diff --git a/README.md b/README.md index ff2d5b9..429d817 100644 --- a/README.md +++ b/README.md @@ -1,20 +1,27 @@ -# Enterprise Example Images +# Coder Example Images This repository contains example images for use with [Coder](https://coder.com/docs/v2/latest). -- `enterprise-base`: Contains an example image that can be used as a base for +- `example-base`: Contains an example image that can be used as a base for other images. -- `enterprise-minimal`: Contains a minimal image that contains only the required +- `example-minimal`: Contains a minimal image that contains only the required utilities for a Coder workspace to bootstrap successfully. +- `example-golang`: Contains Go development tools. +- `example-java`: Contains Java development tools. +- `example-node`: Contains Node.js development tools. +- `example-desktop`: Contains a desktop environment accessible via web browser. ## Images on Docker Hub -Each of these images is also published to Docker Hub under the -`codercom/enterprise-[name]` repository. For example, `base` is available at -https://hub.docker.com/r/codercom/enterprise-base. The tag is taken from the +Each of these images is published to Docker Hub under the +`codercom/example-[name]` repository. For example, `base` is available at +https://hub.docker.com/r/codercom/example-base. The tag is taken from the filename of the Dockerfile. For example, `base/ubuntu.Dockerfile` is under the `ubuntu` tag. +> For backward compatibility, these images are also available with the `enterprise-` prefix +> (e.g., `codercom/enterprise-base`), but the `example-` prefix is recommended for new deployments. + ## Contributing See our [contributing guide](.github/CONTRIBUTING.md). diff --git a/scripts/build_images.sh b/scripts/build_images.sh index 2033375..d01ded3 100755 --- a/scripts/build_images.sh +++ b/scripts/build_images.sh @@ -91,7 +91,8 @@ fi for image in "${IMAGES[@]}"; do image_dir="$PROJECT_ROOT/images/$image" image_file="${TAG}.Dockerfile" - image_ref="codercom/enterprise-$image:$TAG" + enterprise_image_ref="codercom/enterprise-$image:$TAG" + example_image_ref="codercom/example-$image:$TAG" image_path="$image_dir/$image_file" if [ ! -f "$image_path" ]; then @@ -105,5 +106,6 @@ for image in "${IMAGES[@]}"; do "${docker_flags[@]}" \ "$image_dir" \ --file="$image_path" \ - --tag="$image_ref" \| indent + --tag="$example_image_ref" \ + --tag="$enterprise_image_ref" \| indent done diff --git a/scripts/push_images.sh b/scripts/push_images.sh index 4046dcb..5eed22a 100755 --- a/scripts/push_images.sh +++ b/scripts/push_images.sh @@ -92,8 +92,10 @@ date_str=$(date --utc +%Y%m%d) for image in "${IMAGES[@]}"; do image_dir="$PROJECT_ROOT/images/$image" image_file="${TAG}.Dockerfile" - image_ref="codercom/enterprise-$image:$TAG" - image_ref_date="${image_ref}-${date_str}" + enterprise_image_ref="codercom/enterprise-$image:$TAG" + enterprise_image_ref_date="${enterprise_image_ref}-${date_str}" + example_image_ref="codercom/example-$image:$TAG" + example_image_ref_date="${example_image_ref}-${date_str}" image_path="$image_dir/$image_file" if [ ! -f "$image_path" ]; then @@ -104,7 +106,14 @@ for image in "${IMAGES[@]}"; do fi build_id=$(cat "build_${image}.json" | jq -r .\[\"depot.build\"\].buildID) - run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$image_ref" "$build_id" - run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$image_ref_date" "$build_id" + + # Push example images (primary) + run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$example_image_ref" "$build_id" + run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$example_image_ref_date" "$build_id" + run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/example-${image}:latest" "$build_id" + + # Push enterprise images (alias) + run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$enterprise_image_ref" "$build_id" + run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$enterprise_image_ref_date" "$build_id" run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/enterprise-${image}:latest" "$build_id" done diff --git a/scripts/scan_images.sh b/scripts/scan_images.sh index c9c7412..2b70629 100755 --- a/scripts/scan_images.sh +++ b/scripts/scan_images.sh @@ -103,58 +103,62 @@ trivy_tmp_dir="$(mktemp -d -p "$PROJECT_ROOT")" trap 'rm -rf "$tmp_dir" "$trivy_tmp_dir"' EXIT +PREFIXES=("example" "enterprise") + for image in "${IMAGES[@]}"; do - image_ref="codercom/enterprise-${image}:${TAG}" - image_name="${image}-${TAG}" - output="${tmp_dir}/${image}-${TAG}.sarif" - - if ! docker image inspect "$image_ref" >/dev/null 2>&1; then - echo "Image '$image_ref' does not exist locally; skipping" >&2 - continue - fi - - old_tmpdir="${TMPDIR:-}" - export TMPDIR="$trivy_tmp_dir" - - # The timeout is set to 15 minutes because in Java images it can take a while - # to scan JAR files for vulnerabilities. - run_trace $DRY_RUN trivy image \ - --severity CRITICAL,HIGH \ - --format sarif \ - --output "$output" \ - --timeout 15m0s \ - "$image_ref" 2>&1 | indent - - if [ "$old_tmpdir" = "" ]; then - unset TMPDIR - else - export TMPDIR="$old_tmpdir" - fi - - if [ $DRY_RUN = true ]; then - continue - fi - - if [ ! -f "$output" ]; then - echo "No SARIF output found for image '$image_ref' at '$output'" >&2 - exit 1 - fi - - # Do substitutions to add extra details to every message. Without these - # substitutions, most messages won't have any information about which image - # the vulnerability was found in. - jq \ - ".runs[].tool.driver.name |= \"Trivy ${image_name}\"" \ - "$output" >"$output.tmp" - mv "$output.tmp" "$output" - jq \ - ".runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \"${image_name}/\" + ." \ - "$output" >"$output.tmp" - mv "$output.tmp" "$output" - jq \ - ".runs[].results[].locations[].message.text |= \"${image_name}: \" + ." \ - "$output" >"$output.tmp" - mv "$output.tmp" "$output" + for prefix in "${PREFIXES[@]}"; do + image_ref="codercom/${prefix}-${image}:${TAG}" + image_name="${prefix}-${image}-${TAG}" + output="${tmp_dir}/${prefix}-${image}-${TAG}.sarif" + + if ! docker image inspect "$image_ref" >/dev/null 2>&1; then + echo "Image '$image_ref' does not exist locally; skipping" >&2 + continue + fi + + old_tmpdir="${TMPDIR:-}" + export TMPDIR="$trivy_tmp_dir" + + # The timeout is set to 15 minutes because in Java images it can take a while + # to scan JAR files for vulnerabilities. + run_trace $DRY_RUN trivy image \ + --severity CRITICAL,HIGH \ + --format sarif \ + --output "$output" \ + --timeout 15m0s \ + "$image_ref" 2>&1 | indent + + if [ "$old_tmpdir" = "" ]; then + unset TMPDIR + else + export TMPDIR="$old_tmpdir" + fi + + if [ $DRY_RUN = true ]; then + continue + fi + + if [ ! -f "$output" ]; then + echo "No SARIF output found for image '$image_ref' at '$output'" >&2 + exit 1 + fi + + # Do substitutions to add extra details to every message. Without these + # substitutions, most messages won't have any information about which image + # the vulnerability was found in. + jq \ + ".runs[].tool.driver.name |= \"Trivy ${image_name}\"" \ + "$output" >"$output.tmp" + mv "$output.tmp" "$output" + jq \ + ".runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \"${image_name}/\" + ." \ + "$output" >"$output.tmp" + mv "$output.tmp" "$output" + jq \ + ".runs[].results[].locations[].message.text |= \"${image_name}: \" + ." \ + "$output" >"$output.tmp" + mv "$output.tmp" "$output" + done done # Merge all SARIF files into one.