Add docker build for java-spiffe-helper container #187

moritzschmitz-oviva · 2024-01-21T19:56:16Z

No description provided.

maxlambrecht · 2024-01-22T13:22:56Z

java-spiffe-helper/Dockerfile

@@ -0,0 +1,10 @@
+FROM eclipse-temurin:17-jdk AS builder


I suggest moving this Dockerfile for java-spiffe-helper to the project's root. This simplifies build context management and path referencing, making the build process more straightforward.

Suggestions for Dockerfile:

Cache Gradle Dependencies: Separate Gradle config files from the rest of the code to improve caching, and run two separate gradle commands (dependencies and build).

Non-Root User: Consider creating a non-root user in the runner stage.

Explicit File Copying: Instead of copying the entire project context (COPY . /builder), explicitly copy only what's necessary.

Versioning Strategy: Rethink including JAVA_SPIFFE_HELPER_VERSION in the Dockerfile. Tagging the Docker image with the project version might be more efficient.

Explicit File Copying: I don't see any benefit here, except build time probably. 1. The context file won't end up in the final image. 2. Every change to the dependencies of java-spiffe-helper would require an adjustment of the Dockerfile as well.

Versioning Strategy: Yeah, my issue here was that the name of the built Jar is dependent on the version. Solved this now by setting some special version during docker build. Easier to find and copy then.

maxlambrecht · 2024-01-24T13:46:18Z

Dockerfile

+  --chown=nobody:nobody \
+  /builder/java-spiffe-helper/build/libs/java-spiffe-helper-docker-docker.jar /app/java-spiffe-helper.jar
+USER nobody
+ENTRYPOINT ["java", "-jar", "/app/java-spiffe-helper.jar"]


The ENTRYPOINT requires a --config configfile parameter. I'm submitting a PR to add a default config file and set a default for this parameter.

Yeah, wasn't sure about this one. Effectively the app doesn't start without it, but I didn't want to force users to a location for the file.

ENTRYPOINT ["java", "-jar", "/app/java-spiffe-helper.jar"] COMMAND ["--config", "/etc/java-spiffe-helper.conf"]

So by default it works if they mount the config file in the right place, or they can easily override it otherwise?

Probably the way to go, yes! Will add it now so no PR necessary.

I believe it would be beneficial to implement a default value for the --config parameter. This change would enable the application to run out of the box. I'll be submitting the PR shortly.

Dockerfile

.github/workflows/docker.yml

.github/workflows/gradle.yml

maxlambrecht · 2024-02-05T15:16:46Z

java-spiffe-helper/example.conf

+keyStorePath = /tmp/keystore.p12
+keyStorePass = example123
+keyPass = pass123
+
+trustStorePath = /tmp/truststore.p12
+trustStorePass = otherpass123
+
+keyStoreType = pkcs12
+
+keyAlias = spiffe
+
+spiffeSocketPath = unix:/tmp/agent.sock


This file is redundant now as #199 is merged, which adds a java-spiffe-helper.properties, an example configuration in the default config path. That file could be copied in the Dockerfile. WDYT?

Dockerfile

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

…sion to gradle properties Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Co-authored-by: Ryan Turner <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

maxlambrecht

Left two minor comments. It's looking good.

build.gradle

java-spiffe-helper/build.gradle

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

moritzschmitz-oviva · 2024-02-05T20:30:00Z

Left two minor comments. It's looking good.

Thank you. Made the adjustments.

maxlambrecht

Thanks, @moritzschmitz-oviva!

moritzschmitz-oviva marked this pull request as draft January 21, 2024 19:56

moritzschmitz-oviva force-pushed the add-docker-build branch from 2399117 to 5b12d46 Compare January 22, 2024 06:39

moritzschmitz-oviva marked this pull request as ready for review January 22, 2024 07:02

moritzschmitz-oviva marked this pull request as draft January 22, 2024 07:03

maxlambrecht requested review from maxlambrecht and rturner3 January 22, 2024 12:54

maxlambrecht reviewed Jan 22, 2024

View reviewed changes

moritzschmitz-oviva marked this pull request as ready for review January 23, 2024 09:33

moritzschmitz-oviva requested a review from maxlambrecht January 23, 2024 09:34

maxlambrecht reviewed Jan 24, 2024

View reviewed changes

kfox1111 mentioned this pull request Jan 26, 2024

Enhancements: Example Config File, Default Path, and Error Handling Improvements #199

Merged

rturner3 reviewed Jan 31, 2024

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

.github/workflows/docker.yml Outdated Show resolved Hide resolved

.github/workflows/gradle.yml Outdated Show resolved Hide resolved

moritzschmitz-oviva force-pushed the add-docker-build branch 3 times, most recently from 6823bfd to 03b04a7 Compare February 1, 2024 09:11

rturner3 approved these changes Feb 1, 2024

View reviewed changes

maxlambrecht reviewed Feb 5, 2024

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

moritzschmitz-oviva and others added 12 commits February 5, 2024 16:45

Add docker build for java-spiffe-helper container

055d4c9

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Adopt JDK has been deprecated in favor of temurin

13e72fb

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Push image after build

4b87e04

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Remove build on pull request and fix image tag

668ce0f

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Set user non-root, add separate stage for gradle dependencies and ver…

dad2685

…sion to gradle properties Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Fix entrypoint

91420b5

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Add example config and default container command

8977ff6

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Revert changes to gradle workflow and rename container build workflow

0f415a2

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Pin gradle builder image version

ccdd432

Co-authored-by: Ryan Turner <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Add buildx action

2a69ac8

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Use github variable in image tag

364c3f8

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Add Qemu

22d422d

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

moritzschmitz-oviva added 5 commits February 5, 2024 16:45

Login before push

93a1c12

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Adopt JDK has been deprecated in favor of temurin

31f903e

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Remove build on pull request and fix image tag

94241f6

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Revert changes to gradle workflow and rename container build workflow

bd2eb72

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

Use new properties example file

5dc3aa6

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

moritzschmitz-oviva force-pushed the add-docker-build branch from c74a83f to 5dc3aa6 Compare February 5, 2024 15:53

moritzschmitz-oviva requested a review from maxlambrecht February 5, 2024 15:54

maxlambrecht reviewed Feb 5, 2024

View reviewed changes

build.gradle Outdated Show resolved Hide resolved

java-spiffe-helper/build.gradle Outdated Show resolved Hide resolved

Minor improvements according to PR comments

36bd39a

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

maxlambrecht approved these changes Feb 5, 2024

View reviewed changes

maxlambrecht merged commit 27b2a01 into spiffe:main Feb 5, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add docker build for java-spiffe-helper container #187

Add docker build for java-spiffe-helper container #187

moritzschmitz-oviva commented Jan 21, 2024

maxlambrecht Jan 22, 2024

maxlambrecht Jan 22, 2024

moritzschmitz-oviva Jan 23, 2024 •

edited

Loading

maxlambrecht Jan 24, 2024

moritzschmitz-oviva Jan 24, 2024

kfox1111 Jan 24, 2024

moritzschmitz-oviva Jan 25, 2024

maxlambrecht Jan 25, 2024

maxlambrecht Jan 25, 2024

maxlambrecht Feb 5, 2024

maxlambrecht left a comment

moritzschmitz-oviva commented Feb 5, 2024

maxlambrecht left a comment

Add docker build for java-spiffe-helper container #187

Add docker build for java-spiffe-helper container #187

Conversation

moritzschmitz-oviva commented Jan 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

moritzschmitz-oviva Jan 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxlambrecht left a comment

Choose a reason for hiding this comment

moritzschmitz-oviva commented Feb 5, 2024

maxlambrecht left a comment

Choose a reason for hiding this comment

moritzschmitz-oviva Jan 23, 2024 •

edited

Loading