djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
8ff6ef32e9
ContainerImage.Pinniped/Dockerfile

42 lines
1.8 KiB
Docker
Raw Normal View History

Add more details to FIPS comments Signed-off-by: Monis Khan <mok@vmware.com>
2022-03-31 18:48:52 +00:00
# syntax=docker/dockerfile:1
Optimize image build using .dockerignore and BuildKit features. This optimizes our image in a few different ways: - It adds a bunch of files and directories to the `.dockerignore` file. This lets us have a single `COPY . .` but still be very aggressive about pruning what files end up in the build context. - It adds build-time cache mounts to the `go build` commands using BuildKit's `--mount=type=cache` flag. This requires BuildKit-capable Docker, but means that our Go builds can all be incremental builds. This replaces the previous flow we had where we needed to split out `go mod download`. - Instead of letting the full `apt-get install ca-certificates` layer end up in our final image, we copy just the single file we need. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-01-15 17:23:36 +00:00
Merge branch 'main' into upstream_access_revocation_during_gc
2022-01-14 18:49:22 +00:00
# Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
First draft of moving API server TLS cert generation to controllers - Refactors the existing cert generation code into controllers which read and write a Secret containing the certs - Does not add any new functionality yet, e.g. no new handling for cert expiration, and no leader election to allow for multiple servers running simultaneously - This commit also doesn't add new tests for the cert generation code, but it should be more unit testable now as controllers
2020-08-09 17:04:05 +00:00
# SPDX-License-Identifier: Apache-2.0
Bump Go 1.19.1 -> 1.19.4, and go-boringcrypto 1.18.6b7 -> 1.18.9b7
2022-12-15 17:40:32 +00:00
FROM golang:1.19.4 as build-env
Update dockerfile to use netrc Signed-off-by: Monis Khan <mok@vmware.com>
2020-07-17 03:52:53 +00:00
Add Dockerfile
2020-07-06 23:54:04 +00:00
WORKDIR /work
Optimize image build using .dockerignore and BuildKit features. This optimizes our image in a few different ways: - It adds a bunch of files and directories to the `.dockerignore` file. This lets us have a single `COPY . .` but still be very aggressive about pruning what files end up in the build context. - It adds build-time cache mounts to the `go build` commands using BuildKit's `--mount=type=cache` flag. This requires BuildKit-capable Docker, but means that our Go builds can all be incremental builds. This replaces the previous flow we had where we needed to split out `go mod download`. - Instead of letting the full `apt-get install ca-certificates` layer end up in our final image, we copy just the single file we need. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-01-15 17:23:36 +00:00
COPY . .
ARG GOPROXY
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-08-12 20:57:27 +00:00
Build with CGO_ENABLED=0 in Dockerfile - Not strictly necessary at the moment because both our build layer and our run layer are based on alpine, but static linking our binary will help us later when we want to base our run image on something closer to scratch
2020-08-06 00:43:24 +00:00
# Build the executable binary (CGO_ENABLED=0 means static linking)
Optimize image build using .dockerignore and BuildKit features. This optimizes our image in a few different ways: - It adds a bunch of files and directories to the `.dockerignore` file. This lets us have a single `COPY . .` but still be very aggressive about pruning what files end up in the build context. - It adds build-time cache mounts to the `go build` commands using BuildKit's `--mount=type=cache` flag. This requires BuildKit-capable Docker, but means that our Go builds can all be incremental builds. This replaces the previous flow we had where we needed to split out `go mod download`. - Instead of letting the full `apt-get install ca-certificates` layer end up in our final image, we copy just the single file we need. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-01-15 17:23:36 +00:00
# Pass in GOCACHE (build cache) and GOMODCACHE (module cache) so they
# can be re-used between image builds.
RUN \
--mount=type=cache,target=/cache/gocache \
--mount=type=cache,target=/cache/gomodcache \
mkdir out && \
Switch to a slimmer distroless base image. At a high level, it switches us to a distroless base container image, but that also includes several related bits: - Add a writable /tmp but make the rest of our filesystems read-only at runtime. - Condense our main server binaries into a single pinniped-server binary. This saves a bunch of space in the image due to duplicated library code. The correct behavior is dispatched based on `os.Args[0]`, and the `pinniped-server` binary is symlinked to `pinniped-concierge` and `pinniped-supervisor`. - Strip debug symbols from our binaries. These aren't really useful in a distroless image anyway and all the normal stuff you'd expect to work, such as stack traces, still does. - Add a separate `pinniped-concierge-kube-cert-agent` binary with "sleep" and "print" functionality instead of using builtin /bin/sleep and /bin/cat for the kube-cert-agent. This is split from the main server binary because the loading/init time of the main server binary was too large for the tiny resource footprint we established in our kube-cert-agent PodSpec. Using a separate binary eliminates this issue and the extra binary adds only around 1.5MiB of image size. - Switch the kube-cert-agent code to use a JSON `{"tls.crt": "<b64 cert>", "tls.key": "<b64 key>"}` format. This is more robust to unexpected input formatting than the old code, which simply concatenated the files with some extra newlines and split on whitespace. - Update integration tests that made now-invalid assumptions about the `pinniped-server` image. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-07-26 16:18:43 +00:00
export GOCACHE=/cache/gocache GOMODCACHE=/cache/gomodcache CGO_ENABLED=0 GOOS=linux GOARCH=amd64 && \
Dockerfile: build all files and trim file system paths Use "..." instead of "main.go" as the build target since we may have extra files in the future. https://pkg.go.dev/cmd/go#hdr-Compile_packages_and_dependencies -trimpath remove all file system paths from the resulting executable. Instead of absolute file system paths, the recorded file names will begin with either "go" (for the standard library), or a module path@version (when using modules), or a plain import path (when using GOPATH). Signed-off-by: Monis Khan <mok@vmware.com>
2021-11-03 14:26:13 +00:00
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-concierge-kube-cert-agent ./cmd/pinniped-concierge-kube-cert-agent/... && \
go build -v -trimpath -ldflags "$(hack/get-ldflags.sh) -w -s" -o /usr/local/bin/pinniped-server ./cmd/pinniped-server/... && \
Switch to a slimmer distroless base image. At a high level, it switches us to a distroless base container image, but that also includes several related bits: - Add a writable /tmp but make the rest of our filesystems read-only at runtime. - Condense our main server binaries into a single pinniped-server binary. This saves a bunch of space in the image due to duplicated library code. The correct behavior is dispatched based on `os.Args[0]`, and the `pinniped-server` binary is symlinked to `pinniped-concierge` and `pinniped-supervisor`. - Strip debug symbols from our binaries. These aren't really useful in a distroless image anyway and all the normal stuff you'd expect to work, such as stack traces, still does. - Add a separate `pinniped-concierge-kube-cert-agent` binary with "sleep" and "print" functionality instead of using builtin /bin/sleep and /bin/cat for the kube-cert-agent. This is split from the main server binary because the loading/init time of the main server binary was too large for the tiny resource footprint we established in our kube-cert-agent PodSpec. Using a separate binary eliminates this issue and the extra binary adds only around 1.5MiB of image size. - Switch the kube-cert-agent code to use a JSON `{"tls.crt": "<b64 cert>", "tls.key": "<b64 key>"}` format. This is more robust to unexpected input formatting than the old code, which simply concatenated the files with some extra newlines and split on whitespace. - Update integration tests that made now-invalid assumptions about the `pinniped-server` image. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-07-26 16:18:43 +00:00
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-concierge && \
ln -s /usr/local/bin/pinniped-server /usr/local/bin/pinniped-supervisor && \
ln -s /usr/local/bin/pinniped-server /usr/local/bin/local-user-authenticator
# Use a distroless runtime image with CA certificates, timezone data, and not much else.
Upgrade project dependencies to latest - Upgrade Go used in CI from 1.19.0 to 1.19.1 - Upgrade all go.mod direct dependencies to latest available versions - Upgrade distroless base image to latest available version - Upgrade Go fips compiler to to latest available version Note that upgrading the go-oidc library changed an error message returned by that library, so update the places where tests were expecting that error message.
2022-09-23 21:41:54 +00:00
FROM gcr.io/distroless/static:nonroot@sha256:2a9e2b4fa771d31fe3346a873be845bfc2159695b9f90ca08e950497006ccc2e
Switch to a slimmer distroless base image. At a high level, it switches us to a distroless base container image, but that also includes several related bits: - Add a writable /tmp but make the rest of our filesystems read-only at runtime. - Condense our main server binaries into a single pinniped-server binary. This saves a bunch of space in the image due to duplicated library code. The correct behavior is dispatched based on `os.Args[0]`, and the `pinniped-server` binary is symlinked to `pinniped-concierge` and `pinniped-supervisor`. - Strip debug symbols from our binaries. These aren't really useful in a distroless image anyway and all the normal stuff you'd expect to work, such as stack traces, still does. - Add a separate `pinniped-concierge-kube-cert-agent` binary with "sleep" and "print" functionality instead of using builtin /bin/sleep and /bin/cat for the kube-cert-agent. This is split from the main server binary because the loading/init time of the main server binary was too large for the tiny resource footprint we established in our kube-cert-agent PodSpec. Using a separate binary eliminates this issue and the extra binary adds only around 1.5MiB of image size. - Switch the kube-cert-agent code to use a JSON `{"tls.crt": "<b64 cert>", "tls.key": "<b64 key>"}` format. This is more robust to unexpected input formatting than the old code, which simply concatenated the files with some extra newlines and split on whitespace. - Update integration tests that made now-invalid assumptions about the `pinniped-server` image. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-07-26 16:18:43 +00:00
# Copy the server binary from the build-env stage.
COPY --from=build-env /usr/local/bin /usr/local/bin
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-08-12 20:57:27 +00:00
Add aggregatedAPIServerPort to the Concierge's static ConfigMap - Allow the port number to be configured to any value within the range 1024 to 65535 - This commit does not include adding new config knobs to the ytt values file, so while it is possible to change this port without needing to recompile, it is not convenient
2021-11-17 00:43:51 +00:00
# Document the default server ports for the various server apps
HTTP listener: default disabled and may only bind to loopback interfaces
2022-03-24 22:46:10 +00:00
EXPOSE 8443 8444 10250
Run as non-root I tried to follow a principle of encapsulation here - we can still default to peeps making connections to 80/443 on a Service object, but internally we will use 8080/8443. Signed-off-by: Andrew Keesler <akeesler@vmware.com>
2020-11-02 16:57:05 +00:00
# Run as non-root for security posture
Use 65532 instead of 1001 as non-root user Signed-off-by: Monis Khan <mok@vmware.com>
2021-10-25 20:21:54 +00:00
# Use the same non-root user as https://github.com/GoogleContainerTools/distroless/blob/fc3c4eaceb0518900f886aae90407c43be0a42d9/base/base.bzl#L9
# This is a workaround for https://github.com/GoogleContainerTools/distroless/issues/718
USER 65532:65532
Switch to Debian base images. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2020-08-12 20:57:27 +00:00
# Set the entrypoint
Switch to a slimmer distroless base image. At a high level, it switches us to a distroless base container image, but that also includes several related bits: - Add a writable /tmp but make the rest of our filesystems read-only at runtime. - Condense our main server binaries into a single pinniped-server binary. This saves a bunch of space in the image due to duplicated library code. The correct behavior is dispatched based on `os.Args[0]`, and the `pinniped-server` binary is symlinked to `pinniped-concierge` and `pinniped-supervisor`. - Strip debug symbols from our binaries. These aren't really useful in a distroless image anyway and all the normal stuff you'd expect to work, such as stack traces, still does. - Add a separate `pinniped-concierge-kube-cert-agent` binary with "sleep" and "print" functionality instead of using builtin /bin/sleep and /bin/cat for the kube-cert-agent. This is split from the main server binary because the loading/init time of the main server binary was too large for the tiny resource footprint we established in our kube-cert-agent PodSpec. Using a separate binary eliminates this issue and the extra binary adds only around 1.5MiB of image size. - Switch the kube-cert-agent code to use a JSON `{"tls.crt": "<b64 cert>", "tls.key": "<b64 key>"}` format. This is more robust to unexpected input formatting than the old code, which simply concatenated the files with some extra newlines and split on whitespace. - Update integration tests that made now-invalid assumptions about the `pinniped-server` image. Signed-off-by: Matt Moyer <moyerm@vmware.com>
2021-07-26 16:18:43 +00:00
ENTRYPOINT ["/usr/local/bin/pinniped-server"]
Reference in New Issue Copy Permalink