Skip to content

Commit 9fb6d15

Browse files
committed
Merge branch 'feature/PB-44239-make-openshift-compatible-nonroot-container' into 'master'
Feature/pb 44239 make openshift compatible nonroot container See merge request passbolt/passbolt_docker!237
2 parents a41b6ea + 639c656 commit 9fb6d15

File tree

7 files changed

+391
-0
lines changed

7 files changed

+391
-0
lines changed

.gitlab-ci/Jobs/build_image.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,3 +227,21 @@ build-pro-stable-rootless-arm-v7:
227227
PLATFORM: "linux/arm/v7"
228228
SUPERCRONIC_ARCH: arm
229229
SUPERCRONIC_SHA1SUM: 510b84b031b78ebe25b1f00c91ced3434edcd383
230+
231+
build-ce-stable-openshift:
232+
extends: .stable-build
233+
variables:
234+
DOCKERFILE_PATH: "debian/Dockerfile.openshift"
235+
DOCKER_TAG: "openshift"
236+
SUPERCRONIC_ARCH: amd64
237+
SUPERCRONIC_SHA1SUM: bc072eba2ae083849d5f86c6bd1f345f6ed902d0
238+
PLATFORM: "linux/amd64"
239+
240+
build-pro-stable-openshift:
241+
extends: .stable-build-pro
242+
variables:
243+
DOCKERFILE_PATH: "debian/Dockerfile.openshift"
244+
DOCKER_TAG: "openshift"
245+
SUPERCRONIC_ARCH: amd64
246+
SUPERCRONIC_SHA1SUM: bc072eba2ae083849d5f86c6bd1f345f6ed902d0
247+
PLATFORM: "linux/amd64"

.gitlab-ci/Jobs/publish.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,30 @@ publish-pro-non-root:
142142
rules:
143143
- if: '$PASSBOLT_VERSION && $CI_COMMIT_BRANCH == "master" && $PASSBOLT_PUBLISH == "pro"'
144144
when: on_success
145+
publish-ce-openshift:
146+
extends: .publish
147+
variables:
148+
DOCKER_TAG: "openshift"
149+
PASSBOLT_FLAVOUR: "ce"
150+
PASSBOLT_IMAGE_FLAVOUR: "ce-openshift"
151+
script:
152+
- *manifest-yaml
153+
- ./manifest-tool-linux-amd64 push from-spec manifests.yaml
154+
- crane cp "${CI_REGISTRY_IMAGE}:latest-${PASSBOLT_IMAGE_FLAVOUR}" "${DOCKER_HUB_PASSBOLT_REGISTRY}:latest-${PASSBOLT_IMAGE_FLAVOUR}"
155+
- crane cp "${CI_REGISTRY_IMAGE}:${PASSBOLT_VERSION}-${PASSBOLT_IMAGE_FLAVOUR}" "${DOCKER_HUB_PASSBOLT_REGISTRY}:${PASSBOLT_VERSION}-${PASSBOLT_IMAGE_FLAVOUR}"
156+
- 'bash .gitlab-ci/scripts/bin/slack-status-messages.sh ":whale: $PASSBOLT_VERSION $PASSBOLT_IMAGE_FLAVOUR docker image has been published" "$CI_PROJECT_URL/-/jobs/$CI_JOB_ID"'
157+
publish-pro-openshift:
158+
extends: .publish
159+
variables:
160+
DOCKER_TAG: "openshift"
161+
PASSBOLT_FLAVOUR: "pro"
162+
PASSBOLT_IMAGE_FLAVOUR: "pro-openshift"
163+
script:
164+
- *manifest-yaml
165+
- ./manifest-tool-linux-amd64 push from-spec manifests.yaml
166+
- crane cp "${CI_REGISTRY_IMAGE}:latest-${PASSBOLT_IMAGE_FLAVOUR}" "${DOCKER_HUB_PASSBOLT_REGISTRY}:latest-${PASSBOLT_IMAGE_FLAVOUR}"
167+
- crane cp "${CI_REGISTRY_IMAGE}:${PASSBOLT_VERSION}-${PASSBOLT_IMAGE_FLAVOUR}" "${DOCKER_HUB_PASSBOLT_REGISTRY}:${PASSBOLT_VERSION}-${PASSBOLT_IMAGE_FLAVOUR}"
168+
- 'bash .gitlab-ci/scripts/bin/slack-status-messages.sh ":whale: $PASSBOLT_VERSION $PASSBOLT_IMAGE_FLAVOUR docker image has been published" "$CI_PROJECT_URL/-/jobs/$CI_JOB_ID"'
169+
rules:
170+
- if: '$PASSBOLT_VERSION && $CI_COMMIT_BRANCH == "master" && $PASSBOLT_PUBLISH == "pro"'
171+
when: on_success

.gitlab-ci/Jobs/test_images.yaml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,51 @@ pro-non-root-docker-runtime-with-passbolt-php:
112112
variables:
113113
TEST_NAME: docker_runtime_with_passbolt_php
114114
ROOTLESS: "true"
115+
116+
ce-openshift-docker-image:
117+
extends: .test-images
118+
variables:
119+
TEST_NAME: docker_image
120+
ROOTLESS: "true"
121+
122+
ce-openshift-docker-runtime:
123+
extends: .test-images
124+
variables:
125+
TEST_NAME: docker_runtime
126+
ROOTLESS: "true"
127+
128+
ce-openshift-docker-runtime-no-envs:
129+
extends: .test-images
130+
variables:
131+
TEST_NAME: docker_runtime_no_envs
132+
ROOTLESS: "true"
133+
134+
ce-openshift-docker-runtime-with-passbolt-php:
135+
extends: .test-images
136+
variables:
137+
TEST_NAME: docker_runtime_with_passbolt_php
138+
ROOTLESS: "true"
139+
140+
pro-openshift-docker-image:
141+
extends: .test-pro-images
142+
variables:
143+
TEST_NAME: docker_image
144+
ROOTLESS: "true"
145+
146+
pro-openshift-docker-runtime:
147+
extends: .test-pro-images
148+
variables:
149+
TEST_NAME: docker_runtime
150+
ROOTLESS: "true"
151+
152+
pro-openshift-docker-runtime-no-envs:
153+
extends: .test-pro-images
154+
variables:
155+
TEST_NAME: docker_runtime_no_envs
156+
ROOTLESS: "true"
157+
158+
pro-openshift-docker-runtime-with-passbolt-php:
159+
extends: .test-images
160+
variables:
161+
TEST_NAME: docker_runtime_with_passbolt_php
162+
ROOTLESS: "true"

.gitlab-ci/Jobs/test_vulnerabilities.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,17 @@ docker-pro-rootless:
3636
PASSBOLT_FLAVOUR: "pro"
3737
DOCKER_TAG: "rootless"
3838
OPPOSITE_FLAVOUR: "ce"
39+
40+
docker-pro-openshift:
41+
extends: .test-vulnerabilities
42+
variables:
43+
PASSBOLT_FLAVOUR: "pro"
44+
DOCKER_TAG: "openshift"
45+
OPPOSITE_FLAVOUR: "ce"
46+
47+
docker-ce-openshift:
48+
extends: .test-vulnerabilities
49+
variables:
50+
PASSBOLT_FLAVOUR: "ce"
51+
DOCKER_TAG: "openshift"
52+
OPPOSITE_FLAVOUR: "pro"

debian/Dockerfile.openshift

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
FROM debian:trixie-slim
2+
3+
ARG API_REPOSITORY="https://github.com/passbolt/passbolt_api"
4+
ARG IMAGE_DESCRIPTION="Passbolt CE Backend, a JSON API written with CakePHP"
5+
ARG BUILD_DATE=""
6+
7+
LABEL org.opencontainers.image.created="${BUILD_DATE}"
8+
LABEL org.opencontainers.image.description="${IMAGE_DESCRIPTION}"
9+
LABEL org.opencontainers.image.documentation=https://help.passbolt.com/
10+
LABEL org.opencontainers.image.authors="Passbolt SA <[email protected]>"
11+
LABEL org.opencontainers.image.licenses=AGPL-3.0-only
12+
LABEL org.opencontainers.image.source="${API_REPOSITORY}"
13+
LABEL org.opencontainers.image.title=passbolt/passbolt
14+
LABEL org.opencontainers.image.url=https://passbolt.com
15+
16+
ARG SUPERCRONIC_ARCH=amd64
17+
ARG SUPERCRONIC_SHA1SUM=bc072eba2ae083849d5f86c6bd1f345f6ed902d0
18+
19+
ARG PASSBOLT_DISTRO="buster"
20+
ARG PASSBOLT_COMPONENT="stable"
21+
ARG PASSBOLT_SERVER_KEY="https://download.passbolt.com"
22+
ARG PASSBOLT_FLAVOUR="ce"
23+
ARG PASSBOLT_PKG=passbolt-$PASSBOLT_FLAVOUR-server
24+
ARG PASSBOLT_REPO_URL="https://download.passbolt.com"
25+
ARG PASSBOLT_REPO_KEY_PATH="/usr/share/keyrings/passbolt-repository.gpg"
26+
ARG PASSBOLT_SOURCES_LIST_PATH="/etc/apt/sources.list.d/passbolt.sources"
27+
28+
ARG PASSBOLT_USER_UID=33
29+
ARG PASSBOLT_GROUP_GID=33
30+
31+
ENV PASSBOLT_PKG_KEY=0xDE8B853FC155581D
32+
ENV PHP_VERSION=8.4
33+
ENV GNUPGHOME=/var/lib/passbolt/.gnupg
34+
ENV SUPERCRONIC_VERSION=0.2.38
35+
ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v${SUPERCRONIC_VERSION}/supercronic-linux-${SUPERCRONIC_ARCH} \
36+
SUPERCRONIC=supercronic-linux-${SUPERCRONIC_ARCH}
37+
ENV PASSBOLT_FLAVOUR="${PASSBOLT_FLAVOUR}"
38+
ENV LOG_ERROR_URL="console://?levels[]=warning&levels[]=error&levels[]=critical&levels[]=alert&levels[]=emergency"
39+
40+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
41+
42+
RUN usermod -u $PASSBOLT_USER_UID www-data \
43+
&& groupmod -g $PASSBOLT_GROUP_GID www-data
44+
45+
RUN apt-get update \
46+
&& DEBIAN_FRONTEND=non-interactive apt-get -y install \
47+
ca-certificates \
48+
gnupg \
49+
curl \
50+
&& curl -s $PASSBOLT_SERVER_KEY/pub.key |\
51+
gpg --dearmor | tee $PASSBOLT_REPO_KEY_PATH > /dev/null \
52+
&& chmod 644 $PASSBOLT_REPO_KEY_PATH \
53+
&& echo -e "Types: deb \nURIs: $PASSBOLT_REPO_URL/$PASSBOLT_FLAVOUR/debian \nSuites: $PASSBOLT_DISTRO \nComponents: $PASSBOLT_COMPONENT \nSigned-By: $PASSBOLT_REPO_KEY_PATH" > $PASSBOLT_SOURCES_LIST_PATH \
54+
&& apt-get update \
55+
&& DEBIAN_FRONTEND=non-interactive apt-get -y install --no-install-recommends \
56+
nginx \
57+
$PASSBOLT_PKG \
58+
supervisor \
59+
&& rm -f /etc/passbolt/jwt/* \
60+
&& curl -fsSLO "$SUPERCRONIC_URL" \
61+
&& echo "${SUPERCRONIC_SHA1SUM} ${SUPERCRONIC}" | sha1sum -c - \
62+
&& chmod +x "$SUPERCRONIC" \
63+
&& mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
64+
&& ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
65+
66+
COPY conf/supervisor/cron.conf.rootless /etc/supervisor/conf.d/cron.conf
67+
COPY conf/supervisor/nginx.conf /etc/supervisor/conf.d/nginx.conf
68+
COPY conf/supervisor/php.conf /etc/supervisor/conf.d/php.conf
69+
70+
RUN sed -i 's,listen 80;,listen 8080;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \
71+
&& sed -i 's,listen \[\:\:\]\:80;,listen \[\:\:\]\:8080;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \
72+
&& rm /etc/nginx/sites-enabled/default \
73+
&& cp /usr/share/passbolt/examples/nginx-passbolt-ssl.conf /etc/nginx/snippets/passbolt-ssl.conf \
74+
&& sed -i 's,;clear_env = no,clear_env = no,' /etc/php/$PHP_VERSION/fpm/pool.d/www.conf \
75+
&& sed -i 's,# include __PASSBOLT_SSL__,include /etc/nginx/snippets/passbolt-ssl.conf;,' /etc/nginx/sites-enabled/nginx-passbolt.conf \
76+
&& sed -i 's,listen \[\:\:\]\:443 ssl http2;,listen \[\:\:\]\:4433 ssl http2;,' /etc/nginx/snippets/passbolt-ssl.conf \
77+
&& sed -i '/listen \[\:\:\]\:4433 ssl http2;/a \ \ listen 4433 ssl http2;' /etc/nginx/snippets/passbolt-ssl.conf \
78+
&& sed -i 's,__CERT_PATH__,/etc/passbolt/certs/certificate.crt;,' /etc/nginx/snippets/passbolt-ssl.conf \
79+
&& sed -i 's,__KEY_PATH__,/etc/passbolt/certs/certificate.key;,' /etc/nginx/snippets/passbolt-ssl.conf \
80+
&& sed -i '/user www-data;/d' /etc/nginx/nginx.conf \
81+
&& sed -i 's,/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf \
82+
&& sed -i "/^http {/a \ proxy_temp_path /tmp/proxy_temp;\n client_body_temp_path /tmp/client_temp;\n fastcgi_temp_path /tmp/fastcgi_temp;\n uwsgi_temp_path /tmp/uwsgi_temp;\n scgi_temp_path /tmp/scgi_temp;\n" /etc/nginx/nginx.conf \
83+
&& sed -i "s,listen = /run/php/php$PHP_VERSION-fpm.sock,listen = 127.0.0.1:9000," /etc/php/$PHP_VERSION/fpm/pool.d/www.conf \
84+
&& sed -i "s,unix:/run/php/php$PHP_VERSION-fpm.sock,127.0.0.1:9000," /etc/nginx/sites-enabled/nginx-passbolt.conf \
85+
&& sed -i "s,pid = /run/php/php$PHP_VERSION-fpm.pid,pid = /tmp/php$PHP_VERSION-fpm.pid," /etc/php/$PHP_VERSION/fpm/php-fpm.conf \
86+
&& sed -i 's,/var/run/supervisor.sock,/tmp/supervisor.sock,' /etc/supervisor/supervisord.conf \
87+
&& chown -R www-data:0 /etc/nginx \
88+
&& chmod -R g+w /etc/nginx \
89+
&& mkdir /etc/passbolt/certs \
90+
&& chown www-data:0 /etc/passbolt/certs \
91+
&& chown www-data:0 /etc/passbolt/jwt \
92+
&& chown www-data:0 /var/log/supervisor \
93+
&& chown www-data:0 /etc/supervisor/conf.d/cron.conf \
94+
&& chown www-data:0 /etc/supervisor/conf.d/php.conf \
95+
&& chown www-data:0 /etc/supervisor/conf.d/nginx.conf \
96+
&& chown -R www-data:0 /var/log/nginx \
97+
&& ln -sf /dev/stdout /var/log/nginx/passbolt-access.log \
98+
&& ln -sf /dev/stderr /var/log/nginx/passbolt-error.log \
99+
&& chown -R www-data:0 /var/log/supervisor \
100+
&& touch /var/www/.profile \
101+
&& chown www-data:0 /var/www/.profile \
102+
&& sed -i 's,www-data\s,,' /etc/cron.d/$PASSBOLT_PKG \
103+
&& sed -i "s,__PASSBOLT_PACKAGE__,$PASSBOLT_PKG," /etc/supervisor/conf.d/cron.conf \
104+
&& touch /etc/environment \
105+
&& chown www-data:0 /etc/environment \
106+
&& chmod 600 /etc/environment
107+
108+
COPY conf/php/zz-docker.conf /etc/php/$PHP_VERSION/fpm/pool.d/zz-docker.conf
109+
COPY scripts/entrypoint/docker-entrypoint.openshift.sh /docker-entrypoint.sh
110+
COPY scripts/entrypoint/passbolt/entrypoint-openshift.sh /passbolt/entrypoint-openshift.sh
111+
COPY scripts/entrypoint/passbolt/env.sh /passbolt/env.sh
112+
COPY scripts/entrypoint/passbolt/deprecated_paths.sh /passbolt/deprecated_paths.sh
113+
COPY scripts/wait-for.sh /usr/bin/wait-for.sh
114+
115+
RUN chmod 0644 /etc/supervisor/conf.d/* \
116+
&& chmod 0755 /docker-entrypoint.sh \
117+
&& chmod 0755 /passbolt/* \
118+
&& chmod 0755 /usr/bin/wait-for.sh
119+
120+
# Changes ownership of some files for Openshift compatibility
121+
RUN chgrp -R 0 /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \
122+
chmod -R g=u /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \
123+
chgrp 0 /var/run && \
124+
chmod g=u /var/run && \
125+
mkdir /var/run/php && \
126+
chgrp -R 0 /var/run/php && \
127+
chmod -R g=u /var/run/php
128+
129+
# Openshift uses a random UID which is added to the root group. This mimics the functionality with the default user we provide.
130+
RUN usermod -a -G root www-data
131+
132+
EXPOSE 8080 4433
133+
134+
WORKDIR /usr/share/php/passbolt
135+
136+
USER www-data
137+
138+
CMD ["/docker-entrypoint.sh"]
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
set -eo pipefail
4+
5+
passbolt_config="/etc/passbolt"
6+
gpg_private_key="${PASSBOLT_GPG_SERVER_KEY_PRIVATE:-$passbolt_config/gpg/serverkey_private.asc}"
7+
gpg_public_key="${PASSBOLT_GPG_SERVER_KEY_PUBLIC:-$passbolt_config/gpg/serverkey.asc}"
8+
9+
ssl_key='/etc/passbolt/certs/certificate.key'
10+
ssl_cert='/etc/passbolt/certs/certificate.crt'
11+
12+
deprecation_message=""
13+
14+
subscription_key_file_paths=("/etc/passbolt/subscription_key.txt" "/etc/passbolt/license")
15+
16+
source $(dirname $0)/../passbolt/entrypoint-openshift.sh
17+
source $(dirname $0)/../passbolt/env.sh
18+
source $(dirname $0)/../passbolt/deprecated_paths.sh
19+
20+
manage_docker_env
21+
22+
check_deprecated_paths
23+
24+
if [ ! -f "$gpg_private_key" ] ||
25+
[ ! -f "$gpg_public_key" ]; then
26+
gpg_gen_key
27+
gpg_import_key
28+
else
29+
gpg_import_key
30+
fi
31+
32+
if [ ! -f "$ssl_key" ] && [ ! -L "$ssl_key" ] &&
33+
[ ! -f "$ssl_cert" ] && [ ! -L "$ssl_cert" ]; then
34+
gen_ssl_cert
35+
fi
36+
37+
install
38+
39+
echo -e "$deprecation_message"
40+
41+
declare -p | grep -Ev 'BASHOPTS|BASH_VERSINFO|EUID|PPID|SHELLOPTS|UID' >/etc/environment
42+
43+
exec /usr/bin/supervisord -n

0 commit comments

Comments
 (0)