Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-09-02 10:08:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: Dockerfile - Adopt HereDoc syntax

Browse Source
This commit is contained in:
Brennan Kinney
2025-05-19 11:47:15 +12:00
committed by GitHub
parent 0d0c5d0ab9
commit 5b899958ec
2 changed files with 53 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
Dockerfile
View File

@ -6,42 +6,53 @@ ARG INSTALL_ROOT=/rootfs
FROM opensuse/leap:${LEAP_VERSION} AS builder FROM opensuse/leap:${LEAP_VERSION} AS builder
ARG CACHE_ZYPPER=/tmp/cache/zypper ARG CACHE_ZYPPER=/tmp/cache/zypper
ARG INSTALL_ROOT ARG INSTALL_ROOT
RUN \ RUN <<HEREDOC
# /etc/os-release provides ${VERSION_ID} for usage in ZYPPER_OPTIONS: # Remove the `openh264` the `non-oss` repos to save on sync time, they're not needed:
source /etc/os-release \ zypper removerepo repo-openh264 repo-non-oss repo-update-non-oss
# We don't need the openh264.repo and the non-oss repos, just costs build time (repo caches). # `/etc/os-release` provides the `VERSION_ID` variable for usage in `ZYPPER_OPTIONS`:
&& zypper removerepo repo-openh264 repo-non-oss repo-update-non-oss \ source /etc/os-release
&& export ZYPPER_OPTIONS=( --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" ) \ export ZYPPER_OPTIONS=( --releasever "${VERSION_ID}" --installroot "${INSTALL_ROOT}" --cache-dir "${CACHE_ZYPPER}" )
&& zypper "${ZYPPER_OPTIONS[@]}" --gpg-auto-import-keys refresh \
&& zypper "${ZYPPER_OPTIONS[@]}" --non-interactive install --download-in-advance --no-recommends \ # Install packages to a custom root-fs location (defined in `ZYPPER_OPTIONS`):
bash procps grep gawk sed coreutils busybox ldns libidn2-0 socat openssl curl \ zypper "${ZYPPER_OPTIONS[@]}" --gpg-auto-import-keys refresh
&& zypper "${ZYPPER_OPTIONS[@]}" clean --all \ zypper "${ZYPPER_OPTIONS[@]}" --non-interactive install --download-in-advance --no-recommends \
## Cleanup (reclaim approx 13 MiB): bash procps grep gawk sed coreutils busybox ldns libidn2-0 socat openssl curl
# Optional - Avoid `CACHE_ZYPPER` from being redundantly cached in this RUN layer:
# (doesn't improve `INSTALL_ROOT` size thanks to `--cache-dir`)
zypper "${ZYPPER_OPTIONS[@]}" clean --all
# Cleanup (reclaim approx 13 MiB):
# None of this content should be relevant to the container: # None of this content should be relevant to the container:
&& rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info} \ rm -r "${INSTALL_ROOT}/usr/share/"{licenses,man,locale,doc,help,info} \
"${INSTALL_ROOT}/usr/share/misc/termcap" \ "${INSTALL_ROOT}/usr/share/misc/termcap" \
"${INSTALL_ROOT}/usr/lib/sysimage/rpm" "${INSTALL_ROOT}/usr/lib/sysimage/rpm"
HEREDOC
# Create a new image with the contents of ${INSTALL_ROOT} # Create a new image with the contents of ${INSTALL_ROOT}
FROM scratch AS base-leap FROM scratch AS base-leap
ARG INSTALL_ROOT ARG INSTALL_ROOT
COPY --link --from=builder ${INSTALL_ROOT} / COPY --link --from=builder ${INSTALL_ROOT} /
RUN \ RUN <<HEREDOC
# Creates symlinks for any other commands that busybox can provide that # Creates symlinks for any other commands that busybox can provide that
# aren't already provided by coreutils (notably hexdump + tar, see #2403): # aren't already provided by coreutils (notably hexdump + tar, see #2403):
# NOTE: `busybox --install -s` is not supported via the leap package, manually symlink commands. # NOTE: `busybox --install -s` is not supported via the leap package, manually symlink commands.
ln -s /usr/bin/busybox /usr/bin/tar \ ln -s /usr/bin/busybox /usr/bin/tar
&& ln -s /usr/bin/busybox /usr/bin/hexdump \ ln -s /usr/bin/busybox /usr/bin/hexdump
&& ln -s /usr/bin/busybox /usr/bin/xxd \ ln -s /usr/bin/busybox /usr/bin/xxd
# Add a non-root user `testssl`, this is roughly equivalent to the `useradd` command: # Add a non-root user `testssl`, this is roughly equivalent to the `useradd` command:
# useradd --uid 1000 --user-group --create-home --shell /bin/bash testssl # useradd --uid 1000 --user-group --create-home --shell /bin/bash testssl
&& echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd \ echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd
&& echo 'testssl:x:1000:' >> /etc/group \ echo 'testssl:x:1000:' >> /etc/group
&& echo 'testssl:!::0:::::' >> /etc/shadow \ echo 'testssl:!::0:::::' >> /etc/shadow
&& install --mode 2755 --owner testssl --group testssl --directory /home/testssl \ install --mode 2755 --owner testssl --group testssl --directory /home/testssl
# The home directory will install a copy of `testssl.sh`, symlink the script to be used as a command:
&& ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh # A copy of `testssl.sh` will be added to the home directory,
# symlink to that file so it can be treated as a command:
ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh
HEREDOC
# Runtime config: # Runtime config:
USER testssl USER testssl
@ -49,7 +60,7 @@ ENTRYPOINT ["testssl.sh"]
CMD ["--help"] CMD ["--help"]
# Final image stage (add `testssl.sh` project files) # Final image stage (add `testssl.sh` project files)
# Choose either one as the final stage (defaults to last stage, `dist-local`) # Choose either one as the final stage (defaults to the last stage, `dist-local`)
# 62MB Image (Remote repo clone, cannot filter content through `.dockerignore`): # 62MB Image (Remote repo clone, cannot filter content through `.dockerignore`):
FROM base-leap AS dist-git FROM base-leap AS dist-git

22
Dockerfile.alpine
View File

@ -1,8 +1,20 @@
# syntax=docker.io/docker/dockerfile:1
FROM alpine:3.21 AS base-alpine FROM alpine:3.21 AS base-alpine
RUN apk add --no-cache bash procps drill coreutils libidn curl socat openssl xxd \ RUN <<HEREDOC
&& addgroup testssl \ apk add --no-cache bash procps drill coreutils libidn curl socat openssl xxd
&& adduser -G testssl -g "testssl user" -s /bin/bash -D testssl \
&& ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh # Add a non-root user `testssl`, this is roughly equivalent to the `adduser` command:
# addgroup testssl && adduser -G testssl -g "testssl user" -s /bin/bash -D testssl
echo 'testssl:x:1000:1000::/home/testssl:/bin/bash' >> /etc/passwd
echo 'testssl:x:1000:' >> /etc/group
echo 'testssl:!::0:::::' >> /etc/shadow
install --mode 2755 --owner testssl --group testssl --directory /home/testssl
# A copy of `testssl.sh` will be added to the home directory,
# symlink to that file so it can be treated as a command:
ln -s /home/testssl/testssl.sh /usr/local/bin/testssl.sh
HEREDOC
# Runtime config: # Runtime config:
USER testssl USER testssl
@ -10,7 +22,7 @@ ENTRYPOINT ["testssl.sh"]
CMD ["--help"] CMD ["--help"]
# Final image stage (add `testssl.sh` project files) # Final image stage (add `testssl.sh` project files)
# Choose either one as the final stage (defaults to last stage, `dist-git`) # Choose either one as the final stage (defaults to the last stage, `dist-local`)
# 35MB Image (Remote repo clone, cannot filter content through `.dockerignore`): # 35MB Image (Remote repo clone, cannot filter content through `.dockerignore`):
FROM base-alpine AS dist-git FROM base-alpine AS dist-git