docker security upgrades #44

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7539c31
Update dockerfile for security upgrades
codeadict Jan 22, 2025
91b644f
Use wget to download deps
codeadict Jan 22, 2025
054bdc4
Merge branch 'main' into codeadict/docker_security_upgrades
codeadict Jan 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 21 additions & 14 deletions infra/sidecar.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,32 +1,39 @@
# ----- Builder image
FROM golang:1.21.6-bookworm AS builder
ARG GOLANG_VERSION=1.21.13
FROM golang:${GOLANG_VERSION}-bookworm AS builder

ARG FIPS_MODE
ARG COMMIT_SHA

RUN apt update -y
RUN apt install -y build-essential ca-certificates python3 git socat
RUN DEBIAN_FRONTEND=noninteractive \
apt-get update && \
apt-get install --no-install-recommends -y \
build-essential ca-certificates python3 git socat

WORKDIR /splitd
COPY . .

RUN export GITHUB_SHA="${COMMIT_SHA}" && bash -c '\
if [[ "${FIPS_MODE}" = "enabled" ]]; \
then echo "building in fips mode"; make clean splitd-fips splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; mv splitd-fips splitd; \
else echo "building in standard mode"; make clean splitd splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; \
fi'
if [[ "${FIPS_MODE}" = "enabled" ]]; \
then echo "building in fips mode"; make clean splitd-fips splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; mv splitd-fips splitd; \
else echo "building in standard mode"; make clean splitd splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; \
fi'

# ----- Runner image
FROM debian:12.4 AS runner
FROM debian:bookworm-20250113-slim AS runner

RUN apt update -y
RUN apt install -y bash ca-certificates wget socat
ARG YQ_VERSION=v4.44.6

RUN wget https://github.com/mikefarah/yq/releases/download/v4.40.5/yq_linux_amd64
RUN chmod +x yq_linux_amd64
RUN mv yq_linux_amd64 /usr/local/bin/yq
RUN DEBIAN_FRONTEND=noninteractive \
apt-get update && \
apt-get install --no-install-recommends -y \
bash ca-certificates wget socat && \
wget -O /usr/local/bin/yq \
"https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" && \
chmod +x /usr/local/bin/yq && \
mkdir -p /opt/splitd && \
rm -rf /var/lib/apt/lists/*

RUN mkdir -p /opt/splitd
COPY --from=builder /splitd/splitd /opt/splitd
COPY --from=builder /splitd/splitd.yaml.tpl /opt/splitd
COPY infra/entrypoint.sh /opt/splitd
Expand Down