Skip to content

Commit 35d1b79

Browse files
lfranckerazvan
lfrancke
and
razvan
authored
Move base image to new heredoc format (#780)
* Move base image to new heredoc format There are no functional changes * Hadolint * Hadolint * Update stackable-base/Dockerfile Co-authored-by: Razvan-Daniel Mihai <[email protected]> --------- Co-authored-by: Razvan-Daniel Mihai <[email protected]>
1 parent c254621 commit 35d1b79

File tree

2 files changed

+97
-65
lines changed

2 files changed

+97
-65
lines changed

‎.hadolint.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ ignored:
2525
# Reason: We inherit the SHELL from our base image and that sets it
2626
- DL4006
2727

28+
# Not following: File not included in mock.
29+
# https://www.shellcheck.net/wiki/SC1091
30+
# Reason: I've yet to see this being useful, where this happens we usually have no way to actually provide the file
31+
- SC1091
32+
2833
# Use cd ... || exit in case cd fails.
2934
# https://github.com/koalaman/shellcheck/wiki/SC2164
3035
# Reason: Ignoring because we inherit SHELL from the base image which contains "-e" for bash

‎stackable-base/Dockerfile

Lines changed: 92 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -9,21 +9,25 @@ ENV RUST_DEFAULT_TOOLCHAIN_VERSION=1.79.0
99
ENV CARGO_CYCLONEDX_CRATE_VERSION=0.4.0
1010
ENV CARGO_AUDITABLE_CRATE_VERSION=0.6.4
1111

12-
RUN microdnf update --assumeyes && \
13-
microdnf --assumeyes install \
14-
# Needed to fetch source
15-
git \
16-
# Needed for compilation
17-
gcc && \
18-
microdnf clean all
19-
20-
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $RUST_DEFAULT_TOOLCHAIN_VERSION && \
21-
. "$HOME/.cargo/env" && cargo install cargo-cyclonedx@$CARGO_CYCLONEDX_CRATE_VERSION cargo-auditable@$CARGO_AUDITABLE_CRATE_VERSION
22-
23-
RUN git clone --depth 1 --branch ${CONFIG_UTILS_VERSION} https://github.com/stackabletech/config-utils
24-
RUN cd ./config-utils && \
25-
. $HOME/.cargo/env && \
26-
cargo auditable build --release && cargo cyclonedx --output-pattern package --all --output-cdx
12+
RUN <<EOF
13+
microdnf update --assumeyes
14+
15+
# git: Needed to fetch source
16+
# gcc: Needed for compilation
17+
microdnf --assumeyes install \
18+
gcc \
19+
git
20+
microdnf clean all
21+
rm -rf /var/cache/yum
22+
23+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain "$RUST_DEFAULT_TOOLCHAIN_VERSION"
24+
. "$HOME/.cargo/env" && cargo install cargo-cyclonedx@"$CARGO_CYCLONEDX_CRATE_VERSION" cargo-auditable@"$CARGO_AUDITABLE_CRATE_VERSION"
25+
26+
git clone --depth 1 --branch "${CONFIG_UTILS_VERSION}" https://github.com/stackabletech/config-utils
27+
cd ./config-utils
28+
. "$HOME/.cargo/env"
29+
cargo auditable build --release && cargo cyclonedx --output-pattern package --all --output-cdx
30+
EOF
2731

2832
# Manifest list digest because of multi architecture builds ( https://www.redhat.com/architect/pull-container-image#:~:text=A%20manifest%20list%20exists%20to,system%20on%20a%20specific%20architecture )
2933
FROM registry.access.redhat.com/ubi9-minimal@sha256:a7d837b00520a32502ada85ae339e33510cdfdbc8d2ddf460cc838e12ec5fa5a AS final
@@ -49,63 +53,86 @@ SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
4953
# https://github.com/stackabletech/docker-images/pull/533
5054
COPY stackable-base/stackable/dnf.conf /etc/dnf/dnf.conf
5155

52-
RUN microdnf update --assumeyes && \
53-
microdnf --assumeyes install \
54-
# To make debugging easier, includes things like ping \
55-
# Added 2024-03: We cannot find any vulnerabilities in the past years \
56-
# https://github.com/iputils/iputils \
57-
iputils \
58-
# To make debugging easier \
59-
# Added 2024-03: less has seen three vulnerabilities between 2004 and 2022 which is a risk we're willing to accept for the added convenience \
60-
# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Agnu&cpe_product=cpe%3A%2F%3A%3Aless \
61-
# cpe:2.3:a:gnu:less:*:*:*:*:*:*:*:*
62-
less \
63-
# To make debugging and changing things easier \
64-
# Added 2024-03: We checked and it has not seen any vulnerabilities since 2010 (as of 2024-03) we decided to accept it into our base image \
65-
# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=cpe%3A2.3%3Aa%3Agnu%3Anano&search_type=all&isCpeNameSearch=false
66-
# cpe:2.3:a:gnu:nano:*:*:*:*:*:*:*:*
67-
nano \
68-
# To enable kubectl cp \
69-
# Added 2024-03: We checked and it has seen eight vulnerabilities since 2001, mostly minor and it's not in executable path so we decided to accept the risk \
70-
# https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Agnu%3Atar%3A-%3A*%3A*%3A*%3A*%3A*%3A*%3A*
71-
# cpe:2.3:a:gnu:tar:-:*:*:*:*:*:*:* \
72-
tar \
73-
# Added only temporarily, removed again below
74-
shadow-utils && \
75-
groupadd --gid 1000 --system stackable && \
76-
useradd --gid stackable --uid 1000 --system stackable -d /stackable && \
77-
mkdir /stackable && \
78-
chown stackable:stackable /stackable && \
79-
microdnf remove shadow-utils && \
80-
microdnf clean all && \
81-
echo "alias ll='ls -alF --color=auto'" >> /stackable/.bashrc && \
82-
echo "alias ls='ls --color=auto'" >> /stackable/.bashrc && \
83-
echo "alias ..='cd ..'" >> /stackable/.bashrc && \
84-
echo "export PS1='\u@\[\e[36m\]\H\[\e[m\] \[\e[32m\]\$(pwd)\[\e[m\] \\$ '" >> /stackable/.bashrc && \
85-
echo -e "if [ -f ~/.bashrc ]; then\n\tsource ~/.bashrc\nfi" >> /stackable/.profile && \
86-
chown stackable:stackable /stackable/.bashrc && \
87-
chown stackable:stackable /stackable/.profile
56+
57+
# echo won't expand escape sequences. Consider printf.
58+
# https://github.com/koalaman/shellcheck/wiki/SC2028
59+
# Reason: This is complaining about the complicated PS1 statement.
60+
# It seems to work as intended so I'm not going to touch it!
61+
# hadolint ignore=SC2028
62+
RUN <<EOF
63+
microdnf update
64+
65+
# **iputils**
66+
# To make debugging easier, includes things like ping
67+
# Added 2024-03: We cannot find any vulnerabilities in the past years
68+
# https://github.com/iputils/iputils
69+
#
70+
# **less**
71+
# To make debugging easier
72+
# Added 2024-03: less has seen three vulnerabilities between 2004 and 2022 which is a risk we're willing to accept for the added convenience
73+
# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Agnu&cpe_product=cpe%3A%2F%3A%3Aless
74+
# cpe:2.3:a:gnu:less:*:*:*:*:*:*:*:*
75+
#
76+
# **nano**
77+
# To make debugging and changing things easier
78+
# Added 2024-03: We checked and it has not seen any vulnerabilities since 2010 (as of 2024-03) we decided to accept it into our base image
79+
# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=cpe%3A2.3%3Aa%3Agnu%3Anano&search_type=all&isCpeNameSearch=false
80+
# cpe:2.3:a:gnu:nano:*:*:*:*:*:*:*:*
81+
#
82+
# **tar**
83+
# To enable kubectl cp
84+
# Added 2024-03: We checked and it has seen eight vulnerabilities since 2001, mostly minor and it's not in executable path so we decided to accept the risk
85+
# https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Agnu%3Atar%3A-%3A*%3A*%3A*%3A*%3A*%3A*%3A*
86+
# cpe:2.3:a:gnu:tar:-:*:*:*:*:*:*:*
87+
microdnf install \
88+
iputils \
89+
less \
90+
nano \
91+
tar
92+
93+
# Added only temporarily to create the user and group, removed again below
94+
microdnf install shadow-utils
95+
groupadd --gid 1000 --system stackable
96+
useradd --gid stackable --uid 1000 --system stackable -d /stackable
97+
98+
mkdir /stackable
99+
chown stackable:stackable /stackable
100+
microdnf remove shadow-utils
101+
microdnf clean all
102+
103+
{
104+
echo "alias ll='ls -alF --color=auto'"
105+
echo "alias ls='ls --color=auto'"
106+
echo "alias ..='cd ..'"
107+
echo "export PS1='\u@\[\e[36m\]\H\[\e[m\] \[\e[32m\]\$(pwd)\[\e[m\] \\$ '"
108+
} >> /stackable/.bashrc
109+
110+
echo -e "if [ -f ~/.bashrc ]; then\n\tsource ~/.bashrc\nfi" >> /stackable/.profile
111+
112+
chown stackable:stackable /stackable/.bashrc
113+
chown stackable:stackable /stackable/.profile
88114

89115
# CVE-2023-37920: Remove "e-Tugra" root certificates
90116
# e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems
91117
# The package ca-certificates 2023.07.22 fixes the problem, until ubi9-minimal updates to it, we should remove them
92118
# manually.
93-
94-
RUN if [ "$(rpm -qa ca-certificates)" != "ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch" ]; then \
95-
echo "The ca-certificates package was updated. Please check if the e-Tugra root certificates are present. \
96-
When they have been removed, manually blacklisting them should be removed" && \
97-
echo "Let me help you by running trust list --filter=ca-anchors | grep 'E-Tugra'" && \
98-
trust list --filter=ca-anchors | grep 'E-Tugra' && \
99-
exit 1; \
100-
fi
119+
if [ "$(rpm -qa ca-certificates)" != "ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch" ]; then
120+
echo "The ca-certificates package was updated. Please check if the e-Tugra root certificates are present. \
121+
When they have been removed, manually blacklisting them should be removed"
122+
echo "Let me help you by running trust list --filter=ca-anchors | grep 'E-Tugra'"
123+
trust list --filter=ca-anchors | grep 'E-Tugra'
124+
exit 1;
125+
fi
126+
EOF
101127

102128
COPY stackable-base/stackable/ca-cert-blocklist/ /etc/pki/ca-trust/source/blocklist/
103-
104-
RUN update-ca-trust && \
105-
if [ "$(trust list --filter=ca-anchors | grep -c 'E-Tugra')" != "0" ]; then \
106-
echo "Still found E-Tugra root certificates, this should not happen!" && \
107-
exit 1; \
108-
fi
129+
RUN <<EOF
130+
update-ca-trust
131+
if [ "$(trust list --filter=ca-anchors | grep -c 'E-Tugra')" != "0" ]; then
132+
echo "Still found E-Tugra root certificates, this should not happen!"
133+
exit 1;
134+
fi
135+
EOF
109136

110137
COPY --from=product-utils-builder --chown=stackable:stackable /config-utils/target/release/config-utils /stackable/config-utils
111138
COPY --from=product-utils-builder --chown=stackable:stackable /config-utils/config-utils.cdx.xml /stackable/config-utils.cdx.xml

0 commit comments

Comments
 (0)