forked from hashicorp/waypoint
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile
117 lines (93 loc) · 4.12 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# syntax = docker.mirror.hashicorp.services/docker/dockerfile:experimental
#--------------------------------------------------------------------
# builder builds the Waypoint binaries
#--------------------------------------------------------------------
FROM docker.mirror.hashicorp.services/golang:1.16.5-alpine3.13 AS builder
RUN apk add --no-cache git gcc libc-dev make
RUN mkdir -p /tmp/wp-prime
COPY go.sum /tmp/wp-prime
COPY go.mod /tmp/wp-prime
WORKDIR /tmp/wp-prime
RUN go mod download
RUN go get github.com/kevinburke/go-bindata/...
COPY . /tmp/wp-src
WORKDIR /tmp/wp-src
RUN --mount=type=cache,target=/root/.cache/go-build make bin
RUN --mount=type=cache,target=/root/.cache/go-build make bin/entrypoint
#--------------------------------------------------------------------
# imgbase builds the "img" tool and all of its dependencies
#--------------------------------------------------------------------
# We build a fork of img for now so we can get the `img inspect` CLI
#
# These PRs were required for us:
# - https://github.com/genuinetools/img/pull/324
# - https://github.com/genuinetools/img/pull/326
#
# We are now waiting on the img maintainers to do a new release of 'img' that
# includes these fixes before we can delete this and install img directly.
FROM docker.mirror.hashicorp.services/golang:1.16.5-alpine3.13 AS imgbuilder
RUN apk add --no-cache \
bash \
build-base \
gcc \
git \
libseccomp-dev \
linux-headers \
make
RUN git clone https://github.com/mitchellh/img.git /img
WORKDIR /img
RUN go get github.com/go-bindata/go-bindata/go-bindata
RUN make BUILDTAGS="seccomp noembed dfrunmount dfsecrets dfssh" && mv img /usr/bin/img
# Copied from img repo, see notes for specific reasons:
# https://github.com/genuinetools/img/blob/d858ac71f93cc5084edd2ba2d425b90234cf2ead/Dockerfile
FROM docker.mirror.hashicorp.services/alpine:3.13.5 AS imgbase
RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev \
gcc git libcap-dev libtool libxslt runc
RUN git clone https://github.com/shadow-maint/shadow.git /shadow
WORKDIR /shadow
RUN git checkout 59c2dabb264ef7b3137f5edb52c0b31d5af0cf76
RUN ./autogen.sh --disable-nls --disable-man --without-audit \
--without-selinux --without-acl --without-attr --without-tcb \
--without-nscd \
&& make \
&& cp src/newuidmap src/newgidmap /usr/bin
#--------------------------------------------------------------------
# final image
#--------------------------------------------------------------------
# Notes on img and what is required to make it work, since there's a lot
# of small details below that are absolutely required for everything to
# come together:
#
# - img, runc, newuidmap, newgidmap need to be installed
# - libseccomp-dev must be installed for runc
# - newuidmap/newgidmap need to have suid set (u+s)
# - /etc/subuid and /etc/subgid need to have an entry for the user
# - USER, HOME, and XDG_RUNTIME_DIR all need to be set
#
FROM docker.mirror.hashicorp.services/alpine:3.13.5
COPY --from=imgbuilder /usr/bin/img /usr/bin/img
COPY --from=imgbase /usr/bin/runc /usr/bin/runc
COPY --from=imgbase /usr/bin/newuidmap /usr/bin/newuidmap
COPY --from=imgbase /usr/bin/newgidmap /usr/bin/newgidmap
# libseccomp-dev is required for runc
# git is for gitrefpretty() and other calls for Waypoint
RUN apk add --no-cache libseccomp-dev git
COPY --from=builder /tmp/wp-src/waypoint /usr/bin/waypoint
COPY --from=builder /tmp/wp-src/waypoint-entrypoint /usr/bin/waypoint-entrypoint
VOLUME ["/data"]
# NOTE: userid must be 100 here. Otherwise upgrades will fail due to user not
# having the proper permissions to read the server db due to a different userid
RUN addgroup waypoint && \
adduser -S -u 100 -G waypoint waypoint && \
mkdir /data/ && \
chown -R waypoint:waypoint /data
# configure newuidmap/newgidmap to work with our waypoint user
RUN chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap \
&& mkdir -p /run/user/100 \
&& chown -R waypoint /run/user/100 /home/waypoint \
&& echo waypoint:100000:65536 | tee /etc/subuid | tee /etc/subgid
USER waypoint
ENV USER waypoint
ENV HOME /home/waypoint
ENV XDG_RUNTIME_DIR=/run/user/100
ENTRYPOINT ["/usr/bin/waypoint"]