Skip to content

Commit ecd044c

Browse files
tesshuflowertesshuflower
committed
Dockerfile for konflux builds
- add Dockerfile.rhtap with golang builder, final img and fips flags for downstream (to be used by konflux) Signed-off-by: Tesshu Flower <[email protected]>
1 parent a65ed0d commit ecd044c

File tree

2 files changed

+241
-0
lines changed

2 files changed

+241
-0
lines changed

‎.ci-scripts/yamlconfig.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ ignore: |
1111
hack/crds/*
1212
helm/volsync/**
1313
.krew.yaml
14+
.tekton/*
1415
rules:
1516
comments: # renovate-bot dosen't put 2 spaces before the version number
1617
ignore: |

‎Dockerfile.rhtap‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
######################################################################
2+
# Establish a common builder image for all golang-based images
3+
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23 AS golang-builder
4+
USER root
5+
WORKDIR /workspace
6+
# We don't vendor modules. Enforce that behavior
7+
ENV GOFLAGS=-mod=readonly
8+
ENV GO111MODULE=on
9+
ENV CGO_ENABLED=1
10+
ARG TARGETOS
11+
ARG TARGETARCH
12+
ENV GOOS=${TARGETOS:-linux}
13+
ENV GOARCH=${TARGETARCH}
14+
ENV GOEXPERIMENT=strictfipsruntime
15+
ENV BUILD_TAGS="strictfipsruntime"
16+
17+
18+
######################################################################
19+
# Build the manager binary
20+
FROM golang-builder AS manager-builder
21+
22+
# Copy the Go Modules manifests & download dependencies
23+
COPY go.mod go.mod
24+
COPY go.sum go.sum
25+
RUN go mod download
26+
27+
# Copy the go source
28+
COPY cmd/ cmd/
29+
COPY api/ api/
30+
COPY internal/ internal/
31+
32+
# Build
33+
ARG version_arg="(unknown)"
34+
ARG tags_arg=${BUILD_TAGS}
35+
RUN go build -a -o manager -ldflags "-X=main.volsyncVersion=${version_arg}" -tags "${tags_arg}" ./cmd/...
36+
37+
# Verify that FIPS crypto libs are accessible
38+
RUN nm manager | grep -q "goboringcrypto\|golang-fips"
39+
40+
######################################################################
41+
# Build rclone
42+
FROM golang-builder AS rclone-builder
43+
44+
ARG RCLONE_VERSION=v1.63.1
45+
ARG RCLONE_GIT_HASH=bd1fbcae12f795f498c7ace6af9d9cc218102094
46+
47+
RUN git clone --depth 1 -b ${RCLONE_VERSION} https://github.com/rclone/rclone.git
48+
WORKDIR /workspace/rclone
49+
50+
# Make sure the Rclone version tag matches the git hash we're expecting
51+
RUN /bin/bash -c "[[ $(git rev-list -n 1 HEAD) == ${RCLONE_GIT_HASH} ]]"
52+
53+
RUN GOTAGS=${BUILD_TAGS} make rclone
54+
55+
# Verify that FIPS crypto libs are accessible
56+
RUN nm rclone | grep -q "goboringcrypto\|golang-fips"
57+
58+
######################################################################
59+
# Build restic
60+
FROM golang-builder AS restic-builder
61+
62+
COPY /mover-restic/restic ./restic
63+
COPY /mover-restic/minio-go ./minio-go
64+
65+
WORKDIR /workspace/restic
66+
67+
RUN go run build.go --enable-cgo --tags ${BUILD_TAGS}
68+
69+
# Verify that FIPS crypto libs are accessible
70+
RUN nm restic | grep -q "goboringcrypto\|golang-fips"
71+
72+
######################################################################
73+
# Build syncthing
74+
FROM golang-builder AS syncthing-builder
75+
76+
ARG SYNCTHING_VERSION="v1.29.5"
77+
ARG SYNCTHING_GIT_HASH="f0b666269b6bdd1e8000e56e421367260e807479"
78+
79+
RUN git clone --depth 1 -b ${SYNCTHING_VERSION} https://github.com/syncthing/syncthing.git
80+
WORKDIR /workspace/syncthing
81+
82+
# Make sure we have the correct Syncthing release
83+
RUN /bin/bash -c "[[ $(git rev-list -n 1 HEAD) == ${SYNCTHING_GIT_HASH} ]]"
84+
85+
RUN go run build.go -no-upgrade -tags ${BUILD_TAGS}
86+
87+
# Verify that FIPS crypto libs are accessible
88+
RUN nm bin/syncthing | grep -q "goboringcrypto\|golang-fips"
89+
90+
######################################################################
91+
# Build diskrsync binary
92+
FROM golang-builder AS diskrsync-builder
93+
94+
ARG DISKRSYNC_VERSION="v1.3.0"
95+
ARG DISKRSYNC_GIT_HASH="507805c4378495fc2267b77f6eab3d6bb318c86c"
96+
97+
RUN git clone --depth 1 -b ${DISKRSYNC_VERSION} https://github.com/dop251/diskrsync.git
98+
WORKDIR /workspace/diskrsync
99+
100+
# Make sure we have the correct diskrsync release
101+
RUN /bin/bash -c "[[ $(git rev-list -n 1 HEAD) == ${DISKRSYNC_GIT_HASH} ]]"
102+
103+
RUN go build -a -o bin/diskrsync -tags ${BUILD_TAGS} ./diskrsync
104+
105+
# Verify that FIPS crypto libs are accessible
106+
# RUN nm bin/diskrsync | grep -q "goboringcrypto\|golang-fips"
107+
108+
109+
######################################################################
110+
# Build diskrsync-tcp binary
111+
FROM golang-builder AS diskrsync-tcp-builder
112+
113+
# Copy the Go Modules manifests & download dependencies
114+
COPY go.mod go.mod
115+
COPY go.sum go.sum
116+
RUN go mod download
117+
118+
# Copy the go source
119+
COPY diskrsync-tcp/ diskrsync-tcp/
120+
121+
# Build
122+
ARG version_arg="(unknown)"
123+
RUN go build -a -o diskrsync-tcp/diskrsync-tcp -ldflags "-X=main.volsyncVersion=${version_arg}" -tags ${BUILD_TAGS} diskrsync-tcp/main.go
124+
125+
# Verify that FIPS crypto libs are accessible
126+
RUN nm diskrsync-tcp/diskrsync-tcp | grep -q "goboringcrypto\|golang-fips"
127+
128+
######################################################################
129+
# Final container
130+
FROM registry.redhat.io/ubi9/ubi-minimal:latest
131+
WORKDIR /
132+
133+
RUN microdnf --refresh update -y && \
134+
microdnf --nodocs --setopt=install_weak_deps=0 install -y \
135+
acl `# rclone - getfacl/setfacl` \
136+
openssh `# rsync/ssh - ssh key generation in operator` \
137+
openssh-clients `# rsync/ssh - ssh client` \
138+
openssh-server `# rsync/ssh - ssh server` \
139+
perl `# rsync/ssh - rrsync script` \
140+
stunnel `# rsync-tls` \
141+
openssl `# syncthing - server certs` \
142+
vim-minimal `# for mover debug` \
143+
tar `# for mover debug` \
144+
&& microdnf --setopt=install_weak_deps=0 install -y \
145+
`# docs are needed so rrsync gets installed for ssh variant` \
146+
rsync `# rsync/ssh, rsync-tls - rsync, rrsync` \
147+
&& microdnf clean all && \
148+
rm -rf /var/cache/yum
149+
150+
##### VolSync operator
151+
COPY --from=manager-builder /workspace/manager /manager
152+
153+
##### rclone
154+
COPY --from=rclone-builder /workspace/rclone/rclone /usr/local/bin/rclone
155+
COPY /mover-rclone/active.sh \
156+
/mover-rclone/
157+
RUN chmod a+rx /mover-rclone/*.sh
158+
159+
##### restic
160+
COPY --from=restic-builder /workspace/restic/restic /usr/local/bin/restic
161+
COPY /mover-restic/entry.sh \
162+
/mover-restic/
163+
RUN chmod a+rx /mover-restic/*.sh
164+
165+
##### rsync (ssh)
166+
COPY /mover-rsync/source.sh \
167+
/mover-rsync/destination.sh \
168+
/mover-rsync/destination-command.sh \
169+
/mover-rsync/
170+
RUN chmod a+rx /mover-rsync/*.sh
171+
172+
RUN ln -s /keys/destination /etc/ssh/ssh_host_rsa_key && \
173+
ln -s /keys/destination.pub /etc/ssh/ssh_host_rsa_key.pub && \
174+
install /usr/share/doc/rsync/support/rrsync /usr/local/bin && \
175+
\
176+
SSHD_CONFIG="/etc/ssh/sshd_config" && \
177+
sed -ir 's|^[#\s]*\(.*/etc/ssh/ssh_host_ecdsa_key\)$|#\1|' "$SSHD_CONFIG" && \
178+
sed -ir 's|^[#\s]*\(.*/etc/ssh/ssh_host_ed25519_key\)$|#\1|' "$SSHD_CONFIG" && \
179+
sed -ir 's|^[#\s]*\(PasswordAuthentication\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
180+
sed -ir 's|^[#\s]*\(KbdInteractiveAuthentication\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
181+
sed -ir 's|^[#\s]*\(AllowTcpForwarding\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
182+
sed -ir 's|^[#\s]*\(X11Forwarding\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
183+
sed -ir 's|^[#\s]*\(PermitTunnel\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
184+
sed -ir 's|^[#\s]*\(PidFile\)\s.*$|\1 /tmp/sshd.pid|' "$SSHD_CONFIG" && \
185+
sed -ir 's|^[#\s]*\(UsePAM\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
186+
sed -ir 's|^[#\s]*\(GSSAPIAuthentication\)\s.*$|\1 no|' "$SSHD_CONFIG" && \
187+
\
188+
INCLUDED_SSH_CONFIG_DIR="/etc/ssh/sshd_config.d" && \
189+
sed -ir 's|^[#\s]*\(UsePAM\)\s.*$|\1 no|' "$INCLUDED_SSH_CONFIG_DIR"/* && \
190+
sed -ir 's|^[#\s]*\(GSSAPIAuthentication\)\s.*$|\1 no|' "$INCLUDED_SSH_CONFIG_DIR"/*
191+
192+
##### rsync-tls
193+
COPY /mover-rsync-tls/client.sh \
194+
/mover-rsync-tls/server.sh \
195+
/mover-rsync-tls/
196+
RUN chmod a+rx /mover-rsync-tls/*.sh
197+
198+
##### syncthing
199+
COPY --from=syncthing-builder /workspace/syncthing/bin/syncthing /usr/local/bin/syncthing
200+
ENV SYNCTHING_DATA_TRANSFERMODE="sendreceive"
201+
COPY /mover-syncthing/config-template.xml \
202+
/mover-syncthing/
203+
RUN chmod a+r /mover-syncthing/config-template.xml
204+
205+
COPY /mover-syncthing/config-template.xml \
206+
/mover-syncthing/stignore-template \
207+
/mover-syncthing/entry.sh \
208+
/mover-syncthing/
209+
RUN chmod a+r /mover-syncthing/config-template.xml && \
210+
chmod a+r /mover-syncthing/stignore-template && \
211+
chmod a+rx /mover-syncthing/*.sh
212+
213+
##### diskrsync
214+
COPY --from=diskrsync-builder /workspace/diskrsync/bin/diskrsync /usr/local/bin/diskrsync
215+
216+
##### diskrsync-tcp
217+
COPY --from=diskrsync-tcp-builder /workspace/diskrsync-tcp/diskrsync-tcp /diskrsync-tcp
218+
219+
##### Set build metadata
220+
ARG builddate_arg="(unknown)"
221+
ARG version_arg="(unknown)"
222+
ENV builddate="${builddate_arg}"
223+
ENV version="${version_arg}"
224+
225+
# https://github.com/opencontainers/image-spec/blob/main/annotations.md
226+
LABEL org.opencontainers.image.base.name="registry.redhat.io/ubi9/ubi-minimal"
227+
LABEL org.opencontainers.image.created="${builddate}"
228+
LABEL org.opencontainers.image.description="VolSync data replication operator"
229+
LABEL org.opencontainers.image.documentation="https://volsync.readthedocs.io/"
230+
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
231+
LABEL org.opencontainers.image.revision="${version}"
232+
LABEL org.opencontainers.image.source="https://github.com/backube/volsync"
233+
LABEL org.opencontainers.image.title="VolSync"
234+
LABEL org.opencontainers.image.vendor="Backube"
235+
LABEL org.opencontainers.image.version="${version}"
236+
237+
# uid/gid: nobody/nobody
238+
USER 65534:65534
239+
240+
ENTRYPOINT [ "/bin/bash" ]

0 commit comments

Comments
 (0)