Adding new Container and Container.debian dockerfiles to enable rootl… #8
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
There was a problem hiding this comment. Why a new file? Can't you use an argument for the base container just like There was a problem hiding this comment. The repo URL is a bit different. To me it makes since to separate out the files. You would also need an OS argument for: But you could do that and have a single file if desired. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,181 @@ | ||
| ARG UBUNTU_VERSION=24.04 | ||
| ARG DEBIAN_VERSION=12 | ||
| FROM ubuntu:${UBUNTU_VERSION} AS builder | ||
|
|
||
| ARG BUILD_PKGS="ruby3.2-dev gcc make cmake pkg-config libssl-dev libc6-dev libssh2-1-dev" | ||
| ARG R10K_VERSION=5.0.0 | ||
| ARG RUGGED_VERSION=1.9.0 | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y --no-install-recommends $BUILD_PKGS && \ | ||
| gem install --no-doc r10k -v $R10K_VERSION && \ | ||
| gem install --no-doc rugged -v $RUGGED_VERSION -- --with-ssh | ||
|
|
||
| FROM debian:${DEBIAN_VERSION} AS final | ||
|
|
||
| ARG vcs_ref | ||
| ARG build_type | ||
| ARG build_date | ||
| ARG PACKAGES="git netbase openjdk-17-jre-headless openssh-client libssh2-1 dumb-init net-tools adduser" | ||
| ARG TARGETARCH | ||
| ARG OPENVOX_RELEASE=8 | ||
| ARG OPENVOXSERVER_VERSION=8.8.0 | ||
| ARG OPENVOXAGENT_VERSION=8.11.0 | ||
| ARG OPENVOXDB_VERSION=8.9.0 | ||
| ARG OPENVOX_USER_UID=999 | ||
| ARG OPENVOX_USER_GID=999 | ||
| ARG UBUNTU_VERSION=24.04 | ||
| ARG DEBIAN_VERSION=12 | ||
|
|
||
| LABEL org.label-schema.maintainer="Voxpupuli Team <[email protected]>" \ | ||
| org.label-schema.vendor="OpenVoxProject" \ | ||
| org.label-schema.url="https://github.com/OpenVoxProject/container-openvoxserver" \ | ||
| org.label-schema.vcs-url="https://github.com/OpenVoxProject/container-openvoxserver" \ | ||
| org.label-schema.schema-version="1.0" \ | ||
| org.label-schema.dockerfile="/Containerfile" \ | ||
| org.label-schema.name="OpenVox Server ($build_type)" \ | ||
| org.label-schema.version="$OPENVOXSERVER_VERSION" \ | ||
| org.label-schema.vcs-ref="$vcs_ref" \ | ||
| org.label-schema.build-date="$build_date" | ||
|
|
||
| ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \ | ||
| PATH=$PATH:/opt/puppetlabs/server/bin:/opt/puppetlabs/puppet/bin:/opt/puppetlabs/bin \ | ||
| SSLDIR=/etc/puppetlabs/puppet/ssl \ | ||
| LOGDIR=/var/log/puppetlabs/puppetserver \ | ||
| OPENVOXSERVER_HOSTNAME="" \ | ||
| CERTNAME="" \ | ||
| DNS_ALT_NAMES="" \ | ||
| OPENVOXSERVER_PORT=8140 \ | ||
| AUTOSIGN=true \ | ||
| OPENVOXSERVER_MAX_ACTIVE_INSTANCES=1 \ | ||
| OPENVOXSERVER_MAX_REQUESTS_PER_INSTANCE=0 \ | ||
| CA_ENABLED=true \ | ||
| CA_TTL=157680000 \ | ||
| CA_HOSTNAME=puppet \ | ||
| CA_PORT=8140 \ | ||
| CA_ALLOW_SUBJECT_ALT_NAMES=false \ | ||
| INTERMEDIATE_CA=false \ | ||
| INTERMEDIATE_CA_BUNDLE=/etc/puppetlabs/intermediate/ca.pem \ | ||
| INTERMEDIATE_CRL_CHAIN=/etc/puppetlabs/intermediate/crl.pem \ | ||
| INTERMEDIATE_CA_KEY=/etc/puppetlabs/intermediate/key.pem \ | ||
| USE_OPENVOXDB=true \ | ||
| OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \ | ||
| OPENVOX_STORECONFIGS_BACKEND="puppetdb" \ | ||
| OPENVOX_STORECONFIGS=true \ | ||
| OPENVOX_REPORTS="puppetdb" \ | ||
| OPENVOXSERVER_GRAPHITE_EXPORTER_ENABLED=false \ | ||
| OPENVOXSERVER_GRAPHITE_PORT=9109 \ | ||
| OPENVOXSERVER_GRAPHITE_HOST=exporter \ | ||
| OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \ | ||
| OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \ | ||
| ENVIRONMENTPATH=/etc/puppetlabs/code/environments \ | ||
| HIERACONFIG='$confdir/hiera.yaml' \ | ||
| CSR_ATTRIBUTES='{}' | ||
|
|
||
| COPY docker-entrypoint.sh \ | ||
| healthcheck.sh \ | ||
| Containerfile \ | ||
| / | ||
|
|
||
| COPY docker-entrypoint.d /docker-entrypoint.d | ||
| COPY --from=builder /var/lib/gems/ /var/lib/gems/ | ||
| COPY --from=builder /usr/local/bin/r10k /usr/local/bin/ | ||
|
|
||
| #ADD https://apt.overlookinfratech.com/openvox${OPENVOX_RELEASE}-release-ubuntu${UBUNTU_VERSION}.deb / | ||
| ADD https://apt.overlookinfratech.com/openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb / | ||
| RUN apt update && apt install -y ca-certificates && \ | ||
| dpkg -i /openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb && \ | ||
| rm -f /openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb | ||
|
|
||
| RUN groupadd -g ${OPENVOX_USER_GID} puppet && \ | ||
| useradd -m -u ${OPENVOX_USER_UID} -g puppet puppet && \ | ||
| chmod +x /docker-entrypoint.sh /healthcheck.sh /docker-entrypoint.d/*.sh && \ | ||
| apt-get update && \ | ||
| apt-get upgrade -y && \ | ||
| apt-get install -y $PACKAGES && \ | ||
| apt-get install -y openvox-agent=${OPENVOXAGENT_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get install -y openvox-server=${OPENVOXSERVER_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get install -y openvoxdb-termini=${OPENVOXDB_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get autoremove -y && \ | ||
| apt-get clean && \ | ||
| rm -rf /var/lib/apt/lists/* && \ | ||
| cp -pr /etc/puppetlabs/puppet /var/tmp && \ | ||
| cp -pr /opt/puppetlabs/server/data/puppetserver /var/tmp && \ | ||
| rm -rf /var/tmp/puppet/ssl | ||
| # apt-get install -y openvox-agent=${OPENVOXAGENT_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
|
|
||
| # needs to be copied after package installation | ||
| COPY puppetserver /etc/default/puppetserver | ||
|
|
||
| COPY logback.xml \ | ||
| request-logging.xml \ | ||
| /etc/puppetlabs/puppetserver/ | ||
|
|
||
| COPY conf.d/puppetserver.conf \ | ||
| conf.d/product.conf \ | ||
| /etc/puppetlabs/puppetserver/conf.d/ | ||
|
|
||
| COPY puppetdb.conf /var/tmp/puppet/ | ||
|
|
||
| RUN chown -R puppet /etc/puppetlabs/puppetserver && \ | ||
| chown -R puppet:puppet /var/tmp/puppet && \ | ||
| chown -R puppet:puppet /opt/puppetlabs && \ | ||
| chown -R puppet:puppet /usr/local/bin && \ | ||
| chown -R puppet:puppet /var/lib/gems && \ | ||
| chown -R puppet:puppet /etc/puppetlabs && \ | ||
| chown -R puppet:puppet /var/tmp/puppetserver && \ | ||
| chown -R puppet:puppet /etc/default && \ | ||
| chown -R puppet:puppet /docker-entrypoint.sh /healthcheck.sh /docker-entrypoint.d | ||
|
|
||
| USER puppet | ||
|
|
||
| RUN mkdir -p /home/puppet/.puppetlabs/etc/ && \ | ||
| ln -s /etc/puppetlabs/puppet/ /home/puppet/.puppetlabs/etc/puppet | ||
|
|
||
| ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \ | ||
| confdir=/etc/puppetlabs/puppet \ | ||
| PATH=$PATH:/opt/puppetlabs/server/bin:/opt/puppetlabs/puppet/bin:/opt/puppetlabs/bin \ | ||
| SSLDIR=/etc/puppetlabs/puppet/ssl \ | ||
| LOGDIR=/var/log/puppetlabs/puppetserver \ | ||
| OPENVOXSERVER_HOSTNAME="" \ | ||
| CERTNAME="" \ | ||
| DNS_ALT_NAMES="" \ | ||
| OPENVOXSERVER_PORT=8140 \ | ||
| AUTOSIGN=true \ | ||
| OPENVOXSERVER_MAX_ACTIVE_INSTANCES=1 \ | ||
| OPENVOXSERVER_MAX_REQUESTS_PER_INSTANCE=0 \ | ||
| CA_ENABLED=true \ | ||
| CA_TTL=157680000 \ | ||
| CA_HOSTNAME=puppet \ | ||
| CA_PORT=8140 \ | ||
| CA_ALLOW_SUBJECT_ALT_NAMES=false \ | ||
| INTERMEDIATE_CA=false \ | ||
| INTERMEDIATE_CA_BUNDLE=/etc/puppetlabs/intermediate/ca.pem \ | ||
| INTERMEDIATE_CRL_CHAIN=/etc/puppetlabs/intermediate/crl.pem \ | ||
| INTERMEDIATE_CA_KEY=/etc/puppetlabs/intermediate/key.pem \ | ||
| USE_OPENVOXDB=true \ | ||
| OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \ | ||
| OPENVOX_STORECONFIGS_BACKEND="puppetdb" \ | ||
| OPENVOX_STORECONFIGS=true \ | ||
| OPENVOX_REPORTS="puppetdb" \ | ||
| OPENVOXSERVER_GRAPHITE_EXPORTER_ENABLED=false \ | ||
| OPENVOXSERVER_GRAPHITE_PORT=9109 \ | ||
| OPENVOXSERVER_GRAPHITE_HOST=exporter \ | ||
| OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \ | ||
| OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \ | ||
| ENVIRONMENTPATH=/etc/puppetlabs/code/environments \ | ||
| HIERACONFIG='$confdir/hiera.yaml' \ | ||
| HOME=/home/puppet \ | ||
| CSR_ATTRIBUTES='{}' | ||
|
|
||
| RUN echo 'confdir = /etc/puppetlabs/puppet' >> /etc/puppetlabs/puppet/puppet.conf | ||
| WORKDIR /home/puppet | ||
|
|
||
| # k8s uses livenessProbe, startupProbe, readinessProbe and ignores HEALTHCHECK | ||
| HEALTHCHECK --interval=20s --timeout=15s --retries=12 --start-period=3m CMD ["/healthcheck.sh"] | ||
|
|
||
| # NOTE: this is just documentation on defaults | ||
| EXPOSE 8140 | ||
|
|
||
| ENTRYPOINT ["dumb-init", "/docker-entrypoint.sh"] | ||
| CMD ["foreground"] |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why exactly is this required? Without the container, puppetserver is also started as
puppetuser.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am not sure I follow what you mean by "Without the container".
The main issue is that the ENTRYPOINT and CMD within container is RAN by root, it assumed all of the ROOT ENV and puppet config variables in the deployment scripts within /docker-entrypoint.d. This is easy to see:
Lets use your container:
And now lets get a shell inside the container and see who the container is running as:
This is a security issue. The containers user should be a non-root user. If this container was to run in Openshift or Rancher Carbide, it would be immediately rejected.
Similarly lets look at the new container builds..
Excellent... this would run without warnings or issues in Rancher Carbide or Openshift.
SOOO... looking at the issue we need to solve when using USER puppet.
When using root:
Versus non-root. The puppet user has UID 999
So in the default container, the puppet user (UID - 999) has a HOME directory set as /opt/puppetlabs/server/data/puppetserver, and looking at the puppet documentation:
https://www.puppet.com/docs/puppet/8/dirs_confdir.html#dirs_confdir-confdir-location
Non-root users: ~/.puppetlabs/etc/puppetThis change in the path, really screws up the ENTRYPOINT and CMD init using:
/docker-entrypoint.sh and /docker-entrypoint.d/Because of this, I KNOW where things will change to automatically when I use a non-root user to run the ENTRYPOINT/CMD, so I leverage this and link it to the default deployment.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also... it is important to make the mounts simple, or keep them the same, as we need to give the end users an easy way to preserve the CA folder for certificates.
By using the symlink method, the container can still easily mount:
VERSUS