Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-09-02 10:08:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2777 from polarathene/chore/consistent-dockerfile

Browse Source 
chore: `Dockerfile` consistency
This commit is contained in:
Dirk Wetter
2025-05-19 13:10:45 +02:00
committed by GitHub
parent 0d0c5d0ab9 9dc4ea338b
commit 54964a9bc6
4 changed files with 70 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/docker-3.2.yml vendored
View File

@ -15,10 +15,8 @@ env:
GIT_BRANCH: "3.2" GIT_BRANCH: "3.2"
jobs: jobs:
deploy: deploy:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
steps: steps:
- name: lowercase the repository name - name: lowercase the repository name
run: echo "REPO=${GITHUB_REPOSITORY@L}" >> "${GITHUB_ENV}" run: echo "REPO=${GITHUB_REPOSITORY@L}" >> "${GITHUB_ENV}"

61
Dockerfile
View File

@ -6,42 +6,53 @@ ARG INSTALL_ROOT=/rootfs
FROM opensuse/leap:${LEAP_VERSION} AS builder FROM opensuse/leap:${LEAP_VERSION} AS builder
ARG CACHE_ZYPPER=/tmp/cache/zypper ARG CACHE_ZYPPER=/tmp/cache/zypper
ARG INSTALL_ROOT ARG INSTALL_ROOT
RUN \ RUN <<HEREDOC
# /etc/os-release provides ${VERSION_ID} for usage in ZYPPER_OPTIONS: # Remove the `openh264` the `non-oss` repos to save on sync time, they're not needed:
source /etc/os-release \ zypper removerepo repo-openh264 repo-non-oss repo-update-non-oss
# We don't need the openh264.repo and the non-oss repos, just costs build time (repo caches). # `/etc/os-release` provides the `VERSION_ID` variable for usage in `ZYPPER_OPTIONS`:
&& zypper removerepo repo-openh264 repo-non-oss repo-update-non-oss \ source /etc/os-release
&& export ZYPPER_OPTIONS=( --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" ) \ export ZYPPER_OPTIONS=( --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" )
&& zypper "${ZYPPER_OPTIONS[@]}" --gpg-auto-import-keys refresh \
&& zypper "${ZYPPER_OPTIONS[@]}" --non-interactive install --download-in-advance --no-recommends \ # Install packages to a custom root-fs location (defined in `ZYPPER_OPTIONS`):
bash procps grep gawk sed coreutils busybox ldns libidn2-0 socat openssl curl \ zypper "${ZYPPER_OPTIONS[@]}" --gpg-auto-import-keys refresh
&& zypper "${ZYPPER_OPTIONS[@]}" clean --all \ zypper "${ZYPPER_OPTIONS[@]}" --non-interactive install --download-in-advance --no-recommends \
## Cleanup (reclaim approx 13 MiB): bash procps grep gawk sed coreutils busybox ldns libidn2-0 socat openssl curl
# Optional - Avoid `CACHE_ZYPPER` from being redundantly cached in this RUN layer:
# (doesn't improve `INSTALL_ROOT` size thanks to `--cache-dir`)
zypper "${ZYPPER_OPTIONS[@]}" clean --all
# Cleanup (reclaim approx 13 MiB):
# None of this content should be relevant to the container: # None of this content should be relevant to the container:
&& rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info} \ rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info} \
"${INSTALL_ROOT}/usr/share/misc/termcap" \ "${INSTALL_ROOT}/usr/share/misc/termcap" \
"${INSTALL_ROOT}/usr/lib/sysimage/rpm" "${INSTALL_ROOT}/usr/lib/sysimage/rpm"
HEREDOC
# Create a new image with the contents of ${INSTALL_ROOT} # Create a new image with the contents of ${INSTALL_ROOT}
FROM scratch AS base-leap FROM scratch AS base-leap
ARG INSTALL_ROOT ARG INSTALL_ROOT
COPY --link --from=builder ${INSTALL_ROOT} / COPY --link --from=builder ${INSTALL_ROOT} /
RUN \ RUN <<HEREDOC
# Creates symlinks for any other commands that busybox can provide that # Creates symlinks for any other commands that busybox can provide that
# aren't already provided by coreutils (notably hexdump + tar, see #2403): # aren't already provided by coreutils (notably hexdump + tar, see #2403):
# NOTE: `busybox --install -s` is not supported via the leap package, manually symlink commands. # NOTE: `busybox --install -s` is not supported via the leap package, manually symlink commands.
ln -s /usr/bin/busybox /usr/bin/tar \ ln -s /usr/bin/busybox /usr/bin/tar
&& ln -s /usr/bin/busybox /usr/bin/hexdump \ ln -s /usr/bin/busybox /usr/bin/hexdump
&& ln -s /usr/bin/busybox /usr/bin/xxd \ ln -s /usr/bin/busybox /usr/bin/xxd
# Add a non-root user `testssl`, this is roughly equivalent to the `useradd` command: # Add a non-root user `testssl`, this is roughly equivalent to the `useradd` command:
# useradd --uid 1000 --user-group --create-home --shell /bin/bash testssl # useradd --uid 1000 --user-group --create-home --shell /bin/bash testssl
&& echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd \ echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd
&& echo 'testssl:x:1000:' >> /etc/group \ echo 'testssl:x:1000:' >> /etc/group
&& echo 'testssl:!::0:::::' >> /etc/shadow \ echo 'testssl:!::0:::::' >> /etc/shadow
&& install --mode 2755 --owner testssl --group testssl --directory /home/testssl \ install --mode 2755 --owner testssl --group testssl --directory /home/testssl
# The home directory will install a copy of `testssl.sh`, symlink the script to be used as a command:
&& ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh # A copy of `testssl.sh` will be added to the home directory,
# symlink to that file so it can be treated as a command:
ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh
HEREDOC
# Runtime config: # Runtime config:
USER testssl USER testssl
@ -49,7 +60,7 @@ ENTRYPOINT ["testssl.sh"]
CMD ["--help"] CMD ["--help"]
# Final image stage (add `testssl.sh` project files) # Final image stage (add `testssl.sh` project files)
# Choose either one as the final stage (defaults to last stage, `dist-local`) # Choose either one as the final stage (defaults to the last stage, `dist-local`)
# 62MB Image (Remote repo clone, cannot filter content through `.dockerignore`): # 62MB Image (Remote repo clone, cannot filter content through `.dockerignore`):
FROM base-leap AS dist-git FROM base-leap AS dist-git

22
Dockerfile.alpine
View File

@ -1,8 +1,20 @@
# syntax=docker.io/docker/dockerfile:1
FROM alpine:3.21 AS base-alpine FROM alpine:3.21 AS base-alpine
RUN apk add --no-cache bash procps drill coreutils libidn curl socat openssl xxd \ RUN <<HEREDOC
&& addgroup testssl \ apk add --no-cache bash procps drill coreutils libidn curl socat openssl xxd
&& adduser -G testssl -g "testssl user" -s /bin/bash -D testssl \
&& ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh # Add a non-root user `testssl`, this is roughly equivalent to the `adduser` command:
# addgroup testssl && adduser -G testssl -g "testssl user" -s /bin/bash -D testssl
echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd
echo 'testssl:x:1000:' >> /etc/group
echo 'testssl:!::0:::::' >> /etc/shadow
install --mode 2755 --owner testssl --group testssl --directory /home/testssl
# A copy of `testssl.sh` will be added to the home directory,
# symlink to that file so it can be treated as a command:
ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh
HEREDOC
# Runtime config: # Runtime config:
USER testssl USER testssl
@ -10,7 +22,7 @@ ENTRYPOINT ["testssl.sh"]
CMD ["--help"] CMD ["--help"]
# Final image stage (add `testssl.sh` project files) # Final image stage (add `testssl.sh` project files)
# Choose either one as the final stage (defaults to last stage, `dist-git`) # Choose either one as the final stage (defaults to the last stage, `dist-local`)
# 35MB Image (Remote repo clone, cannot filter content through `.dockerignore`): # 35MB Image (Remote repo clone, cannot filter content through `.dockerignore`):
FROM base-alpine AS dist-git FROM base-alpine AS dist-git

24
Dockerfile.md
View File

@ -1,6 +1,6 @@
## Usage ## Usage
Run the image with `testssl.sh` options appended (default is `--help`). The container entrypoint is already set to `testsl.sh` as the command for convenience. Run the image with `testssl.sh` options appended (default is `--help`). The container entrypoint is already set to `testsl.sh` for convenience.
```bash ```bash
docker run --rm -it ghcr.io/testssl/testssl.sh:3.2 --fs github.com docker run --rm -it ghcr.io/testssl/testssl.sh:3.2 --fs github.com
@ -19,19 +19,19 @@ docker run --rm -it -v /tmp:/data --workdir /data ghcr.io/testssl/testssl.sh:3.2
> [!NOTE] > [!NOTE]
> - The UID/GID ownership of the file will be created by the container user `testssl` (`1000:1000`), with permissions `644`. > - The UID/GID ownership of the file will be created by the container user `testssl` (`1000:1000`), with permissions `644`.
> - Your host directory must permit the `testssl` container user or group to write to that host volume. You could alternatively use [`docker cp`](https://docs.docker.com/reference/cli/docker/container/cp/). > - Your host directory must permit the `testssl` container user or group to write to that host volume. You could alternatively use [`docker cp`][docker-docs::cli::cp].
## Images ## Images
### Available at DockerHub and GHCR ### Available at DockerHub and GHCR
You can pull the image from either of these registries: You can pull the image from either of these registries:
- DockerHub: [`drwetter/testssl.sh`](https://hub.docker.com/r/drwetter/testssl.sh) - DockerHub: [`drwetter/testssl.sh`][image-registry::dockerhub]
- GHCR: [`ghcr.io/testssl/testssl.sh`](https://github.com/testssl/testssl.sh/pkgs/container/testssl.sh) - GHCR: [`ghcr.io/testssl/testssl.sh`][image-registry::ghcr]
Supported tags: Supported tags:
- `3.2` / `latest` - `3.2` / `latest`
- `3.0` is the old stable version ([soon to become EOL](https://github.com/testssl/testssl.sh/tree/3.0#status)) - `3.0` is the old stable version ([soon to become EOL][testssl::v3p0-eol])
### Building the `testssl.sh` container image ### Building the `testssl.sh` container image
@ -47,7 +47,9 @@ There are two base images supported:
- openSUSE Leap ([`Dockerfile`](./Dockerfile)), glibc-based + faster. - openSUSE Leap ([`Dockerfile`](./Dockerfile)), glibc-based + faster.
- Alpine ([`Dockerfile`](./Dockerfile.alpine)), musl-based + half the size. - Alpine ([`Dockerfile`](./Dockerfile.alpine)), musl-based + half the size.
The Alpine variant is made available if you need broarder platform support, or an image about 30MB smaller at the expense of slightly slower performance. The Alpine variant is made available if you need broader platform support, or an image about 30MB smaller at the expense of [slightly slower performance][testssl::base-image-performance].
For contributors, if needing context on the [package selection has been documented][testssl::base-image-packages] for each base image.
#### Tip - Remote build context + `Dockerfile` #### Tip - Remote build context + `Dockerfile`
@ -58,7 +60,7 @@ docker build --tag localhost/testssl.sh:3.2 https://github.com/testssl/testssl.s
``` ```
> [!NOTE] > [!NOTE]
> This will produce a slightly larger image as [`.dockerignore` is not supported with remote build contexts](https://github.com/docker/buildx/issues/3169). > This will produce a slightly larger image as [`.dockerignore` is not supported with remote build contexts][build::dockerignore-remote-context].
--- ---
@ -70,3 +72,11 @@ docker build \
--file https://raw.githubusercontent.com/testssl/testssl.sh/3.2/Dockerfile.alpine \ --file https://raw.githubusercontent.com/testssl/testssl.sh/3.2/Dockerfile.alpine \
https://github.com/testssl/testssl.sh.git#3.2 https://github.com/testssl/testssl.sh.git#3.2
``` ```
[docker-docs::cli::cp]: https://docs.docker.com/reference/cli/docker/container/cp/
[image-registry::dockerhub]: https://hub.docker.com/r/drwetter/testssl.sh
[image-registry::ghcr]: https://github.com/testssl/testssl.sh/pkgs/container/testssl.sh
[testssl::v3p0-eol]: https://github.com/testssl/testssl.sh/tree/3.0#status
[testssl::base-image-performance]: https://github.com/testssl/testssl.sh/issues/2422#issuecomment-2841822406
[testssl::base-image-packages]: https://github.com/testssl/testssl.sh/issues/2422#issuecomment-2841822406
[build::dockerignore-remote-context]: https://github.com/docker/buildx/issues/3169