Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Official Support for Windows Docker Images #2136

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
+276 −33
Open

Add Official Support for Windows Docker Images #2136

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
d5e9215
Squash commits
zZHorizonZz Aug 29, 2024
c77f154
Add Official Support for Windows Docker Images
zZHorizonZz Sep 4, 2024
880fca8
Add fallback to gpg
zZHorizonZz Sep 4, 2024
788df2f
Added verbose logging and sha256 checksum for gpg
zZHorizonZz Sep 5, 2024
47843c9
Added link to gpg key and remove verbose logging
zZHorizonZz Sep 5, 2024
537bc56
Updated update.sh to allow skiping everything besides windows
zZHorizonZz Sep 5, 2024
0547704
Remove empty smoke test layer
zZHorizonZz Sep 6, 2024
b98f859
Remove empty smoke test layer
zZHorizonZz Sep 6, 2024
48e25c2
Fix linting errors
zZHorizonZz Sep 9, 2024
d5532b8
Renamed windows variant to windowsservercore
zZHorizonZz Sep 9, 2024
a8724fb
Fixed github action after rename
zZHorizonZz Sep 9, 2024
dbe54a6
Fixed github action after rename
zZHorizonZz Sep 9, 2024
e3485a7
Updated README.md to include information about windoservercore images.
zZHorizonZz Sep 9, 2024
79bf2fe
Remove gpg, multistage from windowservercore images and use NODE_CHEC…
zZHorizonZz Sep 20, 2024
41d4d9f
Fixed build-test-windows.yml
zZHorizonZz Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
113 changes: 113 additions & 0 deletions .github/workflows/build-test-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
name: build-test-windows

on:
push:
paths:
- "**/windows-2019/**"
- "**/windows-2022/**"
- ".github/workflows/build-test-windows.yml"

pull_request:
paths:
- "**/windows-2019/**"
- "**/windows-2022/**"
- ".github/workflows/build-test-windows.yml"

jobs:
build-windows-2019:
name: build-windows-2019
runs-on: windows-2019
timeout-minutes: 60
strategy:
fail-fast: false
matrix:
version: [ 22.7.0 ]
variant: [ "windows-2019" ]

steps:
- name: Get short node version
uses: actions/github-script@v7
id: short-version
with:
result-encoding: string
script: return "${{ matrix.version }}".split('.')[0]

- name: Checkout
uses: actions/checkout@v4

# We cannot use docker/build-push-action here because it requires buildx, which is not available on Windows
- name: Build image
run: |
docker build --tag node:${{ matrix.version }}-${{ matrix.variant }} ./${{ steps.short-version.outputs.result }}/${{ matrix.variant }}

- name: Test for node version
shell: pwsh
run: |
$image_node_version = (docker run --rm node:${{ matrix.version }}-${{ matrix.variant }} node --print "process.versions.node").Trim()
Write-Host "Expected: '${{ matrix.version }}', Got: '$image_node_version'"
if ($image_node_version -ne "${{ matrix.version }}") {
exit 1
}

- name: Verify entrypoint runs regular, non-executable files with node
shell: pwsh
run: |
$tempDir = New-Item -ItemType Directory -Path $env:TEMP -Name "tempNodeApp"
$tmp_file = Join-Path $tempDir "index.js"
"console.log('success')" | Out-File -FilePath $tmp_file -Encoding utf8
$output = (docker run --rm -w /app --mount "type=bind,src=$tempDir,target=c:\app" node:${{ matrix.version }}-${{ matrix.variant }} C:/app/index.js)
if ($output -ne 'success') {
Write-Host "Invalid"
}

- name: Test for npm
run: docker run --rm node:${{ matrix.version }}-${{ matrix.variant }} npm --version

build-windows-2022:
name: build-windows-2022
runs-on: windows-2022
timeout-minutes: 60
strategy:
fail-fast: false
matrix:
version: [ "22.7.0" ]
variant: [ "windows-2022" ]

steps:
- name: Get short node version
uses: actions/github-script@v7
id: short-version
with:
result-encoding: string
script: return "${{ matrix.version }}".split('.')[0]

- name: Checkout
uses: actions/checkout@v4

# We cannot use docker/build-push-action here because it requires buildx, which is not available on Windows
- name: Build image
run: |
docker build --tag node:${{ matrix.version }}-${{ matrix.variant }} ./${{ steps.short-version.outputs.result }}/${{ matrix.variant }}

- name: Test for node version
shell: pwsh
run: |
$image_node_version = (docker run --rm node:${{ matrix.version }}-${{ matrix.variant }} node --print "process.versions.node").Trim()
Write-Host "Expected: '${{ matrix.version }}', Got: '$image_node_version'"
if ($image_node_version -ne "${{ matrix.version }}") {
exit 1
}

- name: Verify entrypoint runs regular, non-executable files with node
shell: pwsh
run: |
$tempDir = New-Item -ItemType Directory -Path $env:TEMP -Name "tempNodeApp"
$tmp_file = Join-Path $tempDir "index.js"
"console.log('success')" | Out-File -FilePath $tmp_file -Encoding utf8
$output = (docker run --rm -w /app --mount "type=bind,src=$tempDir,target=c:\app" node:${{ matrix.version }}-${{ matrix.variant }} C:/app/index.js)
if ($output -ne 'success') {
Write-Host "Invalid"
}

- name: Test for npm
run: docker run --rm node:${{ matrix.version }}-${{ matrix.variant }} npm --version
62 changes: 62 additions & 0 deletions 22/windows-2019/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
FROM mcr.microsoft.com/windows/servercore:ltsc2019 as installer

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

# PATH isn't actually set in the Docker image, so we have to set it from within the container
RUN $newPath = ('C:\Program Files (x86)\GnuPG\bin;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)
# doing this first to share cache across versions more aggressively

ENV NODE_VERSION 22.7.0
ENV NODE_CHECKSUM 3fc638727974262b4f65a6b1b43c22fb2d80671cdcb50e1237e0b05d1330aaf7

ENV GPG_VERSION 2.4.5_20240307

RUN Invoke-WebRequest $('https://www.gnupg.org/ftp/gcrypt/binary/gnupg-w32-{0}.exe' -f $env:GPG_VERSION) -OutFile 'gpg-installer.exe'; \
Start-Process -FilePath 'gpg-installer.exe' -ArgumentList '/S' -Wait; \
gpg --version;

RUN @( \
'4ED778F539E3634C779C87C6D7062848A1AB005C', \
'141F07595B7B3FFE74309A937405533BE57C7D57', \
'74F12602B6F1C4E913FAA37AD3A89613643B6201', \
'DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7', \
'61FC681DFB92A079F1685E77973F295594EC4689', \
'8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600', \
'C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8', \
'890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4', \
'C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C', \
'108F52B48DB57BB0CC439B2997B01419BD92F80A', \
'A363A499291CBBC940DD62E41F10027AF002F8B0', \
'CC68F5A3106FF448322E48ED27F5E38D5B0A215F' \
) | foreach { \
gpg --keyserver hkps://keys.openpgp.org --recv-keys $_ ; \
} ; \
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/SHASUMS256.txt.asc' -f $env:NODE_VERSION) -OutFile 'SHASUMS256.txt.asc' -UseBasicParsing ; \
gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/node-v{0}-win-x64.zip' -f $env:NODE_VERSION) -OutFile 'node.zip' -UseBasicParsing ; \
$sum = $(cat SHASUMS256.txt.asc | sls $(' node-v{0}-win-x64.zip' -f $env:NODE_VERSION)) -Split ' ' ; \
if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $sum[0]) { Write-Error 'SHA256 mismatch' } ; \
Expand-Archive node.zip -DestinationPath C:\ ; \
Rename-Item -Path $('C:\node-v{0}-win-x64' -f $env:NODE_VERSION) -NewName 'C:\nodejs'

FROM mcr.microsoft.com/windows/servercore:ltsc2019 as runner

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

RUN $newPath = ('C:\nodejs;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)

COPY --from=installer C:/nodejs C:/nodejs

COPY docker-entrypoint.ps1 C:/docker-entrypoint.ps1
ENTRYPOINT [ "powershell.exe" , "C:/docker-entrypoint.ps1" ]

# Smoke test
RUN node --version; \
npm --version;

CMD [ "node.exe" ]
16 changes: 16 additions & 0 deletions 22/windows-2019/docker-entrypoint.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Ensure script stops on any error
$ErrorActionPreference = 'Stop'

# Check if the first argument:
# 1. Contains a "-"
# 2. Is NOT a recognized command
# 3. Is a file that's NOT executable
if (($args[0] -like '*-') -or
(!(Get-Command $args[0] -ErrorAction SilentlyContinue)) -or
(((Test-Path $args[0] -PathType Leaf)) -and -not ((Get-Item $args[0]).Attributes -band 'ReadOnly'))) {
# Prepend 'node' to the argument list
$args = @('node') + $args
}

# Execute the (potentially modified) command
& $args[0] $args[1..($args.Length-1)]
62 changes: 62 additions & 0 deletions 22/windows-2022/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
FROM mcr.microsoft.com/windows/servercore:ltsc2022 as installer

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

# PATH isn't actually set in the Docker image, so we have to set it from within the container
RUN $newPath = ('C:\Program Files (x86)\GnuPG\bin;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)
# doing this first to share cache across versions more aggressively

ENV NODE_VERSION 22.7.0
ENV NODE_CHECKSUM 3fc638727974262b4f65a6b1b43c22fb2d80671cdcb50e1237e0b05d1330aaf7

ENV GPG_VERSION 2.4.5_20240307

RUN Invoke-WebRequest $('https://www.gnupg.org/ftp/gcrypt/binary/gnupg-w32-{0}.exe' -f $env:GPG_VERSION) -OutFile 'gpg-installer.exe'; \
Start-Process -FilePath 'gpg-installer.exe' -ArgumentList '/S' -Wait; \
gpg --version;

RUN @( \
'4ED778F539E3634C779C87C6D7062848A1AB005C', \
'141F07595B7B3FFE74309A937405533BE57C7D57', \
'74F12602B6F1C4E913FAA37AD3A89613643B6201', \
'DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7', \
'61FC681DFB92A079F1685E77973F295594EC4689', \
'8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600', \
'C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8', \
'890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4', \
'C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C', \
'108F52B48DB57BB0CC439B2997B01419BD92F80A', \
'A363A499291CBBC940DD62E41F10027AF002F8B0', \
'CC68F5A3106FF448322E48ED27F5E38D5B0A215F' \
) | foreach { \
gpg --keyserver hkps://keys.openpgp.org --recv-keys $_ ; \
} ; \
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/SHASUMS256.txt.asc' -f $env:NODE_VERSION) -OutFile 'SHASUMS256.txt.asc' -UseBasicParsing ; \
gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/node-v{0}-win-x64.zip' -f $env:NODE_VERSION) -OutFile 'node.zip' -UseBasicParsing ; \
$sum = $(cat SHASUMS256.txt.asc | sls $(' node-v{0}-win-x64.zip' -f $env:NODE_VERSION)) -Split ' ' ; \
if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $sum[0]) { Write-Error 'SHA256 mismatch' } ; \
Expand-Archive node.zip -DestinationPath C:\ ; \
Rename-Item -Path $('C:\node-v{0}-win-x64' -f $env:NODE_VERSION) -NewName 'C:\nodejs'

FROM mcr.microsoft.com/windows/servercore:ltsc2022 as runner

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

RUN $newPath = ('C:\nodejs;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)

COPY --from=installer C:/nodejs C:/nodejs

COPY docker-entrypoint.ps1 C:/docker-entrypoint.ps1
ENTRYPOINT [ "powershell.exe" , "C:/docker-entrypoint.ps1" ]

# Smoke test
RUN node --version; \
npm --version;

CMD [ "node.exe" ]
16 changes: 16 additions & 0 deletions 22/windows-2022/docker-entrypoint.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Ensure script stops on any error
$ErrorActionPreference = 'Stop'

# Check if the first argument:
# 1. Contains a "-"
# 2. Is NOT a recognized command
# 3. Is a file that's NOT executable
if (($args[0] -like '*-') -or
(!(Get-Command $args[0] -ErrorAction SilentlyContinue)) -or
(((Test-Path $args[0] -PathType Leaf)) -and -not ((Get-Item $args[0]).Attributes -band 'ReadOnly'))) {
# Prepend 'node' to the argument list
$args = @('node') + $args
}

# Execute the (potentially modified) command
& $args[0] $args[1..($args.Length-1)]
51 changes: 51 additions & 0 deletions Dockerfile-windows.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
FROM mcr.microsoft.com/windows/servercore:version as installer

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

# PATH isn't actually set in the Docker image, so we have to set it from within the container
RUN $newPath = ('C:\Program Files (x86)\GnuPG\bin;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)
# doing this first to share cache across versions more aggressively

ENV NODE_VERSION 0.0.0
ENV NODE_CHECKSUM CHECKSUM_x64
zZHorizonZz marked this conversation as resolved.
Show resolved Hide resolved

ENV GPG_VERSION 2.4.5_20240307

RUN Invoke-WebRequest $('https://www.gnupg.org/ftp/gcrypt/binary/gnupg-w32-{0}.exe' -f $env:GPG_VERSION) -OutFile 'gpg-installer.exe'; \
Start-Process -FilePath 'gpg-installer.exe' -ArgumentList '/S' -Wait; \
zZHorizonZz marked this conversation as resolved.
Show resolved Hide resolved
gpg --version;

RUN @( \
"${NODE_KEYS[@]}"
) | foreach { \
gpg --keyserver hkps://keys.openpgp.org --recv-keys $_ ; \
} ; \
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/SHASUMS256.txt.asc' -f $env:NODE_VERSION) -OutFile 'SHASUMS256.txt.asc' -UseBasicParsing ; \
gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc ; \
Invoke-WebRequest $('https://nodejs.org/dist/v{0}/node-v{0}-win-x64.zip' -f $env:NODE_VERSION) -OutFile 'node.zip' -UseBasicParsing ; \
$sum = $(cat SHASUMS256.txt.asc | sls $(' node-v{0}-win-x64.zip' -f $env:NODE_VERSION)) -Split ' ' ; \
if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $sum[0]) { Write-Error 'SHA256 mismatch' } ; \
Copy link
Member

@LaurentGoderre LaurentGoderre Sep 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zZHorizonZz to meet what @tianon said, I think you could change these 2 line to be

if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $NODE_CHECKSUM) { Write-Error 'SHA256 mismatch' } ; \

The reason why this is better is that the images get rebuilt when the base image changes so if the server was compromised, the key would be changed at the same time as the archive. This means that the arcgive can't change or rebuilds would fail.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LaurentGoderre It's not really just about changing these two lines. If we check the checksum, we don't really need GPG or multistage, which makes it simpler. So, what I'll do is remove the GPG installation and SHA256 download and replace it with verification through the NODE_CHECKSUM variable. I'll also remove the multistage as that's not necessary if we're going this way.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aren't these two different checks though? One checks it wasn't modified, the other checks it came from the release team

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm starting to get a little bit confused here.

If we change these two lines:

$sum = $(cat SHASUMS256.txt.asc | sls $('  node-v{0}-win-x64.zip' -f $env:NODE_VERSION)) -Split ' ' ; \
    if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $sum[0]) { Write-Error 'SHA256 mismatch' } ; \

To this:

if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $NODE_CHECKSUM) { Write-Error 'SHA256 mismatch' } ; 

We validate the checksum against the supplied checksum NODE_CHECKSUM. In the first version, we used the sum extracted from the SHASUMS256.txt.asc file. Maybe I misunderstood you. Did you mean to replace these lines or add a new check but keep the verification from SHASUMS as well? I got confused because @tianon is also discussing whether we should use GPG at all. I looked through the Golang Windows images, and they are also using only one check with a static SHA256.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yeah, my bad. We might be good to just have the hardcoded checksum and no gpg

Expand-Archive node.zip -DestinationPath C:\ ; \
Rename-Item -Path $('C:\node-v{0}-win-x64' -f $env:NODE_VERSION) -NewName 'C:\nodejs'

FROM mcr.microsoft.com/windows/servercore:version as runner

SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]

RUN $newPath = ('C:\nodejs;{0}' -f $env:PATH); \
Write-Host ('Updating PATH: {0}' -f $newPath); \
[Environment]::SetEnvironmentVariable('PATH', $newPath, [EnvironmentVariableTarget]::Machine)
LaurentGoderre marked this conversation as resolved.
Show resolved Hide resolved

COPY --from=installer C:/nodejs C:/nodejs

COPY docker-entrypoint.ps1 C:/docker-entrypoint.ps1
ENTRYPOINT [ "powershell.exe" , "C:/docker-entrypoint.ps1" ]
LaurentGoderre marked this conversation as resolved.
Show resolved Hide resolved

# Smoke test
RUN node --version; \
npm --version;

CMD [ "node.exe" ]
4 changes: 2 additions & 2 deletions architectures
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
bashbrew-arch variants
amd64 alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
amd64 alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim,windows-2019,windows-2022
arm32v6 alpine3.19,alpine3.20
arm32v7 alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
arm64v8 alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
i386 alpine3.19,alpine3.20
ppc64le alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
s390x alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
s390x alpine3.19,alpine3.20,bookworm,bookworm-slim,bullseye,bullseye-slim
16 changes: 16 additions & 0 deletions docker-entrypoint.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Ensure script stops on any error
$ErrorActionPreference = 'Stop'

# Check if the first argument:
# 1. Contains a "-"
# 2. Is NOT a recognized command
# 3. Is a file that's NOT executable
if (($args[0] -like '*-') -or
(!(Get-Command $args[0] -ErrorAction SilentlyContinue)) -or
(((Test-Path $args[0] -PathType Leaf)) -and -not ((Get-Item $args[0]).Attributes -band 'ReadOnly'))) {
# Prepend 'node' to the argument list
$args = @('node') + $args
}

# Execute the (potentially modified) command
& $args[0] $args[1..($args.Length-1)]
10 changes: 10 additions & 0 deletions functions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,16 @@ function is_debian_slim() {
return 1
}

function is_windows() {
local variant
variant=$1
shift

if [ "${variant}" = "${variant#windows}" ]; then
return 1
fi
}

function get_fork_name() {
local version
version=$1
Expand Down
Loading