-
Notifications
You must be signed in to change notification settings - Fork 73
/
Dockerfile.ubi9
124 lines (95 loc) · 6.07 KB
/
Dockerfile.ubi9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# syntax=docker/dockerfile:1
#---------------------------------------------------------------------
# PRE-BUILD STAGE: Build the acr credential helper binary
# This is due to the fact that the acr credential helper is not being actively released
#---------------------------------------------------------------------
FROM --platform=linux/amd64 golang:1.16 as cred-helpers-build
RUN go install github.com/chrismellard/docker-credential-acr-env@82a0ddb2758901b711d9d1614755b77e401598a1
#---------------------------------------------------------------------
# STAGE 1: Build kubernetes-monitor application
#---------------------------------------------------------------------
FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/nodejs-18:1-84 AS build
ENV NODE_ENV production
# Add manifest files and install before adding anything else to take advantage of layer caching
COPY --chown=1001:1001 package.json package-lock.json ./
RUN npm ci
# add the rest of the app files
COPY --chown=1001:1001 . ./
# Build typescript
RUN npm run build
#---------------------------------------------------------------------
# STAGE 2: Install containers-common to obtain configuration files
#---------------------------------------------------------------------
FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:9.4 AS containers-common
RUN dnf install -y containers-common
#---------------------------------------------------------------------
# STAGE 3: Build the kubernetes-monitor final image
#---------------------------------------------------------------------
FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi:9.4
ARG NODE_18_LATEST_VERSION
ARG NODE_18_LATEST_VERSION_TAR_GZ_FILE_SHASUM256
# https://github.com/Yelp/dumb-init/releases
ARG DUMB_INIT_VERSION=1.2.5
ARG DUMB_INIT_BINARY_FILE_SHASUM256=e874b55f3279ca41415d290c512a7ba9d08f98041b28ae7c2acb19a545f1c4df
# https://github.com/lework/skopeo-binary/releases
ARG SKOPEO_VERSION=1.13.2
ARG SKOPEO_BINARY_FILE_SHASUM256=2f00be6ee1c4cbfa7f2452be90a1a2ce88fd92a6d0f6a2e9d901bd2087bd9092
# https://github.com/awslabs/amazon-ecr-credential-helper/releases
# for sha: download SHA256 for the linux-amd64/docker-credential-ecr-login, then `cat docker-credential-ecr-login.sha256`
ARG ECR_CREDENTIAL_HELPER_VERSION=0.9.0
ARG ECR_CREDENTIAL_HELPER_BINARY_FILE_SHASUM256=dd6bd933e439ddb33b9f005ad5575705a243d4e1e3d286b6c82928bcb70e949a
# since this is built from a commit, you will need to build it locally to get the sha
ARG ACR_CREDENTIAL_HELPER_BINARY_SHASUM256=598bbd4ad2741ae2e68ac55e938a4542e71952e418e6278a74baf6213ef8ce76
LABEL name="Snyk Controller" \
maintainer="support@snyk.io" \
vendor="Snyk Ltd" \
summary="Snyk integration for Kubernetes" \
description="Snyk Controller enables you to import and test your running workloads and identify vulnerabilities in their associated images and configurations that might make those workloads less secure."
COPY LICENSE /licenses/LICENSE
ENV NODE_ENV production
RUN yum upgrade -y
WORKDIR /srv/app
RUN groupadd -g 10001 snyk
RUN useradd -g snyk -d /srv/app -u 10001 snyk
# Install dumb-init
RUN curl -sSfLo /usr/bin/dumb-init "https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_x86_64" && \
chmod 755 /usr/bin/dumb-init && \
echo "${DUMB_INIT_BINARY_FILE_SHASUM256} /usr/bin/dumb-init" | sha256sum --check --status
# Install skopeo
RUN curl -sSfLo /usr/bin/skopeo "https://github.com/lework/skopeo-binary/releases/download/v${SKOPEO_VERSION}/skopeo-linux-amd64" && \
chmod 755 /usr/bin/skopeo && \
echo "${SKOPEO_BINARY_FILE_SHASUM256} /usr/bin/skopeo" | sha256sum --check --status
# Copy configuration files required for skopeo to copy images, without including entire containers-common install
COPY --chown=snyk:snyk --from=containers-common /etc/containers/registries.d/default.yaml /etc/containers/registries.d/default.yaml
COPY --chown=snyk:snyk --from=containers-common /etc/containers/policy.json /etc/containers/policy.json
# Install credential helpers
RUN curl -sSfLo /usr/local/bin/docker-credential-ecr-login "https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/${ECR_CREDENTIAL_HELPER_VERSION}/linux-amd64/docker-credential-ecr-login" && \
chmod 755 /usr/local/bin/docker-credential-ecr-login && \
echo "${ECR_CREDENTIAL_HELPER_BINARY_FILE_SHASUM256} /usr/local/bin/docker-credential-ecr-login" | sha256sum --check --status
COPY --chown=snyk:snyk --from=cred-helpers-build /go/bin/docker-credential-acr-env /usr/local/bin/docker-credential-acr-env
RUN echo "${ACR_CREDENTIAL_HELPER_BINARY_SHASUM256} /usr/local/bin/docker-credential-acr-env" | sha256sum --check --status
# Install gcloud
RUN curl -sSfL https://sdk.cloud.google.com | bash -s -- --disable-prompts --install-dir=/ && \
rm -f /google-cloud-sdk/bin/anthoscli && \
rm -rf /google-cloud-sdk/platform
ENV PATH=/google-cloud-sdk/bin:$PATH
# Install node
RUN curl -sSfLo /tmp/node_18.tar.gz "https://nodejs.org/dist/latest-v18.x/${NODE_18_LATEST_VERSION}.tar.gz" && \
echo "${NODE_18_LATEST_VERSION_TAR_GZ_FILE_SHASUM256} /tmp/node_18.tar.gz" | sha256sum --check --status && \
mkdir /tmp/node_18 && tar -C /tmp/node_18 -xzf /tmp/node_18.tar.gz ${NODE_18_LATEST_VERSION}/bin/node && \
mv /tmp/node_18/${NODE_18_LATEST_VERSION}/bin/node /usr/local/bin && \
rm -rf /tmp/node_18.tar.gz /tmp/node_18
RUN rpm -e --nodeps curl-minimal && \
rpm -e --nodeps libcurl-minimal
# The `.config` directory is used by `snyk protect` and we also mount a K8s volume there at runtime.
# This clashes with OpenShift 3 which mounts things differently and prevents access to the directory.
# TODO: Remove this line once OpenShift 3 comes out of support.
RUN mkdir -p .config
# Copy app
COPY --chown=snyk:snyk --from=build /opt/app-root/src /srv/app/
# OpenShift 4 doesn't allow dumb-init access the app folder without this permission.
RUN chmod 755 /srv/app && chmod 755 /srv/app/bin && chmod +x /srv/app/bin/start
# This must be in the end for Red Hat Build Service
RUN chown -R snyk:snyk .
USER 10001:10001
ENTRYPOINT ["/usr/bin/dumb-init", "--", "bin/start"]