vulnerability-engine/Dockerfile at master · RedHatInsights/vulnerability-engine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
ARG ALT_REPO

FROM registry.access.redhat.com/ubi9/ubi:9.8-1787634763@sha256:b8c53f907b7ea8934d6bb23b319ca7b5ab567e61a0806ffc80170631cabc7563 AS buildimg

ARG ALT_REPO


RUN (dnf module enable -y postgresql:18 || curl -o /etc/yum.repos.d/postgresql.repo $ALT_REPO) && \
    dnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
        python312 python3.12-pip python3.12-devel \
        gcc make redhat-rpm-config file kernel-srpm-macros go-srpm-macros \
        postgresql-server-devel postgresql-static libpq \
        postgresql readline-devel zlib-devel \
        openssl-devel lz4-devel libzstd-devel libffi-devel \
        cargo rust gcc-c++ && \
    dnf clean all

# Build pg_repack 1.5.2 from git submodule
COPY .pg_repack /tmp/pg_repack
RUN cd /tmp/pg_repack && \
    make && make install

WORKDIR /engine

ADD requirements.txt /engine/

# Limit to 12 due to memory usage
ENV GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS=12

RUN pip3.12 install --upgrade pip && \
    pip3.12 install -r requirements.txt && \
    pip3.12 cache purge

# -------------
# runtime image
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1787647261@sha256:580752f96d36c4132bffd30f9c34865bf4bd87f6aa161c969d117f21732e50f7 AS runtimeimg
ARG ALT_REPO

# Install PostgreSQL without pg_repack (will copy from builder)
RUN (microdnf module enable -y postgresql:18 || curl -o /etc/yum.repos.d/postgresql.repo $ALT_REPO) && \
    microdnf install -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs \
        python312 libpq shadow-utils git-core postgresql && \
    microdnf clean all

# Copy pg_repack 1.5.2 from builder stage
COPY --from=buildimg /usr/bin/pg_repack /usr/local/bin/pg_repack
COPY --from=buildimg /usr/lib64/pgsql/pg_repack.so /usr/local/lib/postgresql/
COPY --from=buildimg /usr/share/pgsql/extension/ /usr/local/share/postgresql/extension/

WORKDIR /engine

RUN adduser --gid 0 -d /engine --no-create-home insights

# for manager purposes
RUN mkdir -p /tmp/prometheus_multiproc && \
    chown -R insights:0 /tmp/prometheus_multiproc && \
    chgrp -R 0 /tmp/prometheus_multiproc && \
    chmod -R g=u /tmp/prometheus_multiproc
ENV prometheus_multiproc_dir=/tmp/prometheus_multiproc

# minimal schema required by application, used for waiting in services until DB migration is finished
ENV MINIMAL_SCHEMA=172

# Baked-in content for FedRAMP
ARG STATIC_ASSETS=0
ARG GIT_TOKEN=""
RUN if [ "${STATIC_ASSETS}" == 1 ] ; then \
        curl -o /etc/pki/ca-trust/source/anchors/2022-IT-Root-CA.crt https://certs.corp.redhat.com/certs/2022-IT-Root-CA.pem && \
        update-ca-trust extract && \
        git clone --depth 1 https://gitlab.cee.redhat.com/vmaas/vmaas-assets.git /engine/vmaas_assets_git && \
        git clone --depth 1 https://gitlab.cee.redhat.com/insights-rules/insights-playbooks.git /engine/insights_playbooks_git && \
        git clone --depth 1 "https://$GIT_TOKEN@github.com/RedHatInsights/insights-content-vulnerability.git" /engine/insights_content_vulnerability_git && \
        # below is needed to avoid git 'detected dubious ownership' error when running as a rootless container...
        git config --system --add safe.directory /engine/vmaas_assets_git && \
        git config --system --add safe.directory /engine/insights_playbooks_git && \
        git config --system --add safe.directory /engine/insights_content_vulnerability_git && \
        echo "Cloned static assets" ; \
    fi

USER insights

COPY --from=buildimg /usr/local/lib/python3.12/site-packages   /usr/local/lib/python3.12/site-packages
COPY --from=buildimg /usr/local/lib64/python3.12/site-packages /usr/local/lib64/python3.12/site-packages
COPY --from=buildimg /usr/local/bin/gunicorn                   /usr/local/bin/

COPY --from=buildimg --chown=insights:root /engine/requirements.txt /engine/

ADD entrypoint.sh \
    develfeatureflags.json \
    manager.healthz.spec.yaml \
    manager.admin.spec.yaml \
    manager.spec.yaml \
    /database/upgrade/dbupgrade.sh \
    /database/schema/local_init_db.sh \
    /engine/
ADD /taskomatic/*.py                       /engine/taskomatic/
ADD /taskomatic/jobs/*.py                  /engine/taskomatic/jobs/
ADD /vmaas_sync/*.py                       /engine/vmaas_sync/
ADD /database/*.py                         /engine/database/
ADD /database/upgrade/*.py                 /engine/database/upgrade/
ADD /database/schema/*.sql                 /engine/database/schema/
ADD /database/schema/upgrade_scripts/*.sql /engine/database/schema/upgrade_scripts/
ADD /evaluator/*.py                        /engine/evaluator/
ADD /listener/*.py                         /engine/listener/
ADD /common/*.py                           /engine/common/
ADD /manager/*.py                          /engine/manager/
ADD /notificator/*.py                      /engine/notificator/
ADD /exploit_sync/*py                      /engine/exploit_sync/
ADD /grouper/*.py                          /engine/grouper/
ADD /cluster/*.py                          /engine/cluster/