|
| 1 | +# syntax=docker/dockerfile:1.10.0@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5 |
| 2 | +# NOTE: The syntax directive needs to be the first line in a Dockerfile |
| 3 | + |
1 | 4 | # ============= |
2 | 5 | # This file is automatically generated from the templates in stackabletech/operator-templating |
3 | 6 | # DON'T MANUALLY EDIT THIS FILE |
4 | 7 | # ============= |
5 | | -FROM oci.stackable.tech/sdp/ubi9-rust-builder AS builder |
6 | 8 |
|
7 | | -FROM registry.access.redhat.com/ubi9/ubi-minimal AS operator |
| 9 | +# https://docs.docker.com/build/checks/#fail-build-on-check-violations |
| 10 | +# check=error=true |
| 11 | + |
| 12 | +# We want to automatically use the latest. We also don't tag our images with a version. |
| 13 | +# hadolint ignore=DL3007 |
| 14 | +FROM oci.stackable.tech/sdp/ubi9-rust-builder:latest AS builder |
| 15 | + |
| 16 | + |
| 17 | +# We want to automatically use the latest. |
| 18 | +# hadolint ignore=DL3007 |
| 19 | +FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS operator |
8 | 20 |
|
9 | 21 | ARG VERSION |
10 | 22 | ARG RELEASE="1" |
11 | 23 |
|
12 | | -LABEL name="Stackable Operator for Trino" \ |
13 | | - |
14 | | - vendor="Stackable GmbH" \ |
15 | | - version="${VERSION}" \ |
16 | | - release="${RELEASE}" \ |
17 | | - summary="Deploy and manage Trino clusters." \ |
18 | | - description="Deploy and manage Trino clusters." |
19 | | - |
20 | | -# Update image and install kerberos client libraries |
21 | | -# install_weak_deps in microdnf does not support the literal "False" as dnf does |
22 | | -# https://github.com/rpm-software-management/microdnf/blob/a600c62f29262d71a6259b70dc220df65a2ab9b5/dnf/dnf-main.c#L176-L189 |
23 | | -RUN microdnf update -y --setopt=install_weak_deps=0 \ |
24 | | - && microdnf install -y --setopt=install_weak_deps=0 \ |
25 | | - krb5-libs \ |
26 | | - libkadm5 \ |
27 | | - && microdnf clean all \ |
28 | | - && rm -rf /var/cache/yum |
| 24 | +# These are chosen at random and are this high on purpose to have very little chance to clash with an existing user or group on the host system |
| 25 | +ARG STACKABLE_USER_GID="574654813" |
| 26 | +ARG STACKABLE_USER_UID="782252253" |
| 27 | + |
| 28 | +# These labels have mostly been superceded by the OpenContainer spec annotations below but it doesn't hurt to include them |
| 29 | +# http://label-schema.org/rc1/ |
| 30 | +LABEL name="Stackable Operator for Trino" |
| 31 | +LABEL maintainer= "[email protected]" |
| 32 | +LABEL vendor="Stackable GmbH" |
| 33 | +LABEL version="${VERSION}" |
| 34 | +LABEL release="${RELEASE}" |
| 35 | +LABEL summary="Deploy and manage Trino clusters." |
| 36 | +LABEL description="Deploy and manage Trino clusters." |
| 37 | + |
| 38 | +# Overwriting/Pinning UBI labels |
| 39 | +# https://github.com/projectatomic/ContainerApplicationGenericLabels |
| 40 | +LABEL vcs-ref="" |
| 41 | +LABEL distribution-scope="public" |
| 42 | +LABEL url="https://stackable.tech" |
| 43 | +ARG TARGETARCH |
| 44 | +LABEL architecture="${TARGETARCH}" |
| 45 | +LABEL com.redhat.component="" |
| 46 | +# It complains about it being an invalid label but RedHat uses it and we want to override it and it works.... |
| 47 | +# hadolint ignore=DL3048 |
| 48 | +LABEL com.redhat.license_terms="" |
| 49 | +LABEL io.buildah.version="" |
| 50 | +LABEL io.openshift.expose-services="" |
| 51 | + |
| 52 | +# https://github.com/opencontainers/image-spec/blob/036563a4a268d7c08b51a08f05a02a0fe74c7268/annotations.md#annotations |
| 53 | +LABEL org.opencontainers.image.authors= "[email protected]" |
| 54 | +LABEL org.opencontainers.image.url="https://stackable.tech" |
| 55 | +LABEL org.opencontainers.image.vendor="Stackable GmbH" |
| 56 | +LABEL org.opencontainers.image.licenses="OSL-3.0" |
| 57 | +LABEL org.opencontainers.image.documentation="https://docs.stackable.tech/home/stable/trino/" |
| 58 | +LABEL org.opencontainers.image.version="${VERSION}" |
| 59 | +LABEL org.opencontainers.image.revision="${RELEASE}" |
| 60 | +LABEL org.opencontainers.image.title="Stackable Operator for Trino" |
| 61 | +LABEL org.opencontainers.image.description="Deploy and manage Trino clusters." |
| 62 | + |
| 63 | +# https://docs.openshift.com/container-platform/4.16/openshift_images/create-images.html#defining-image-metadata |
| 64 | +# https://github.com/projectatomic/ContainerApplicationGenericLabels/blob/master/vendor/redhat/labels.md |
| 65 | +LABEL io.openshift.tags="ubi9,stackable,sdp,trino" |
| 66 | +LABEL io.k8s.description="Deploy and manage Trino clusters." |
| 67 | +LABEL io.k8s.display-name="Stackable Operator for Trino" |
| 68 | + |
| 69 | +COPY <<EOF /etc/dnf/dnf.conf |
| 70 | +[main] |
| 71 | +install_weak_deps=0 |
| 72 | +assumeyes=True |
| 73 | +tsflags=nodocs |
| 74 | +EOF |
| 75 | + |
| 76 | +RUN <<EOF |
| 77 | +# Update image and install kerberos client libraries as well as some other utilities |
| 78 | +microdnf update |
| 79 | + |
| 80 | +# **iputils** |
| 81 | +# To make debugging easier, includes things like ping |
| 82 | +# Added 2024-03: We cannot find any vulnerabilities in the past years |
| 83 | +# https://github.com/iputils/iputils |
| 84 | +# |
| 85 | +# **less** |
| 86 | +# To make debugging easier |
| 87 | +# Added 2024-03: less has seen three vulnerabilities between 2004 and 2022 which is a risk we're willing to accept for the added convenience |
| 88 | +# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Agnu&cpe_product=cpe%3A%2F%3A%3Aless |
| 89 | +# cpe:2.3:a:gnu:less:*:*:*:*:*:*:*:* |
| 90 | +# |
| 91 | +# **nano** |
| 92 | +# To make debugging and changing things easier |
| 93 | +# Added 2024-03: We checked and it has not seen any vulnerabilities since 2010 (as of 2024-03) we decided to accept it into our base image |
| 94 | +# https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=cpe%3A2.3%3Aa%3Agnu%3Anano&search_type=all&isCpeNameSearch=false |
| 95 | +# cpe:2.3:a:gnu:nano:*:*:*:*:*:*:*:* |
| 96 | +# |
| 97 | +# **tar** |
| 98 | +# To enable kubectl cp |
| 99 | +# Added 2024-03: We checked and it has seen eight vulnerabilities since 2001, mostly minor and it's not in executable path so we decided to accept the risk |
| 100 | +# https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Agnu%3Atar%3A-%3A*%3A*%3A*%3A*%3A*%3A*%3A* |
| 101 | +# cpe:2.3:a:gnu:tar:-:*:*:*:*:*:*:* |
| 102 | +# NOTE (@NickLarsenNZ): Maybe we should consider pinning package versions? |
| 103 | +# hadolint ignore=DL3041 |
| 104 | +microdnf install \ |
| 105 | + iputils \ |
| 106 | + krb5-libs \ |
| 107 | + less \ |
| 108 | + libkadm5 \ |
| 109 | + nano \ |
| 110 | + shadow-utils \ |
| 111 | + tar |
| 112 | + |
| 113 | +groupadd --gid ${STACKABLE_USER_GID} --system stackable |
| 114 | +# The --no-log-init is required to work around a bug/problem in Go/Docker when very large UIDs are used |
| 115 | +# See https://github.com/moby/moby/issues/5419#issuecomment-41478290 for more context |
| 116 | +# Making this a system user prevents a mail dir from being created, expiry of passwords etc. but it will warn: |
| 117 | +# useradd warning: stackable's uid 782252253 is greater than SYS_UID_MAX 999 |
| 118 | +# We can safely ignore this warning, to get rid of the warning we could change /etc/login.defs but that does not seem worth it |
| 119 | +# We'll leave the home directory hardcoded to /stackable because I don't want to deal with which chars might be valid and which might not in user name vs. directory |
| 120 | +useradd \ |
| 121 | + --no-log-init \ |
| 122 | + --gid ${STACKABLE_USER_GID} \ |
| 123 | + --uid ${STACKABLE_USER_UID} \ |
| 124 | + --system \ |
| 125 | + --create-home \ |
| 126 | + --home-dir /stackable \ |
| 127 | + stackable |
| 128 | +microdnf remove shadow-utils |
| 129 | +microdnf clean all |
| 130 | +rm -rf /var/cache/yum |
| 131 | + |
| 132 | +### |
| 133 | +### Make shell usage in our containers "nicer" |
| 134 | +### |
| 135 | +{ |
| 136 | + echo "alias ll='ls -alF --color=auto'" |
| 137 | + echo "alias ls='ls --color=auto'" |
| 138 | + echo "alias ..='cd ..'" |
| 139 | + echo "export PS1='\u@\[\e[36m\]\H\[\e[m\] \[\e[32m\]\$(pwd)\[\e[m\] \\$ '" |
| 140 | +} >> /stackable/.bashrc |
| 141 | + |
| 142 | +echo -e "if [ -f ~/.bashrc ]; then\n\tsource ~/.bashrc\nfi" >> /stackable/.profile |
| 143 | + |
| 144 | +chown ${STACKABLE_USER_UID}:0 /stackable/.bashrc |
| 145 | +chown ${STACKABLE_USER_UID}:0 /stackable/.profile |
| 146 | + |
| 147 | +# All files and folders owned by root to support running as arbitrary users |
| 148 | +# This is best practice as all container users will belong to the root group (0) |
| 149 | +# This is not very relevant for the operator images but this makes it consistent with `docker-images` |
| 150 | +chown -R ${STACKABLE_USER_UID}:0 /stackable |
| 151 | +chmod -R g=u /stackable |
| 152 | +EOF |
| 153 | + |
| 154 | +COPY <<EOF /README.md |
| 155 | +# Stackable Operator for Trino |
| 156 | + |
| 157 | +* This image contains version ${VERSION} of the operator. |
| 158 | +* The operator binary can be found in `/usr/local/bin` |
| 159 | +* It is licensed under the OSL-3.0 - the full text can be found in `/licenses/LICENSE` |
| 160 | +EOF |
29 | 161 |
|
30 | 162 | COPY LICENSE /licenses/LICENSE |
31 | 163 |
|
32 | | -COPY --from=builder /app/* /usr/local/bin/ |
33 | | -COPY deploy/config-spec/properties.yaml /etc/stackable/trino-operator/config-spec/properties.yaml |
| 164 | +COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /app/* /usr/local/bin/ |
34 | 165 |
|
35 | | -RUN groupadd -g 1000 stackable && adduser -u 1000 -g stackable -c 'Stackable Operator' stackable |
| 166 | +COPY deploy/config-spec/properties.yaml /etc/stackable/trino-operator/config-spec/properties.yaml |
36 | 167 |
|
37 | | -USER stackable:stackable |
| 168 | +USER ${STACKABLE_USER_UID} |
38 | 169 |
|
39 | 170 | ENTRYPOINT ["stackable-trino-operator"] |
40 | 171 | CMD ["run"] |
0 commit comments