Adding new Container and Container.debian dockerfiles to enable rootl… #8
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
There was a problem hiding this comment. Why a new file? Can't you use an argument for the base container just like There was a problem hiding this comment. The repo URL is a bit different. To me it makes since to separate out the files. You would also need an OS argument for: But you could do that and have a single file if desired. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| ARG UBUNTU_VERSION=24.04 | ||
| ARG DEBIAN_VERSION=12 | ||
| FROM ubuntu:${UBUNTU_VERSION} AS builder | ||
|
|
||
| ARG BUILD_PKGS="ruby3.2-dev gcc make cmake pkg-config libssl-dev libc6-dev libssh2-1-dev" | ||
| ARG R10K_VERSION=5.0.0 | ||
| ARG RUGGED_VERSION=1.9.0 | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y --no-install-recommends $BUILD_PKGS && \ | ||
| gem install --no-doc r10k -v $R10K_VERSION && \ | ||
| gem install --no-doc rugged -v $RUGGED_VERSION -- --with-ssh | ||
|
|
||
| FROM debian:${DEBIAN_VERSION} AS final | ||
|
|
||
| ARG vcs_ref | ||
| ARG build_type | ||
| ARG build_date | ||
| ARG PACKAGES="git netbase openjdk-17-jre-headless openssh-client libssh2-1 dumb-init net-tools adduser" | ||
| ARG TARGETARCH | ||
| ARG OPENVOX_RELEASE=8 | ||
| ARG OPENVOXSERVER_VERSION=8.8.0 | ||
| ARG OPENVOXAGENT_VERSION=8.11.0 | ||
| ARG OPENVOXDB_VERSION=8.9.0 | ||
| ARG OPENVOX_USER_UID=999 | ||
| ARG OPENVOX_USER_GID=999 | ||
| ARG UBUNTU_VERSION=24.04 | ||
| ARG DEBIAN_VERSION=12 | ||
|
|
||
| LABEL org.label-schema.maintainer="Voxpupuli Team <[email protected]>" \ | ||
| org.label-schema.vendor="OpenVoxProject" \ | ||
| org.label-schema.url="https://github.com/OpenVoxProject/container-openvoxserver" \ | ||
| org.label-schema.vcs-url="https://github.com/OpenVoxProject/container-openvoxserver" \ | ||
| org.label-schema.schema-version="1.0" \ | ||
| org.label-schema.dockerfile="/Containerfile" \ | ||
| org.label-schema.name="OpenVox Server ($build_type)" \ | ||
| org.label-schema.version="$OPENVOXSERVER_VERSION" \ | ||
| org.label-schema.vcs-ref="$vcs_ref" \ | ||
| org.label-schema.build-date="$build_date" | ||
|
|
||
| ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \ | ||
| PATH=$PATH:/opt/puppetlabs/server/bin:/opt/puppetlabs/puppet/bin:/opt/puppetlabs/bin \ | ||
| SSLDIR=/etc/puppetlabs/puppet/ssl \ | ||
| LOGDIR=/var/log/puppetlabs/puppetserver \ | ||
| OPENVOXSERVER_HOSTNAME="" \ | ||
| CERTNAME="" \ | ||
| DNS_ALT_NAMES="" \ | ||
| OPENVOXSERVER_PORT=8140 \ | ||
| AUTOSIGN=true \ | ||
| OPENVOXSERVER_MAX_ACTIVE_INSTANCES=1 \ | ||
| OPENVOXSERVER_MAX_REQUESTS_PER_INSTANCE=0 \ | ||
| CA_ENABLED=true \ | ||
| CA_TTL=157680000 \ | ||
| CA_HOSTNAME=puppet \ | ||
| CA_PORT=8140 \ | ||
| CA_ALLOW_SUBJECT_ALT_NAMES=false \ | ||
| INTERMEDIATE_CA=false \ | ||
| INTERMEDIATE_CA_BUNDLE=/etc/puppetlabs/intermediate/ca.pem \ | ||
| INTERMEDIATE_CRL_CHAIN=/etc/puppetlabs/intermediate/crl.pem \ | ||
| INTERMEDIATE_CA_KEY=/etc/puppetlabs/intermediate/key.pem \ | ||
| USE_OPENVOXDB=true \ | ||
| OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \ | ||
| OPENVOX_STORECONFIGS_BACKEND="puppetdb" \ | ||
| OPENVOX_STORECONFIGS=true \ | ||
| OPENVOX_REPORTS="puppetdb" \ | ||
| OPENVOXSERVER_GRAPHITE_EXPORTER_ENABLED=false \ | ||
| OPENVOXSERVER_GRAPHITE_PORT=9109 \ | ||
| OPENVOXSERVER_GRAPHITE_HOST=exporter \ | ||
| OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \ | ||
| OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \ | ||
| ENVIRONMENTPATH=/etc/puppetlabs/code/environments \ | ||
| HIERACONFIG='$confdir/hiera.yaml' \ | ||
| HOME=/home/puppet \ | ||
| CSR_ATTRIBUTES='{}' | ||
|
|
||
| COPY docker-entrypoint.sh \ | ||
| healthcheck.sh \ | ||
| Containerfile \ | ||
| / | ||
|
|
||
| COPY docker-entrypoint.d /docker-entrypoint.d | ||
| COPY --from=builder /var/lib/gems/ /var/lib/gems/ | ||
| COPY --from=builder /usr/local/bin/r10k /usr/local/bin/ | ||
|
|
||
| #ADD https://apt.overlookinfratech.com/openvox${OPENVOX_RELEASE}-release-ubuntu${UBUNTU_VERSION}.deb / | ||
| ADD https://apt.overlookinfratech.com/openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb / | ||
| RUN apt update && apt install -y ca-certificates && \ | ||
| dpkg -i /openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb && \ | ||
| rm -f /openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb | ||
|
|
||
| RUN groupadd -g ${OPENVOX_USER_GID} puppet && \ | ||
| useradd -m -u ${OPENVOX_USER_UID} -g puppet puppet && \ | ||
| chmod +x /docker-entrypoint.sh /healthcheck.sh /docker-entrypoint.d/*.sh && \ | ||
| apt-get update && \ | ||
| apt-get upgrade -y && \ | ||
| apt-get install -y $PACKAGES && \ | ||
| apt-get install -y openvox-agent=${OPENVOXAGENT_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get install -y openvox-server=${OPENVOXSERVER_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get install -y openvoxdb-termini=${OPENVOXDB_VERSION}-1+debian${DEBIAN_VERSION} && \ | ||
| apt-get autoremove -y && \ | ||
| apt-get clean && \ | ||
| rm -rf /var/lib/apt/lists/* && \ | ||
| cp -pr /etc/puppetlabs/puppet /var/tmp && \ | ||
| cp -pr /opt/puppetlabs/server/data/puppetserver /var/tmp && \ | ||
| rm -rf /var/tmp/puppet/ssl | ||
|
|
||
| # needs to be copied after package installation | ||
| COPY puppetserver /etc/default/puppetserver | ||
|
|
||
| COPY logback.xml \ | ||
| request-logging.xml \ | ||
| /etc/puppetlabs/puppetserver/ | ||
|
|
||
| COPY conf.d/puppetserver.conf \ | ||
| conf.d/product.conf \ | ||
| /etc/puppetlabs/puppetserver/conf.d/ | ||
|
|
||
| COPY puppetdb.conf /var/tmp/puppet/ | ||
|
|
||
| RUN chown -R puppet /etc/puppetlabs/puppetserver && \ | ||
| chown -R puppet:puppet /var/tmp/puppet && \ | ||
| chown -R puppet:puppet /opt/puppetlabs && \ | ||
| chown -R puppet:puppet /usr/local/bin && \ | ||
| chown -R puppet:puppet /var/lib/gems && \ | ||
| chown -R puppet:puppet /etc/puppetlabs && \ | ||
| chown -R puppet:puppet /var/tmp/puppetserver && \ | ||
| chown -R puppet:puppet /etc/default && \ | ||
| chown -R puppet:puppet /docker-entrypoint.sh /healthcheck.sh /docker-entrypoint.d | ||
|
|
||
| USER puppet | ||
|
|
||
| RUN mkdir -p /home/puppet/.puppetlabs && \ | ||
| ln -s /etc/puppetlabs /home/puppet/.puppetlabs/etc && \ | ||
| ln -s /opt/puppetlabs /home/puppet/.puppetlabs/opt | ||
|
|
||
| RUN echo 'confdir = /etc/puppetlabs/puppet' >> /etc/puppetlabs/puppet/puppet.conf && \ | ||
| puppet config set cadir /etc/puppetlabs/puppetserver/ca/ | ||
| WORKDIR /home/puppet | ||
|
|
||
| # k8s uses livenessProbe, startupProbe, readinessProbe and ignores HEALTHCHECK | ||
| HEALTHCHECK --interval=20s --timeout=15s --retries=12 --start-period=3m CMD ["/healthcheck.sh"] | ||
|
|
||
| # NOTE: this is just documentation on defaults | ||
| EXPOSE 8140 | ||
|
|
||
| ENTRYPOINT ["dumb-init", "/docker-entrypoint.sh"] | ||
| CMD ["foreground"] |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
in the deb/rpm packages, it's
/opt/puppetlabs/server/data/puppetserverThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It doesnt matter if the HOME directory is
/opt/puppetlabs/server/data/puppetserver
or
/home/puppet
because it will still be interpolated as
/opt/puppetlabs/server/data/puppetserver/.puppetlabs/....or
/home/puppet/.puppetlabs/...I simply felt that
/home/puppet/.puppetlabs/...looks a lot cleaner. One could just as easily setup the SYMLINK for the opt folder as well, simply by changing this:There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actually this can get simpler
However CADIR for a non-root user is set to:
Which conflicts that it should be /etc/puppetlabs/puppetserver/ca.
Also, I need to do a similar link for the OPT and VAR folders.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be fixed. I added a similar symlink to /opt.
I also fixed the incorrect non-root CA dir by adding:
puppet config set cadir /etc/puppetlabs/puppetserver/ca/There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm just wondering why this is required at all. When systemd starts the normal puppetserver unit, it does that as
puppetuser, but it doesn't look for configs in its home.Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Systemd doesn't exist in the container.
I dont have a puppetserver in front of me. But I would guess it's because the service runs as root.
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#User=
And I'm guessing the environment in this case is setup for root, not puppet, even though the binaries are being ran as puppet.
I'm willing to bet if you actually ssh'd into a server as a non root user and ran the systemd unit without sudo (you would have to use the --user flag https://wiki.archlinux.org/title/Systemd/User) it would be a different story.