@@ -14,29 +14,35 @@ ARG STACKABLE_USER_UID
1414USER ${STACKABLE_USER_UID}
1515WORKDIR /stackable
1616
17+ COPY --chown=${STACKABLE_USER_UID}:0 kafka/stackable/jmx/ /stackable/jmx/
1718COPY --chown=${STACKABLE_USER_UID}:0 kafka/stackable/patches/${PRODUCT} /stackable/src/kafka/stackable/patches/${PRODUCT}
1819
19- RUN cd "$(/stackable/patchable --images-repo-root=src checkout kafka ${PRODUCT})" && \
20- # TODO: Try to install gradle via package manager (if possible) instead of fetching it from the internet
21- # We don't specify "-x test" to skip the tests, as we might bump some Kafka internal dependencies in the future and
22- # it's a good idea to run the tests in this case.
23- ./gradlew clean releaseTarGz && \
24- ./gradlew cyclonedxBom && \
25- tar -xf core/build/distributions/kafka_${SCALA}-${PRODUCT}.tgz -C /stackable && \
26- cp build/reports/bom.json /stackable/kafka_${SCALA}-${PRODUCT}.cdx.json && \
27- rm -rf /stackable/kafka_${SCALA}-${PRODUCT}/site-docs/ && \
28- rm -rf /stackable/kafka-${PRODUCT}-src
20+ RUN <<EOF
21+ cd "$(/stackable/patchable --images-repo-root=src checkout kafka ${PRODUCT})"
22+
23+ # TODO: Try to install gradle via package manager (if possible) instead of fetching it from the internet
24+ # We don't specify "-x test" to skip the tests, as we might bump some Kafka internal dependencies in the future and
25+ # it's a good idea to run the tests in this case.
26+ ./gradlew clean releaseTarGz
27+ ./gradlew cyclonedxBom
28+ tar -xf core/build/distributions/kafka_${SCALA}-${PRODUCT}.tgz -C /stackable
29+ cp build/reports/bom.json /stackable/kafka_${SCALA}-${PRODUCT}.cdx.json
30+ rm -rf /stackable/kafka_${SCALA}-${PRODUCT}/site-docs/
31+ (cd .. && rm -rf ${PRODUCT})
2932
3033# TODO (@NickLarsenNZ): Compile from source: https://github.com/StyraInc/opa-kafka-plugin
31- RUN curl https://repo.stackable.tech/repository/packages/kafka-opa-authorizer/opa-authorizer-${OPA_AUTHORIZER}-all.jar \
32- -o /stackable/kafka_${SCALA}-${PRODUCT}/libs/opa-authorizer-${OPA_AUTHORIZER}-all.jar
34+ curl https://repo.stackable.tech/repository/packages/kafka-opa-authorizer/opa-authorizer-${OPA_AUTHORIZER}-all.jar \
35+ -o /stackable/kafka_${SCALA}-${PRODUCT}/libs/opa-authorizer-${OPA_AUTHORIZER}-all.jar
3336
34- COPY --chown=${STACKABLE_USER_UID}:0 kafka/stackable/jmx/ /stackable/jmx/
35- RUN curl https://repo.stackable.tech/repository/packages/jmx-exporter/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar \
36- -o /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar && \
37- chmod +x /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar && \
38- ln -s /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar /stackable/jmx/jmx_prometheus_javaagent.jar
37+ # JMX exporter
38+ curl https://repo.stackable.tech/repository/packages/jmx-exporter/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar \
39+ -o /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar
40+ chmod +x /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar
41+ ln -s /stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar /stackable/jmx/jmx_prometheus_javaagent.jar
3942
43+ # change groups
44+ chmod -R g=u /stackable
45+ EOF
4046
4147FROM stackable/image/java-base AS final
4248
@@ -46,21 +52,23 @@ ARG SCALA
4652ARG KCAT
4753ARG STACKABLE_USER_UID
4854
49- LABEL name="Apache Kafka" \
50- 51- vendor="Stackable GmbH" \
52- version="${PRODUCT}" \
53- release="${RELEASE}" \
54- summary="The Stackable image for Apache Kafka." \
55- description="This image is deployed by the Stackable Operator for Apache Kafka."
55+ LABEL \
56+ name="Apache Kafka" \
57+ 58+ vendor="Stackable GmbH" \
59+ version="${PRODUCT}" \
60+ release="${RELEASE}" \
61+ summary="The Stackable image for Apache Kafka." \
62+ description="This image is deployed by the Stackable Operator for Apache Kafka."
5663
57- COPY --chown=${STACKABLE_USER_UID}:0 kafka/licenses /licenses
5864COPY --chown=${STACKABLE_USER_UID}:0 --from=kafka-builder /stackable/kafka_${SCALA}-${PRODUCT} /stackable/kafka_${SCALA}-${PRODUCT}
5965COPY --chown=${STACKABLE_USER_UID}:0 --from=kafka-builder /stackable/kafka_${SCALA}-${PRODUCT}.cdx.json /stackable/kafka_${SCALA}-${PRODUCT}/kafka_${SCALA}-${PRODUCT}.cdx.json
6066COPY --chown=${STACKABLE_USER_UID}:0 --from=kafka-builder /stackable/jmx/ /stackable/jmx/
6167COPY --chown=${STACKABLE_USER_UID}:0 --from=kcat /stackable/kcat-${KCAT}/kcat /stackable/bin/kcat-${KCAT}
6268COPY --chown=${STACKABLE_USER_UID}:0 --from=kcat /licenses /licenses
6369
70+ COPY --chown=${STACKABLE_USER_UID}:0 kafka/licenses /licenses
71+
6472WORKDIR /stackable
6573
6674RUN <<EOF
@@ -71,24 +79,39 @@ microdnf install \
7179
7280microdnf clean all
7381rpm -qa --qf "%{NAME}-%{VERSION}-%{RELEASE}\n " | sort > /stackable/package_manifest.txt
82+ chown ${STACKABLE_USER_UID}:0 /stackable/package_manifest.txt
83+ chmod g=u /stackable/package_manifest.txt
7484rm -rf /var/cache/yum
7585
7686ln -s /stackable/bin/kcat-${KCAT} /stackable/bin/kcat
87+ chown -h ${STACKABLE_USER_UID}:0 /stackable/bin/kcat
7788# kcat was located in /stackable/kcat - legacy
7889ln -s /stackable/bin/kcat /stackable/kcat
90+ chown -h ${STACKABLE_USER_UID}:0 /stackable/kcat
7991ln -s /stackable/kafka_${SCALA}-${PRODUCT} /stackable/kafka
92+ chown -h ${STACKABLE_USER_UID}:0 /stackable/kafka
8093
81- # All files and folders owned by root group to support running as arbitrary users.
82- # This is best practice as all container users will belong to the root group (0).
83- chown -R ${STACKABLE_USER_UID}:0 /stackable
84- chmod -R g=u /stackable
94+ # fix missing permissions
95+ chmod g=u /stackable/bin
96+ chmod g=u /stackable/jmx
97+ chmod g=u /stackable/kafka_${SCALA}-${PRODUCT}
98+ EOF
99+
100+ # ----------------------------------------
101+ # Checks
102+ # This section is to run final checks to ensure the created final images
103+ # adhere to several minimal requirements like:
104+ # - check file permissions and ownerships
105+ # ----------------------------------------
106+
107+ # Check that permissions and ownership in /stackable are set correctly
108+ # This will fail and stop the build if any mismatches are found.
109+ RUN <<EOF
110+ /bin/check-permissions-ownership.sh /stackable ${STACKABLE_USER_UID} 0
85111EOF
86112
87113# ----------------------------------------
88- # Attention: We are changing the group of all files in /stackable directly above
89- # If you do any file based actions (copying / creating etc.) below this comment you
90- # absolutely need to make sure that the correct permissions are applied!
91- # chown ${STACKABLE_USER_UID}:0
114+ # Attention: Do not perform any file based actions (copying/creating etc.) below this comment because the permissions would not be checked.
92115# ----------------------------------------
93116
94117USER ${STACKABLE_USER_UID}
0 commit comments