refactor: Change base image from `alpine:3.17` to `opensuse/leap:15.4`

This commit is contained in:
Brennan Kinney 2023-03-22 21:18:36 +13:00
parent cb451777d2
commit 1392987f01
1 changed files with 83 additions and 8 deletions

View File

@ -1,11 +1,87 @@
FROM alpine:3.17
# syntax=docker.io/docker/dockerfile:1
# HereDoc (EOF) feature (avoids needing `&& \`) requires BuildKit:
# https://docs.docker.com/engine/reference/builder/#here-documents
ARG LEAP_VERSION=15.4
ARG CACHE_ZYPPER=/tmp/cache/zypper
ARG INSTALL_ROOT=/rootfs
RUN apk update && \
apk upgrade && \
apk add bash procps drill git coreutils libidn curl socat openssl xxd && \
rm -rf /var/cache/apk/* && \
adduser -D -s /bin/bash testssl && \
ln -s /home/testssl/testssl.sh /usr/local/bin/
FROM opensuse/leap:${LEAP_VERSION} as builder
ARG CACHE_ZYPPER
ARG INSTALL_ROOT
# --mount is only necessary for persisting the zypper cache on the build host,
# Paired with --cache-dir below, RUN layer invalidation does not clear this cache.
# Not useful for CI, only local builds that retain the storage.
RUN --mount=type=cache,target="${CACHE_ZYPPER}",sharing=locked <<EOF
INSTALL_DEPS=()
# Mandatory commands. coreutils required over busybox for date command:
# https://github.com/drwetter/testssl.sh/commit/d1f03801738c87b6af39372c45e048af78c73c09
INSTALL_DEPS+=(bash procps grep gawk sed coreutils)
# Support better performance and debugging than hexdump via xxd:
# https://github.com/drwetter/testssl.sh/pull/1862
# busybox-util-linux (mandatory: hexdump) + busybox-vi (optional: xxd)
INSTALL_DEPS+=( busybox-util-linux busybox-vi )
# Support IDN (Internationalized Domain Names) lookups with drill:
# https://github.com/drwetter/testssl.sh/pull/1326
INSTALL_DEPS+=( ldns libidn2-0 )
# Support StartTLS injection:
# https://github.com/drwetter/testssl.sh/pull/1810
INSTALL_DEPS+=( socat openssl )
# Support --phone-out checks:
# https://github.com/drwetter/testssl.sh/commit/a66f5cfdbcd93427f4408bdd8cfc336488c02bb8
INSTALL_DEPS+=( curl )
# Provides $VERSION_ID
source /etc/os-release
# --releasever required due to no version info in install root.
# --installroot installs to location as if it was the system root.
# --cache-dir with above `RUN --mount` speeds this step up.
ZYPPER_OPTIONS=(
--releasever "${VERSION_ID}"
--installroot "${INSTALL_ROOT}"
--cache-dir "${CACHE_ZYPPER}"
)
# Sync package repos to get latest updates:
zypper ${ZYPPER_OPTIONS[@]} --gpg-auto-import-keys refresh
zypper ${ZYPPER_OPTIONS[@]} --non-interactive install \
--download-in-advance --no-recommends ${INSTALL_DEPS[@]}
# Clears the cache, but this is not stored in the install root location (like DNF does), thus not useful.
# zypper ${ZYPPER_OPTIONS[@]} clean --all
# Unlike DNF, there isn't a `--nodocs` install option, manually remove some excess weight (9 MiB):
rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info}
# Neither of these should be needed in the container, removes 4MiB
rm "${INSTALL_ROOT}/usr/share/misc/termcap"
rm -r "${INSTALL_ROOT}/usr/lib/sysimage/rpm"
EOF
# Create a new image with the contents of $INSTALL_ROOT
FROM scratch
ARG INSTALL_ROOT
COPY --link --from=builder ${INSTALL_ROOT} /
# zypper package `busybox-adduser` fails to install with `--installroot`,
# while the `shadow` package is too heavy just to add a user.
#
# Temporarily bind mount the `/bin` dir from another image that already
# has the `adduser` command, and it'll update `/etc/{group,passwd,shadow}` for us:
# Absolute path provided as some base images PATH would use those binaries instead,
# `adduser` varies in supported args, so this should avoid any surprises:
RUN --mount=type=bind,from=busybox:latest,source=/bin,target=/bin <<EOF
/bin/adduser -D -s /bin/bash testssl
/bin/ln -s /home/testssl/testssl.sh /usr/local/bin/
EOF
USER testssl
WORKDIR /home/testssl/
@ -14,5 +90,4 @@ WORKDIR /home/testssl/
COPY --chown=testssl:testssl . /home/testssl/
ENTRYPOINT ["testssl.sh"]
CMD ["--help"]