Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2024-12-29 04:49:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

refactor: Support syntax without BuildKit features

Browse Source 
These have been available via opt-in prior to v23 of Docker Engine with `DOCKER_BUILDKIT=1` ENV as a prefix to running `docker build`, however it's been requested to avoid the syntax.

No HereDoc (multi-line RUN with EOF marker) or `RUN --mount` available. This makes the `busybox` approach a hassle, so I've brought back the explicit creation of user and home dir.

Without the cache mounts, bring back `zypper clean`. It's not doing much as the `--cache-dir` is still set, but should reduce disk space for the `builder` layer. Local builds will be slower as a result when this layer is invalidated.

AFAIK, this also makes it tricky to use the `ZYPPER_OPTIONS`? So no longer DRY.
This commit is contained in:
Brennan Kinney 2023-03-22 22:13:18 +13:00
parent 718eb3461c
commit 1212ad8e59
1 changed files with 22 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
Dockerfile
View File

@ -6,44 +6,34 @@ ARG INSTALL_ROOT=/rootfs
FROM opensuse/leap:${LEAP_VERSION} as builder FROM opensuse/leap:${LEAP_VERSION} as builder
ARG CACHE_ZYPPER=/tmp/cache/zypper ARG CACHE_ZYPPER=/tmp/cache/zypper
ARG INSTALL_ROOT ARG INSTALL_ROOT
# --mount is only necessary for persisting the zypper cache on the build host, # Usually you could source this from /etc/os-release
# Paired with --cache-dir below, RUN layer invalidation does not clear this cache. # Might not always match the image tag:
# Not useful for CI, only local builds that retain the storage. ARG VERSION_ID=15.4
RUN --mount=type=cache,target="${CACHE_ZYPPER}",sharing=locked <<EOF RUN zypper --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" \
# Provides $VERSION_ID --gpg-auto-import-keys refresh \
source /etc/os-release && zypper --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" \
ZYPPER_OPTIONS=( --non-interactive install --download-in-advance --no-recommends \
--releasever "${VERSION_ID}" bash procps grep gawk sed coreutils busybox-util-linux busybox-vi ldns libidn2-0 socat openssl curl \
--installroot "${INSTALL_ROOT}" && zypper --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" \
--cache-dir "${CACHE_ZYPPER}" clean --all
) ## Cleanup (reclaim approx 13 MiB):
# None of this content should be relevant to the container:
# Sync package repos: RUN rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info}
zypper ${ZYPPER_OPTIONS[@]} --gpg-auto-import-keys refresh # Functionality that the container doesn't need:
RUN rm "${INSTALL_ROOT}/usr/share/misc/termcap" \
zypper ${ZYPPER_OPTIONS[@]} --non-interactive install \ && rm -r "${INSTALL_ROOT}/usr/lib/sysimage/rpm"
--download-in-advance --no-recommends \
bash procps grep gawk sed coreutils busybox-util-linux busybox-vi ldns libidn2-0 socat openssl curl
## Cleanup (reclaim approx 13 MiB):
# None of this content should be relevant to the container:
rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info}
# Functionality that the container doesn't need:
rm "${INSTALL_ROOT}/usr/share/misc/termcap"
rm -r "${INSTALL_ROOT}/usr/lib/sysimage/rpm"
EOF
# Create a new image with the contents of $INSTALL_ROOT # Create a new image with the contents of $INSTALL_ROOT
FROM scratch FROM scratch
ARG INSTALL_ROOT ARG INSTALL_ROOT
COPY --link --from=builder ${INSTALL_ROOT} / COPY --link --from=builder ${INSTALL_ROOT} /
WORKDIR /home/testssl # Create user + (home with SGID set):
RUN --mount=type=bind,from=busybox:latest,source=/bin,target=/bin <<EOF RUN echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd \
/bin/adduser -D -s /bin/bash testssl && echo 'testssl:x:1000:' >> /etc/group \
/bin/ln -s /home/testssl/testssl.sh /usr/local/bin/ && echo 'testssl:!::0:::::' >> /etc/shadow \
EOF && install --mode 2755 --owner testssl --group testssl --directory /home/testssl \
&& ln -s /home/testssl/testssl.sh /usr/local/bin/
# Copy over build context (after filtered by .dockerignore): bin/ etc/ testssl.sh # Copy over build context (after filtered by .dockerignore): bin/ etc/ testssl.sh
COPY --chown=testssl:testssl . /home/testssl/ COPY --chown=testssl:testssl . /home/testssl/