Skip to content

Commit 19f1093

Browse files
sxdsxd
committed
chore: improve Dockerfile to build as extension image
Some improvements were made to the Dockerfile to build using meson and use a scratch image to have an extension image compatible with CloudNativePG Closes #10 Signed-off-by: Jonathan Gonzalez V. <[email protected]>
1 parent 388f99c commit 19f1093

File tree

3 files changed

+160
-20
lines changed

3 files changed

+160
-20
lines changed

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,10 +131,20 @@ created during the setup process.
131131

132132
### Docker
133133

134+
A simple possibility is to build the image using a plain docker build
135+
command:
136+
134137
```bash
135138
docker build -t pg-kc-validator -f docker/Dockerfile .
136139
```
137140

141+
To have all the possible labels, annotations, SBOMS, etc. the
142+
image can be built using Docker Bake:
143+
144+
```bash
145+
docker buildx bake
146+
```
147+
138148
---
139149

140150
## Security Notes

‎docker-bake.hcl‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#
2+
# Copyright © contributors to CloudNativePG, established as
3+
# CloudNativePG a Series of LF Projects, LLC.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
#
19+
20+
variable "environment" {
21+
default = "testing"
22+
validation {
23+
condition = contains(["testing", "production"], environment)
24+
error_message = "environment must be either testing or production"
25+
}
26+
}
27+
28+
variable "registry" {
29+
default = "localhost:5000"
30+
}
31+
32+
variable "insecure" {
33+
default = "false"
34+
}
35+
36+
variable "latest" {
37+
default = "false"
38+
}
39+
40+
variable "tag" {
41+
default = "dev"
42+
}
43+
44+
variable "buildVersion" {
45+
default = "dev"
46+
}
47+
48+
variable "revision" {
49+
default = ""
50+
}
51+
52+
suffix = (environment == "testing") ? "-testing" : ""
53+
54+
title = "PostgreSQL Keycloak Validator Extension"
55+
description = ""
56+
authors = "The CloudNativePG Contributors"
57+
url = "https://github.com/cloudnative-pg/"
58+
documentation = "https://cloudnative-pg.io/"
59+
license = "Apache-2.0"
60+
now = timestamp()
61+
62+
63+
# renovate: datasource=docker
64+
baseImage = "ghcr.io/cloudnative-pg/postgresql:18-standard-trixie"
65+
66+
target "default" {
67+
matrix = {
68+
distro = [
69+
"base",
70+
]
71+
}
72+
73+
name = "${distro}"
74+
#platforms = ["linux/amd64", "linux/arm64"]
75+
platforms = ["linux/amd64"]
76+
tags = [
77+
"${registry}/postgres-keycloak-oauth-validator${suffix}:${tag}",
78+
latest("${registry}/postgres-keycloak-oauth-validator${suffix}", "${latest}"),
79+
]
80+
81+
dockerfile = "docker/Dockerfile"
82+
context = "."
83+
84+
args = {
85+
BASE = "${baseImage}"
86+
}
87+
88+
output = [
89+
"type=image,registry.insecure=${insecure}",
90+
]
91+
92+
attest = [
93+
"type=provenance,mode=max",
94+
"type=sbom"
95+
]
96+
annotations = [
97+
"index,manifest:org.opencontainers.image.created=${now}",
98+
"index,manifest:org.opencontainers.image.url=${url}",
99+
"index,manifest:org.opencontainers.image.source=${url}",
100+
"index,manifest:org.opencontainers.image.version=${buildVersion}",
101+
"index,manifest:org.opencontainers.image.revision=${revision}",
102+
"index,manifest:org.opencontainers.image.vendor=${authors}",
103+
"index,manifest:org.opencontainers.image.title=${title}",
104+
"index,manifest:org.opencontainers.image.description=${description}",
105+
"index,manifest:org.opencontainers.image.documentation=${documentation}",
106+
"index,manifest:org.opencontainers.image.authors=${authors}",
107+
"index,manifest:org.opencontainers.image.licenses=${license}",
108+
"index,manifest:org.opencontainers.image.base.name=",
109+
"index,manifest:org.opencontainers.image.base.digest=",
110+
]
111+
labels = {
112+
"org.opencontainers.image.created" = "${now}",
113+
"org.opencontainers.image.url" = "${url}",
114+
"org.opencontainers.image.source" = "${url}",
115+
"org.opencontainers.image.version" = "${buildVersion}",
116+
"org.opencontainers.image.revision" = "${revision}",
117+
"org.opencontainers.image.vendor" = "${authors}",
118+
"org.opencontainers.image.title" = "${title}",
119+
"org.opencontainers.image.description" = "${description}",
120+
"org.opencontainers.image.documentation" = "${documentation}",
121+
"org.opencontainers.image.authors" = "${authors}",
122+
"org.opencontainers.image.licenses" = "${license}",
123+
"org.opencontainers.image.base.name" = "",
124+
"org.opencontainers.image.base.digest" = "",
125+
"name" = "${title}",
126+
"maintainer" = "${authors}",
127+
"vendor" = "${authors}",
128+
"version" = "${buildVersion}",
129+
"release" = "1",
130+
"description" = "${description}",
131+
"summary" = "${description}",
132+
}
133+
}
134+
135+
function latest {
136+
params = [ image, latest ]
137+
result = (latest == "true") ? "${image}:latest" : ""
138+
}

‎docker/Dockerfile‎

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,21 @@
1-
# syntax=docker/dockerfile:1.7
2-
FROM postgres:18 AS builder
1+
ARG BASE=ghcr.io/cloudnative-pg/postgresql:18-standard-trixie
2+
3+
FROM $BASE AS builder
34
ARG DEBIAN_FRONTEND=noninteractive
5+
USER root
46
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
57
set -eux; \
68
apt-get update; \
79
apt-get install -y --no-install-recommends \
810
build-essential \
911
meson \
1012
libcurl4-openssl-dev \
11-
postgresql-server-dev-18; \
12-
WORKDIR /work
13-
COPY . .
14-
RUN meson setup build && meson build -C build/
13+
postgresql-server-dev-18
14+
WORKDIR /srv
15+
COPY meson.build LICENSE ./
16+
COPY src/ ./src/
17+
RUN meson setup build && meson compile -C build/
1518

16-
FROM ghcr.io/cloudnative-pg/postgresql:18-standard-trixie
17-
ARG DEBIAN_FRONTEND=noninteractive
18-
USER root
19-
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
20-
set -eux; \
21-
apt-get update; \
22-
apt-get install -y --no-install-recommends libcurl4 ca-certificates; \
23-
apt-get clean; \
24-
rm -rf /var/lib/apt/lists/*
25-
COPY --chmod=0644 docker/certs/server.crt /usr/local/share/ca-certificates/kc-root.crt
26-
RUN update-ca-certificates
27-
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
28-
USER postgres
29-
COPY --from=builder /work/build/kc_validator.so /usr/lib/postgresql/18/lib/
19+
FROM scratch
20+
21+
COPY --from=builder /srv/build/kc_validator.so /share/extension/

0 commit comments

Comments
 (0)