-
Notifications
You must be signed in to change notification settings - Fork 10
/
Dockerfile
215 lines (169 loc) · 7.63 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: MPL-2.0
# This Dockerfile contains multiple targets.
# Use 'docker build --target=<name> .' to build one.
#
# Every target has a BIN_NAME argument that must be provided via --build-arg=BIN_NAME=<name>
# when building.
# envoy-binary pulls in the latest Envoy binary, as Envoy don't publish
# prebuilt binaries in any other form.
#
ARG GOLANG_VERSION
FROM envoyproxy/envoy-distroless:v1.31.2 as envoy-binary
# Modify the envoy binary to be able to bind to privileged ports (< 1024).
FROM debian:bullseye-slim AS setcap-envoy-binary
ARG BIN_NAME=consul-dataplane
ARG TARGETARCH
ARG TARGETOS
COPY --from=envoy-binary /usr/local/bin/envoy /usr/local/bin/
COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
RUN apt-get update && apt install -y libcap2-bin
RUN setcap CAP_NET_BIND_SERVICE=+ep /usr/local/bin/envoy
RUN setcap CAP_NET_BIND_SERVICE=+ep /usr/local/bin/$BIN_NAME
FROM hashicorp/envoy-fips:1.31.2-fips1402 as envoy-fips-binary
# Modify the envoy-fips binary to be able to bind to privileged ports (< 1024).
FROM debian:bullseye-slim AS setcap-envoy-fips-binary
ARG BIN_NAME=consul-dataplane
ARG TARGETARCH
ARG TARGETOS
COPY --from=envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
RUN apt-get update && apt install -y libcap2-bin
RUN setcap CAP_NET_BIND_SERVICE=+ep /usr/local/bin/envoy
RUN setcap CAP_NET_BIND_SERVICE=+ep /usr/local/bin/$BIN_NAME
# go-discover builds the discover binary (which we don't currently publish
# either).
ARG GOLANG_VERSION
FROM golang:${GOLANG_VERSION}-alpine as go-discover
RUN CGO_ENABLED=0 go install github.com/hashicorp/go-discover/cmd/discover@275a71457aa412bf20df9f9b77c380667164a5e6
# Pull in dumb-init from alpine, as our distroless release image doesn't have a
# package manager and there's no RPM package for UBI.
FROM alpine:latest AS dumb-init
RUN apk add dumb-init
# release-default release image
# -----------------------------------
FROM gcr.io/distroless/base-debian11 AS release-default
ARG BIN_NAME=consul-dataplane
ENV BIN_NAME=$BIN_NAME
ARG PRODUCT_VERSION
ARG PRODUCT_REVISION
ENV PRODUCT_NAME=$BIN_NAME
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
ARG TARGETOS TARGETARCH
LABEL name=${BIN_NAME}\
maintainer="Consul Team <[email protected]>" \
vendor="HashiCorp" \
version=${PRODUCT_VERSION} \
release=${PRODUCT_REVISION} \
revision=${PRODUCT_REVISION} \
summary="Consul dataplane manages the proxy that runs within the data plane layer of Consul Service Mesh." \
description="Consul dataplane manages the proxy that runs within the data plane layer of Consul Service Mesh." \
org.opencontainers.image.licenses="MPL-2.0"
COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
COPY --from=go-discover /go/bin/discover /usr/local/bin/
COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/
COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
COPY LICENSE /licenses/copyright.txt
USER 100
ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
# FIPS release-default release image
# -----------------------------------
FROM gcr.io/distroless/base-debian11 AS release-fips-default
ARG BIN_NAME
ARG PRODUCT_VERSION
ARG PRODUCT_REVISION
ENV PRODUCT_NAME=$BIN_NAME
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
ARG TARGETOS TARGETARCH
LABEL name=${BIN_NAME}\
maintainer="Consul Team <[email protected]>" \
vendor="HashiCorp" \
version=${PRODUCT_VERSION} \
release=${PRODUCT_REVISION} \
revision=${PRODUCT_REVISION} \
summary="Consul dataplane manages the proxy that runs within the data plane layer of Consul Service Mesh." \
description="Consul dataplane manages the proxy that runs within the data plane layer of Consul Service Mesh." \
org.opencontainers.image.licenses="MPL-2.0"
COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
COPY --from=go-discover /go/bin/discover /usr/local/bin/
COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
COPY LICENSE /licenses/copyright.txt
USER 100
ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
# Red Hat UBI-based image
# This image is based on the Red Hat UBI base image, and has the necessary
# labels, license file, and non-root user.
# -----------------------------------
FROM registry.access.redhat.com/ubi9-minimal:9.4 as release-ubi
ARG BIN_NAME=consul-dataplane
ENV BIN_NAME=$BIN_NAME
ARG PRODUCT_VERSION
ARG PRODUCT_REVISION
ENV PRODUCT_NAME=$BIN_NAME
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
ARG TARGETOS TARGETARCH
LABEL name=${BIN_NAME}\
maintainer="Consul Team <[email protected]>" \
vendor="HashiCorp" \
version=${PRODUCT_VERSION} \
release=${PRODUCT_REVISION} \
revision=${PRODUCT_REVISION} \
summary="Consul dataplane connects an application to a Consul service mesh." \
description="Consul dataplane connects an application to a Consul service mesh." \
org.opencontainers.image.licenses="MPL-2.0"
COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
RUN microdnf install -y shadow-utils
# Create a non-root user to run the software.
RUN groupadd --gid 1000 $PRODUCT_NAME && \
adduser --uid 100 --system -g $PRODUCT_NAME $PRODUCT_NAME && \
usermod -a -G root $PRODUCT_NAME
COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
COPY --from=go-discover /go/bin/discover /usr/local/bin/
COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/
COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
COPY LICENSE /licenses/copyright.txt
USER 100
ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
# FIPS Red Hat UBI-based image
# This image is based on the Red Hat UBI base image, and has the necessary
# labels, license file, and non-root user.
# -----------------------------------
FROM registry.access.redhat.com/ubi9-minimal:9.4 as release-fips-ubi
ARG BIN_NAME
ENV BIN_NAME=$BIN_NAME
ARG PRODUCT_VERSION
ARG PRODUCT_REVISION
ENV PRODUCT_NAME=$BIN_NAME
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
ARG TARGETOS TARGETARCH
LABEL name=${BIN_NAME}\
maintainer="Consul Team <[email protected]>" \
vendor="HashiCorp" \
version=${PRODUCT_VERSION} \
release=${PRODUCT_REVISION} \
revision=${PRODUCT_REVISION} \
summary="Consul dataplane connects an application to a Consul service mesh." \
description="Consul dataplane connects an application to a Consul service mesh." \
org.opencontainers.image.licenses="MPL-2.0"
COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
RUN microdnf install -y shadow-utils
# Create a non-root user to run the software.
RUN groupadd --gid 1000 $PRODUCT_NAME && \
adduser --uid 100 --system -g $PRODUCT_NAME $PRODUCT_NAME && \
usermod -a -G root $PRODUCT_NAME
COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
COPY --from=go-discover /go/bin/discover /usr/local/bin/
COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
COPY LICENSE /licenses/copyright.txt
USER 100
ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
# ===================================
#
# Set default target to 'release-default'.
#
# ===================================
FROM release-default