Skip to content

Commit 162f99f

Browse files
ostefanoostefano
authored
Update to Debian bookworm and python 3.12 (#92)
* Update to debian bookworm and python 3.12 * Ship lock file
1 parent 1c89ebc commit 162f99f

File tree

4 files changed

+3597
-95
lines changed

4 files changed

+3597
-95
lines changed

‎core/Dockerfile‎

Lines changed: 91 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,42 @@
11
ARG DOCKER_HUB_PROXY=""
22

3-
FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as composer-build
3+
4+
FROM "${DOCKER_HUB_PROXY}python:3.12-slim-bookworm" as php-base
5+
ENV DEBIAN_FRONTEND noninteractive
6+
7+
# Uncomment when building in corporate environments
8+
# COPY ./rootca.crt /usr/local/share/ca-certificates/rootca.pem
9+
# COPY ./rootca.crt /usr/lib/ssl/cert.pem
10+
11+
RUN apt-get update; apt-get install -y --no-install-recommends \
12+
lsb-release \
13+
ca-certificates \
14+
curl
15+
RUN curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
16+
RUN dpkg -i /tmp/debsuryorg-archive-keyring.deb
17+
RUN echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list
18+
RUN apt-get update
19+
20+
21+
FROM php-base as composer-build
422
ENV DEBIAN_FRONTEND noninteractive
523
ENV COMPOSER_ALLOW_SUPERUSER 1
624
ARG CORE_TAG
725
ARG CORE_COMMIT
826

9-
RUN apt-get update; apt-get install -y --no-install-recommends \
10-
ca-certificates \
11-
php \
12-
php-apcu \
13-
php-curl \
14-
php-xml \
15-
php-intl \
16-
php-bcmath \
17-
php-mbstring \
18-
php-mysql \
19-
php-redis \
20-
php-gd \
21-
php-fpm \
22-
php-zip \
27+
RUN apt-get install -y --no-install-recommends \
28+
php7.4 \
29+
php7.4-apcu \
30+
php7.4-curl \
31+
php7.4-xml \
32+
php7.4-intl \
33+
php7.4-bcmath \
34+
php7.4-mbstring \
35+
php7.4-mysql \
36+
php7.4-redis \
37+
php7.4-gd \
38+
php7.4-fpm \
39+
php7.4-zip \
2340
unzip \
2441
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
2542

@@ -29,41 +46,53 @@ FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as composer-build
2946
RUN composer config --no-interaction allow-plugins.composer/installers true
3047
RUN composer install
3148
RUN composer require --with-all-dependencies --no-interaction \
32-
supervisorphp/supervisor:^4.0 \
33-
guzzlehttp/guzzle \
34-
lstrojny/fxmlrpc \
35-
php-http/message \
36-
php-http/message-factory \
37-
# docker image specific dependencies
38-
elasticsearch/elasticsearch:^8.7.0 \
39-
jakub-onderka/openid-connect-php:^1.0.0 \
40-
aws/aws-sdk-php
41-
42-
FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as php-build
49+
supervisorphp/supervisor:^4.0 \
50+
guzzlehttp/guzzle \
51+
lstrojny/fxmlrpc \
52+
php-http/message \
53+
php-http/message-factory \
54+
# docker image specific dependencies
55+
elasticsearch/elasticsearch:^8.7.0 \
56+
jakub-onderka/openid-connect-php:^1.0.0 \
57+
aws/aws-sdk-php
58+
59+
60+
FROM php-base as php-build
4361
ENV DEBIAN_FRONTEND noninteractive
4462
ENV TZ Etc/UTC
4563

46-
RUN apt-get update; apt-get install -y --no-install-recommends \
64+
RUN apt-get install -y --no-install-recommends \
4765
gcc \
4866
g++ \
4967
make \
68+
php7.4 \
69+
php7.4-dev \
70+
php7.4-xml \
5071
libfuzzy-dev \
51-
ca-certificates \
52-
php \
53-
php-dev \
54-
php-xml \
55-
php-pear \
5672
librdkafka-dev \
5773
libsimdjson-dev \
5874
libzstd-dev \
5975
git \
76+
php-pear \
6077
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
6178

62-
RUN cp "/usr/lib/$(gcc -dumpmachine)"/libfuzzy.* /usr/lib; pecl channel-update pecl.php.net && pecl install ssdeep && pecl install rdkafka && pecl install simdjson && pecl install zstd
63-
RUN git clone --recursive --depth=1 https://github.com/kjdev/php-ext-brotli.git && \
64-
cd php-ext-brotli && phpize && ./configure && make && make install
79+
RUN apt-cache search pecl
80+
81+
RUN update-alternatives --set php /usr/bin/php7.4
82+
RUN update-alternatives --set php-config /usr/bin/php-config7.4
83+
RUN update-alternatives --set phpize /usr/bin/phpize7.4
84+
85+
RUN cp "/usr/lib/$(gcc -dumpmachine)"/libfuzzy.* /usr/lib
86+
RUN pecl channel-update pecl.php.net && \
87+
pecl install ssdeep && \
88+
pecl install rdkafka && \
89+
pecl install simdjson && \
90+
pecl install zstd
91+
RUN git clone --recursive --depth=1 https://github.com/kjdev/php-ext-brotli.git && \
92+
cd php-ext-brotli && phpize && ./configure && make && make install
6593

66-
FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as python-build
94+
95+
FROM php-base as python-build
6796
ENV DEBIAN_FRONTEND noninteractive
6897
ARG CORE_TAG
6998
ARG CORE_COMMIT
@@ -77,8 +106,7 @@ FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as python-build
77106
ARG PYPI_CYBOX_VERSION
78107
ARG PYPI_PYMISP_VERSION
79108

80-
RUN apt-get update; apt-get install -y --no-install-recommends \
81-
python3-pip \
109+
RUN apt-get install -y --no-install-recommends \
82110
git \
83111
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
84112

@@ -89,7 +117,6 @@ FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim" as python-build
89117
else
90118
git clone --branch "${CORE_TAG}" --depth 1 https://github.com/MISP/MISP.git /var/www/MISP
91119
fi
92-
93120
cd /var/www/MISP || exit; git submodule update --init --recursive .
94121
EOF
95122

@@ -124,7 +151,7 @@ EOF
124151
fi
125152
done;
126153

127-
pip3 wheel --no-cache-dir -w /wheels/ -r /var/www/MISP/requirements.txt
154+
pip wheel --no-cache-dir -w /wheels/ -r /var/www/MISP/requirements.txt
128155

129156
# Remove files we do not care for
130157
rm -r /var/www/MISP/PyMISP
@@ -134,13 +161,14 @@ EOF
134161
find /var/www/MISP/.git/* ! -name HEAD -exec rm -rf {} +
135162
EOF
136163

137-
FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim"
164+
165+
FROM php-base
138166
ENV DEBIAN_FRONTEND noninteractive
139167
ARG CORE_TAG
140168
ARG CORE_COMMIT
141169
ARG PHP_VER
142170

143-
RUN apt-get update; apt-get install -y --no-install-recommends \
171+
RUN apt-get install -y --no-install-recommends \
144172
gettext \
145173
procps \
146174
sudo \
@@ -150,42 +178,41 @@ FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim"
150178
openssl \
151179
gpg \
152180
gpg-agent \
153-
ssdeep \
154-
libfuzzy2 \
155181
mariadb-client \
156182
rsync \
157-
# Python Requirements
158-
python3 \
159-
python3-setuptools \
160-
python3-pip \
161183
# PHP Requirements
162-
php \
163-
php-apcu \
164-
php-curl \
165-
php-xml \
166-
php-intl \
167-
php-bcmath \
168-
php-mbstring \
169-
php-mysql \
170-
php-redis \
171-
php-gd \
172-
php-fpm \
173-
php-zip \
174-
php-ldap \
184+
php7.4 \
185+
php7.4-apcu \
186+
php7.4-curl \
187+
php7.4-xml \
188+
php7.4-intl \
189+
php7.4-bcmath \
190+
php7.4-mbstring \
191+
php7.4-mysql \
192+
php7.4-redis \
193+
php7.4-gd \
194+
php7.4-fpm \
195+
php7.4-zip \
196+
php7.4-ldap \
197+
libmagic1 \
175198
libldap-common \
176199
librdkafka1 \
177200
libbrotli1 \
178-
libsimdjson5 \
201+
libsimdjson14 \
179202
libzstd1 \
203+
ssdeep \
204+
libfuzzy2 \
180205
# Unsure we need these
181206
zip unzip \
182207
# Require for advanced an unattended configuration
183208
curl jq \
184209
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
185210

211+
RUN update-alternatives --set php /usr/bin/php7.4
212+
186213
# Install python modules
187214
COPY --from=python-build /wheels /wheels
188-
RUN pip3 install --no-cache-dir /wheels/*.whl && rm -rf /wheels
215+
RUN pip install --no-cache-dir /wheels/*.whl && rm -rf /wheels
189216

190217
# PHP: install prebuilt libraries, then install the app's PHP deps
191218
COPY --from=php-build ["/usr/lib/php/${PHP_VER}/ssdeep.so", "/usr/lib/php/${PHP_VER}/rdkafka.so", "/usr/lib/php/${PHP_VER}/brotli.so", "/usr/lib/php/${PHP_VER}/simdjson.so", "/usr/lib/php/${PHP_VER}/zstd.so", "/usr/lib/php/${PHP_VER}/"]
@@ -208,7 +235,7 @@ FROM "${DOCKER_HUB_PROXY}debian:bullseye-slim"
208235
EOF
209236

210237
# nginx
211-
RUN rm /etc/nginx/sites-enabled/*; mkdir /run/php /etc/nginx/certs
238+
RUN rm /etc/nginx/sites-enabled/*; mkdir -p /run/php /etc/nginx/certs
212239

213240
# Make a copy of the file and configuration stores, so we can sync from it
214241

‎modules/Dockerfile‎

Lines changed: 37 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG DOCKER_HUB_PROXY=""
22

3-
FROM "${DOCKER_HUB_PROXY}python:3.11-slim-bullseye" as python-build
3+
FROM "${DOCKER_HUB_PROXY}python:3.12-slim-bookworm" as python-build
44
ENV DEBIAN_FRONTEND noninteractive
55
ARG MODULES_TAG
66
ARG MODULES_COMMIT
@@ -9,72 +9,78 @@ FROM "${DOCKER_HUB_PROXY}python:3.11-slim-bullseye" as python-build
99
RUN apt-get update && apt-get install -y --no-install-recommends \
1010
cmake \
1111
git \
12-
python3-dev \
13-
python3-pip \
14-
python3-wheel \
1512
build-essential \
16-
pkg-config \
1713
libpoppler-cpp-dev \
1814
libfuzzy-dev \
15+
libffi-dev \
16+
libxml2-dev \
17+
libxslt-dev \
1918
libssl-dev \
2019
ninja-build \
2120
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
22-
21+
2322
RUN mkdir /wheels
24-
WORKDIR /srv
2523

2624
RUN <<-EOF
2725
if [ ! -z ${MODULES_COMMIT} ]; then
2826
git clone https://github.com/MISP/misp-modules.git /srv/misp-modules && cd /srv/misp-modules && git checkout ${MODULES_COMMIT}
2927
else
3028
git clone --branch ${MODULES_TAG} --depth 1 https://github.com/MISP/misp-modules.git /srv/misp-modules
3129
fi
32-
33-
cd /srv/misp-modules
34-
sed -i "s/numpy.*/numpy<2/" REQUIREMENTS
35-
echo "pyeti" >> REQUIREMENTS
36-
echo "greynoise" >> REQUIREMENTS
37-
echo "Google-Search-API" >> REQUIREMENTS
38-
pip3 wheel -r REQUIREMENTS --no-cache-dir -w /wheels/
39-
rm -rf /srv/misp-modules
4030
EOF
4131

32+
WORKDIR /srv/misp-modules
33+
RUN pip install pipenv
34+
COPY files/Pipfile Pipfile
35+
COPY files/Pipfile.lock Pipfile.lock
36+
RUN pipenv requirements > requirements.txt
37+
RUN pip wheel -r requirements.txt --no-cache-dir -w /wheels/
38+
39+
WORKDIR /srv/
40+
RUN rm -rf /srv/misp-modules
41+
4242
RUN <<-EOF
4343
git clone --depth 1 https://github.com/stricaud/faup.git /srv/faup
4444
cd /srv/faup
4545
if [ ! -z ${LIBFAUP_COMMIT} ]; then
4646
git checkout ${LIBFAUP_COMMIT}
4747
fi
48-
49-
cd /srv/faup/build
50-
cmake -G "Ninja" ../
51-
ninja
52-
ninja install
53-
cd /srv/faup/src/lib/bindings/python
54-
pip3 wheel --no-cache-dir --no-dependencies -w /wheels/ .
55-
rm -rf /srv/faup
5648
EOF
5749

58-
FROM "${DOCKER_HUB_PROXY}python:3.11-slim-bullseye"
50+
WORKDIR /srv/faup/build
51+
RUN cmake -G "Ninja" ../
52+
RUN ninja
53+
RUN ninja install
54+
WORKDIR /srv/faup/src/lib/bindings/python
55+
RUN pip wheel --no-cache-dir --no-dependencies -w /wheels/ .
56+
57+
WORKDIR /srv/
58+
RUN rm -rf /srv/faup
59+
60+
61+
FROM "${DOCKER_HUB_PROXY}python:3.12-slim-bookworm"
5962
ENV DEBIAN_FRONTEND noninteractive
6063

6164
RUN apt-get update && apt-get install -y --no-install-recommends \
6265
libglib2.0-0 \
63-
libzbar0 \
64-
libxrender1 \
65-
libxext6 \
6666
libpoppler-cpp0v5 \
6767
libgl1 \
68+
libfuzzy2 \
69+
libffi8 \
70+
libxext6 \
71+
libxml2 \
72+
libxslt1.1 \
73+
libzbar0 \
6874
&& apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
69-
75+
7076
COPY --from=python-build /wheels /wheels
7177
COPY --from=python-build /usr/local/lib/libfaupl* /usr/local/lib/
72-
RUN pip3 install --no-cache-dir --use-deprecated=legacy-resolver /wheels/*.whl; ldconfig && rm -rf /wheels
73-
78+
RUN pip install --no-cache-dir --use-deprecated=legacy-resolver /wheels/*.whl; ldconfig && rm -rf /wheels
79+
7480
# Since we compile faup ourselves and lua is not required anymore, we can load our own library
7581
# and skip the pre-compiled blob to improve compatibility with other architectures like ARM
7682
RUN sed -i s/LoadLibrary\(LOAD_LIB\)/LoadLibrary\(\"\\/usr\\/local\\/lib\\/libfaupl.so\"\)/ \
77-
/usr/local/lib/python3.11/site-packages/pyfaup/__init__.py
83+
/usr/local/lib/python3.12/site-packages/pyfaup/__init__.py
7884

7985
# Disable (all) warnings raised when using 'future'
8086
RUN sed -i '/import sys/a import warnings\nwarnings.warn = lambda *args, **kwargs: None' \

0 commit comments

Comments
 (0)