Skip to content

Commit 30e6ead

Browse files
jiangpengchengjiangpengcheng
authored
Update runner base image to alpine (#747)
1 parent d3275a8 commit 30e6ead

File tree

10 files changed

+110
-73
lines changed

10 files changed

+110
-73
lines changed

‎.ci/helm.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -453,7 +453,7 @@ function ci::verify_elasticsearch_sink() {
453453

454454
function ci::verify_mongodb_source() {
455455
timesleep=$1
456-
kubectl exec mongo-dbz-0 -c mongo -- mongo -u debezium -p dbz --authenticationDatabase admin localhost:27017/inventory --eval 'db.products.update({"_id":NumberLong(104)},{$set:{weight:1.25}})'
456+
kubectl exec mongo-dbz-0 -c mongo -- mongosh -u debezium -p dbz --authenticationDatabase admin localhost:27017/inventory --eval 'db.products.update({"_id":NumberLong(104)},{$set:{weight:1.25}})'
457457
sleep "$timesleep"
458458
kubectl logs --tail=-1 -l compute.functionmesh.io/name=source-sample | grep "records sent"
459459
if [ $? -eq 0 ]; then

‎.ci/tests/integration/cases/mongodb-source/manifests.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ spec:
2323
cpu: "0.1"
2424
memory: 1G
2525
sourceConfig:
26-
mongodb.hosts: rs0/mongo-dbz-0.mongo.default.svc.cluster.local:27017,rs0/mongo-dbz-1.mongo.default.svc.cluster.local:27017,rs0/mongo-dbz-2.mongo.default.svc.cluster.local:27017
26+
mongodb.hosts: rs0/mongo-dbz-0.mongo.default.svc.cluster.local:27017
2727
mongodb.name: dbserver1
2828
mongodb.user: debezium
2929
mongodb.password: dbz

‎.ci/tests/integration/cases/mongodb-source/mongodb-dbz.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ spec:
3535
matchLabels:
3636
role: mongo
3737
serviceName: "mongo"
38-
replicas: 3
38+
replicas: 1
3939
template:
4040
metadata:
4141
labels:
@@ -44,7 +44,7 @@ spec:
4444
terminationGracePeriodSeconds: 10
4545
containers:
4646
- name: mongo
47-
image: debezium/example-mongodb:0.10
47+
image: debezium/example-mongodb:2.6
4848
env:
4949
- name: MONGODB_USER
5050
value: "debezium"

‎.ci/tests/integration/cases/mongodb-source/verify.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ function install_mongodb_server() {
4545
# install mongodb server
4646
kubectl apply -f "${mongodb_file}"
4747
num=0
48-
while [[ ${num} -lt 3 ]]; do
48+
while [[ ${num} -lt 1 ]]; do
4949
sleep 5
5050
kubectl get pods
5151
num=$(kubectl get pods -l role=mongo | wc -l)

‎.github/workflows/trivy.yml‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,17 @@ on:
1111
- 'LICENSE'
1212
- 'mesh-worker-service/README.md'
1313
- 'tools/README.md'
14+
15+
permissions:
16+
pull-requests: write
17+
issues: write
18+
1419
jobs:
1520
build:
1621
name: Scan
22+
permissions:
23+
pull-requests: write
24+
issues: write
1725
runs-on: ubuntu-latest
1826
steps:
1927
- name: Checkout
@@ -59,4 +67,56 @@ jobs:
5967
with:
6068
image-ref: 'function-mesh-operator:latest'
6169
format: 'table'
62-
exit-code: '1'
70+
exit-code: '1'
71+
72+
- name: Build runner images
73+
run: |
74+
PULSAR_IMAGE_TAG=3.2.2.6 PULSAR_IMAGE=streamnative/sn-platform KIND_PUSH=false images/build.sh
75+
76+
- name: Run Trivy vulnerability scanner for java
77+
id: scan-java-runner
78+
uses: aquasecurity/trivy-action@master
79+
with:
80+
image-ref: 'pulsar-functions-java-runner:latest'
81+
format: 'table'
82+
exit-code: '0'
83+
84+
- name: Run Trivy vulnerability scanner for python
85+
id: scan-python-runner
86+
uses: aquasecurity/trivy-action@master
87+
with:
88+
image-ref: 'pulsar-functions-python-runner:latest'
89+
format: 'table'
90+
exit-code: '0'
91+
92+
- name: Run Trivy vulnerability scanner for go
93+
id: scan-go-runner
94+
uses: aquasecurity/trivy-action@master
95+
with:
96+
image-ref: 'pulsar-functions-go-runner:latest'
97+
format: 'table'
98+
exit-code: '0'
99+
100+
- name: Run Trivy vulnerability scanner for java with pulsarctl
101+
id: scan-java-pulsarctl-runner
102+
uses: aquasecurity/trivy-action@master
103+
with:
104+
image-ref: 'pulsar-functions-pulsarctl-java-runner:latest'
105+
format: 'table'
106+
exit-code: '0'
107+
108+
- name: Run Trivy vulnerability scanner for python with pulsarctl
109+
id: scan-python-pulsarctl-runner
110+
uses: aquasecurity/trivy-action@master
111+
with:
112+
image-ref: 'pulsar-functions-pulsarctl-python-runner:latest'
113+
format: 'table'
114+
exit-code: '0'
115+
116+
- name: Run Trivy vulnerability scanner for go with pulsarctl
117+
id: scan-go-pulsarctl-runner
118+
uses: aquasecurity/trivy-action@master
119+
with:
120+
image-ref: 'pulsar-functions-pulsarctl-go-runner:latest'
121+
format: 'table'
122+
exit-code: '0'

‎images/pulsar-functions-base-runner/Dockerfile‎

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
ARG PULSAR_IMAGE
22
ARG PULSAR_IMAGE_TAG
33
FROM ${PULSAR_IMAGE}:${PULSAR_IMAGE_TAG} as pulsar
4-
FROM ubuntu:20.04 as functions-runner
4+
FROM alpine:3.19 as functions-runner
55

66
ENV GID=10001
77
ENV UID=10000
88
ENV USER=pulsar
9-
RUN groupadd -g $GID pulsar
10-
RUN adduser -u $UID --gid $GID --disabled-login --disabled-password --gecos '' $USER
9+
RUN addgroup -g $GID pulsar
10+
RUN adduser -u $UID -G pulsar -D -g '' $USER
1111

1212
RUN mkdir -p /pulsar/bin/ \
1313
&& mkdir -p /pulsar/lib/ \
@@ -28,38 +28,36 @@ RUN echo "VERSION_TAG=${VERSION_TAG}" && \
2828
VERSION_PATCH=$(echo $VERSION_TAG | cut -d. -f3) && \
2929
if [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 7 ]; then \
3030
echo "Pulsar version is 2.7, use java 1.8" && \
31-
export JRE_PACKAGE_NAME=openjdk-8-jre-headless; \
31+
export JRE_PACKAGE_NAME=openjdk8; \
3232
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 8 ]; then \
3333
echo "Pulsar version is 2.8, use java 1.8" && \
34-
export JRE_PACKAGE_NAME=openjdk-8-jre-headless; \
34+
export JRE_PACKAGE_NAME=openjdk8; \
3535
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 9 ]; then \
3636
echo "Pulsar version is 2.9, use java 11" && \
37-
export JRE_PACKAGE_NAME=openjdk-11-jre-headless; \
37+
export JRE_PACKAGE_NAME=openjdk11; \
3838
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 10 ]; then \
3939
echo "Pulsar version is 2.10, use java 11" && \
40-
export JRE_PACKAGE_NAME=openjdk-11-jre-headless; \
40+
export JRE_PACKAGE_NAME=openjdk11; \
4141
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 11 ]; then \
4242
echo "Pulsar version is 2.11, use java 17" && \
43-
export JRE_PACKAGE_NAME=openjdk-17-jre-headless; \
43+
export JRE_PACKAGE_NAME=openjdk11; \
4444
else \
4545
echo "Pulsar version is not in the list, use java 17 instead" && \
46-
export JRE_PACKAGE_NAME=openjdk-17-jre-headless; \
46+
export JRE_PACKAGE_NAME=openjdk17; \
4747
fi && \
48-
apt-get update \
49-
&& apt-get -y dist-upgrade \
50-
&& apt-get -y install $JRE_PACKAGE_NAME \
51-
&& apt-get -y --purge autoremove \
52-
&& apt-get autoclean \
53-
&& apt-get clean \
54-
&& rm -rf /var/lib/apt/lists/*
48+
apk update && apk add --no-cache $JRE_PACKAGE_NAME bash
5549

5650
COPY --from=pulsar --chown=$UID:$GID /pulsar/conf /pulsar/conf
5751
COPY --from=pulsar --chown=$UID:$GID /pulsar/bin /pulsar/bin
5852
COPY --from=pulsar --chown=$UID:$GID /pulsar/lib /pulsar/lib
5953

54+
# remove the vertx jar since it's not need ans has a cve
55+
RUN rm -rf /pulsar/lib/io.vertx-vertx-core-*.jar || true
56+
6057
# remove presto dependencies because they are not needed
6158
RUN rm -rf /pulsar/lib/presto || true
6259
RUN rm -rf /pulsar/conf/presto || true
60+
RUN rm -rf /pulsar/bin/pulsar-detector || true
6361

6462
ENV PULSAR_ROOT_LOGGER=INFO,CONSOLE
6563
ENV java.io.tmpdir=/pulsar/tmp/

‎images/pulsar-functions-base-runner/pulsarctl.Dockerfile‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
ARG PULSAR_IMAGE
22
ARG PULSAR_IMAGE_TAG
33
FROM ${PULSAR_IMAGE}:${PULSAR_IMAGE_TAG} as pulsar
4-
FROM ubuntu:20.04 as functions-runner
4+
FROM alpine:3.19 as functions-runner
55

66
ENV GID=10001
77
ENV UID=10000
88
ENV USER=pulsar
9-
RUN groupadd -g $GID pulsar
10-
RUN adduser -u $UID --gid $GID --disabled-login --disabled-password --gecos '' $USER
9+
RUN addgroup -g $GID pulsar
10+
RUN adduser -u $UID -G pulsar -D -g '' $USER
1111

1212
RUN mkdir -p /pulsar/bin/ \
1313
&& mkdir -p /pulsar/lib/ \
@@ -19,13 +19,7 @@ RUN mkdir -p /pulsar/bin/ \
1919
&& mkdir -p /pulsar/examples/ \
2020
&& chown -R $UID:$GID /pulsar \
2121
&& chmod -R g=u /pulsar \
22-
&& apt-get update \
23-
&& apt-get -y dist-upgrade \
24-
&& apt-get -y install wget \
25-
&& apt-get -y --purge autoremove \
26-
&& apt-get autoclean \
27-
&& apt-get clean \
28-
&& rm -rf /var/lib/apt/lists/* \
22+
&& apk update && apk add --no-cache wget bash \
2923
&& wget https://github.com/streamnative/pulsarctl/releases/latest/download/pulsarctl-amd64-linux.tar.gz -P /pulsar/bin/ \
3024
&& tar -xzf /pulsar/bin/pulsarctl-amd64-linux.tar.gz -C /pulsar/bin/ \
3125
&& rm -rf /pulsar/bin/pulsarctl-amd64-linux.tar.gz \

‎images/pulsar-functions-java-runner/pulsarctl.Dockerfile‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,37 +12,33 @@ RUN echo "VERSION_TAG=${VERSION_TAG}" && \
1212
VERSION_PATCH=$(echo $VERSION_TAG | cut -d. -f3) && \
1313
if [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 7 ]; then \
1414
echo "Pulsar version is 2.7, use java 1.8" && \
15-
export JRE_PACKAGE_NAME=openjdk-8-jre-headless; \
15+
export JRE_PACKAGE_NAME=openjdk8; \
1616
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 8 ]; then \
1717
echo "Pulsar version is 2.8, use java 1.8" && \
18-
export JRE_PACKAGE_NAME=openjdk-8-jre-headless; \
18+
export JRE_PACKAGE_NAME=openjdk8; \
1919
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 9 ]; then \
2020
echo "Pulsar version is 2.9, use java 11" && \
21-
export JRE_PACKAGE_NAME=openjdk-11-jre-headless; \
21+
export JRE_PACKAGE_NAME=openjdk11; \
2222
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 10 ]; then \
2323
echo "Pulsar version is 2.10, use java 11" && \
24-
export JRE_PACKAGE_NAME=openjdk-11-jre-headless; \
24+
export JRE_PACKAGE_NAME=openjdk11; \
2525
elif [ $VERSION_MAJOR -eq 2 ] && [ $VERSION_MINOR -eq 11 ]; then \
2626
echo "Pulsar version is 2.11, use java 17" && \
27-
export JRE_PACKAGE_NAME=openjdk-17-jre-headless; \
27+
export JRE_PACKAGE_NAME=openjdk17; \
2828
else \
2929
echo "Pulsar version is not in the list, use java 17 instead" && \
30-
export JRE_PACKAGE_NAME=openjdk-17-jre-headless; \
30+
export JRE_PACKAGE_NAME=openjdk17; \
3131
fi && \
32-
apt-get update \
33-
&& apt-get -y dist-upgrade \
34-
&& apt-get -y install $JRE_PACKAGE_NAME \
35-
&& apt-get -y --purge autoremove \
36-
&& apt-get autoclean \
37-
&& apt-get clean \
38-
&& rm -rf /var/lib/apt/lists/*
32+
apk update && apk add --no-cache $JRE_PACKAGE_NAME
3933

4034
COPY --from=pulsar --chown=$UID:$GID /pulsar/conf /pulsar/conf
41-
COPY --from=pulsar --chown=$UID:$GID /pulsar/bin /pulsar/bin
4235
COPY --from=pulsar --chown=$UID:$GID /pulsar/lib /pulsar/lib
4336
COPY --from=pulsar --chown=$UID:$GID /pulsar/instances/java-instance.jar /pulsar/instances/java-instance.jar
4437
COPY --from=pulsar --chown=$UID:$GID /pulsar/instances/deps /pulsar/instances/deps
4538

39+
# remove the vertx jar since it's not need ans has a cve
40+
RUN rm -rf /pulsar/lib/io.vertx-vertx-core-*.jar || true
41+
4642
# remove presto dependencies because they are not needed
4743
RUN rm -rf /pulsar/lib/presto || true
4844
RUN rm -rf /pulsar/conf/presto || true

‎images/pulsar-functions-python-runner/Dockerfile‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ COPY --from=pulsar --chown=$UID:$GID /pulsar/instances/deps /pulsar/instances/de
1111
# Below is a hacky way to copy /pulsar/pulsar-client if exist in pulsar image
1212
COPY --from=pulsar --chown=$UID:$GID /pulsar/README /pulsar/pulsar-clien* /pulsar/pulsar-client/
1313

14+
ENV PULSAR_CLIENT_PYTHON_VERSION=3.5.0
15+
1416
# Pulsar 2.8.0 removes /pulsar/cpp-client from docker image
1517
# But it required with Pulsar 2.7.X and below
1618
# to make this Dockerfile compalicate with different Pulsar versions
@@ -19,27 +21,19 @@ COPY --from=pulsar --chown=$UID:$GID /pulsar/README /pulsar/cpp-clien* /tmp/puls
1921
RUN if [ -d "/tmp/pulsar/cpp-client" ]; then mv /tmp/pulsar/cpp-client /pulsar/cpp-client || true ; fi
2022

2123
# Install some utilities
22-
RUN apt-get update \
23-
&& DEBIAN_FRONTEND=noninteractive apt-get install -y python3 python3-dev python3-setuptools python3-yaml python3-kazoo \
24-
libreadline-gplv2-dev libncursesw5-dev libssl-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev libbz2-dev \
25-
curl ca-certificates\
26-
&& apt-get clean autoclean && apt-get autoremove --yes && rm -rf /var/lib/apt/lists/*
24+
RUN apk update \
25+
&& apk add --no-cache python3 python3-dev tk-dev curl ca-certificates\
26+
&& mv /usr/lib/python3.11/EXTERNALLY-MANAGED /usr/lib/python3.11/EXTERNALLY-MANAGED.old
2727

2828
RUN mkdir -p /etc/pki/tls/certs && cp /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
2929

3030
RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
3131
RUN python3 get-pip.py
3232

33-
RUN update-alternatives --install /usr/bin/python python /usr/bin/python3 10
34-
35-
RUN if [ -d "/pulsar/cpp-client" ]; then apt-get update \
36-
&& apt install -y /pulsar/cpp-client/*.deb \
37-
&& apt-get clean autoclean && apt-get autoremove --yes && rm -rf /var/lib/apt/lists/* ; fi
38-
3933
WORKDIR /pulsar
4034

4135
RUN if [ -f "/pulsar/bin/install-pulsar-client-37.sh" ]; then /pulsar/bin/install-pulsar-client-37.sh || true ; fi
42-
RUN if [ -f "/pulsar/bin/install-pulsar-client.sh" ]; then /pulsar/bin/install-pulsar-client.sh || pip3 install 'pulsar-client[all]==3.1.0' ; fi
36+
RUN if [ -f "/pulsar/bin/install-pulsar-client.sh" ]; then /pulsar/bin/install-pulsar-client.sh || pip3 install 'pulsar-client[all]==3.5.0' ; fi
4337

4438
# this dir is duplicate with the installed pulsar-client pip package, and maybe not compatible with the `_pulsar`(the .so library package)
4539
RUN rm -rf /pulsar/instances/python-instance/pulsar/ \
@@ -49,6 +43,6 @@ RUN rm -rf /pulsar/instances/python-instance/pulsar/ \
4943

5044
USER $USER
5145
# a temp solution from https://github.com/apache/pulsar/pull/15846 to fix python protobuf version error
52-
RUN pip3 install protobuf==3.20.1 --user
46+
RUN pip3 install protobuf==3.20.2 --user
5347
# to make the python runner could print json logs
5448
RUN pip3 install python-json-logger --user

‎images/pulsar-functions-python-runner/pulsarctl.Dockerfile‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,28 +11,23 @@ COPY --from=pulsar --chown=$UID:$GID /pulsar/instances/python-instance /pulsar/i
1111
# Below is a hacky way to copy /pulsar/pulsar-client if exist in pulsar image
1212
COPY --from=pulsar --chown=$UID:$GID /pulsar/README /pulsar/pulsar-clien* /pulsar/pulsar-client/
1313

14+
ENV PULSAR_CLIENT_PYTHON_VERSION=3.5.0
15+
1416
# Pulsar 2.8.0 removes /pulsar/cpp-client from docker image
1517
# But it required with Pulsar 2.7.X and below
1618
# to make this Dockerfile compalicate with different Pulsar versions
1719
# Below is a hacky way to copy /pulsar/cpp-client if exist in pulsar image
1820
COPY --from=pulsar --chown=$UID:$GID /pulsar/README /pulsar/cpp-clien* /pulsar/cpp-client/
1921

20-
RUN apt-get update \
21-
&& DEBIAN_FRONTEND=noninteractive apt-get install -y python3 python3-dev python3-setuptools python3-yaml python3-kazoo \
22-
libreadline-gplv2-dev libncursesw5-dev libssl-dev libsqlite3-dev tk-dev libgdbm-dev libc6-dev libbz2-dev \
23-
curl ca-certificates\
24-
&& apt-get clean autoclean && apt-get autoremove --yes && rm -rf /var/lib/apt/lists/* \
22+
RUN apk update \
23+
&& apk add --no-cache python3 python3-dev tk-dev curl ca-certificates\
2524
&& mkdir -p /etc/pki/tls/certs && cp /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt \
26-
&& update-alternatives --install /usr/bin/python python /usr/bin/python3 10 \
2725
&& curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py \
26+
&& mv /usr/lib/python3.11/EXTERNALLY-MANAGED /usr/lib/python3.11/EXTERNALLY-MANAGED.old \
2827
&& python3 get-pip.py && pip3 install --upgrade pip
2928

30-
RUN if [ -d "/pulsar/cpp-client" ]; then apt-get update \
31-
&& apt install -y /pulsar/cpp-client/*.deb || true \
32-
&& apt-get clean autoclean && apt-get autoremove --yes && rm -rf /var/lib/apt/lists/* ; fi
33-
34-
RUN if [ -f "/pulsar/bin/install-pulsar-client-37.sh" ]; then /pulsar/bin/install-pulsar-client-37.sh || pip3 install 'pulsar-client[all]==3.1.0' ; fi
35-
RUN if [ -f "/pulsar/bin/install-pulsar-client.sh" ]; then /pulsar/bin/install-pulsar-client.sh || pip3 install 'pulsar-client[all]==3.1.0' ; fi
29+
RUN if [ -f "/pulsar/bin/install-pulsar-client-37.sh" ]; then /pulsar/bin/install-pulsar-client-37.sh || pip3 install 'pulsar-client[all]==3.5.0' ; fi
30+
RUN if [ -f "/pulsar/bin/install-pulsar-client.sh" ]; then /pulsar/bin/install-pulsar-client.sh || pip3 install 'pulsar-client[all]==3.5.0' ; fi
3631

3732
# this dir is duplicate with the installed pulsar-client pip package, and maybe not compatible with the `_pulsar`(the .so library package)
3833
RUN rm -rf /pulsar/instances/python-instance/pulsar/ \
@@ -43,6 +38,6 @@ WORKDIR /pulsar
4338

4439
USER $USER
4540
# a temp solution from https://github.com/apache/pulsar/pull/15846 to fix python protobuf version error
46-
RUN pip3 install protobuf==3.20.1 --user
41+
RUN pip3 install protobuf==3.20.2 --user
4742
# to make the python runner could print json logs
48-
RUN pip3 install python-json-logger --user
43+
RUN pip3 install python-json-logger --user

0 commit comments

Comments
 (0)