fleet-server/Dockerfile.fips at 26f6d4051b5fe824f7d5115ee63cf2bc10e7b876 · elastic/fleet-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
ARG GO_VERSION
# Suffix should be main-debian11-fips or base-arm-debian11-fips
ARG SUFFIX
FROM docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-${SUFFIX} AS base

RUN groupadd --gid 1000 fleet-server && \
    useradd -M -d /fleet-server/ --uid 1000 --gid 1000 fleet-server
USER fleet-server
WORKDIR /fleet-server/

# pre-copy/cache go.mod for pre-downloading dependencies and only redownloading them in subsequent builds if they change
COPY go.mod go.sum ./
RUN go mod download && go mod verify
RUN go install github.com/magefile/mage # uses version in go.mod

ENV PATH="$PATH:/go/bin"
ENV FIPS=true
ENV CGO_ENABLED=1
ENV MAGEFILE_CACHE=/fleet-server/build/.magefile
ENV MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0
ENTRYPOINT [ "mage" ]
CMD [ "build:release" ]

# FIPS docker image defined below
# Does not use base as the lowest layer so we don't have to deal with user/ownership issues when building the image.
ARG GO_VERSION
# Suffix should be main-debian11-fips or base-arm-debian11-fips
ARG SUFFIX
FROM docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-${SUFFIX} AS builder

WORKDIR /fleet-server
ENV PATH="$PATH:/go/bin"
COPY go.mod go.sum ./
RUN go mod download && go mod verify
RUN go install github.com/magefile/mage # uses version in go.mod

COPY . .

ARG GCFLAGS=""
ARG LDFLAGS=""
ARG DEV=""
ARG SNAPSHOT=""
ARG TARGETPLATFORM

RUN MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 FIPS=true CGO_ENABLED=1 GCFLAGS="${GCFLAGS}" LDFLAGS="${LDFLAGS}" SNAPSHOT="${SNAPSHOT}" DEV="${DEV}" PLATFORMS="${TARGETPLATFORM}" mage build:release

FROM docker.elastic.co/wolfi/chainguard-base-fips:latest
ARG VERSION

RUN addgroup --gid 1000 fleet-server && \
    adduser -H -D -u 1000 -G fleet-server fleet-server

USER fleet-server

COPY --chown=fleet-server:fleet-server --chmod=644 fleet-server.yml /etc/fleet-server.yml
COPY --chown=fleet-server:fleet-server --chmod=555 --from=builder /fleet-server/build/binaries/fleet-server-fips-${VERSION}-linux-*/fleet-server /usr/bin/fleet-server

ENV GODEBUG=fips140=on

CMD [ "/usr/bin/fleet-server", "-c", "/etc/fleet-server.yml" ]