-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #581 from openziti/container-switch-to-redhat-ubi
use Red Hat base image for run container
- Loading branch information
Showing
5 changed files
with
69 additions
and
133 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,5 @@ | ||
FROM debian:buster-slim as fetch-ziti-artifacts | ||
# this builds docker.io/openziti/ziti-edge-tunnel | ||
FROM registry.access.redhat.com/ubi8/ubi-minimal as fetch-ziti-artifacts | ||
# This build stage grabs artifacts that are copied into the final image. | ||
# It uses the same base as the final image to maximize docker cache hits. | ||
|
||
|
@@ -9,32 +10,44 @@ ARG GITHUB_REPO | |
|
||
WORKDIR /tmp | ||
|
||
RUN apt-get -q update && apt-get -q install -y --no-install-recommends curl ca-certificates unzip | ||
# workaround for `openssl rehash` not working on arm. | ||
RUN /bin/bash -c "if ! compgen -G '/etc/ssl/certs/*.[0-9]' > /dev/null; then c_rehash /etc/ssl/certs; fi" | ||
### Add necessary Red Hat repos and packages | ||
RUN INSTALL_PKGS="curl unzip" && \ | ||
microdnf -y update --setopt=install_weak_deps=0 --setopt=tsflags=nodocs && \ | ||
microdnf -y install --setopt=install_weak_deps=0 --setopt=tsflags=nodocs ${INSTALL_PKGS} | ||
|
||
COPY fetch-github-releases.sh . | ||
RUN bash -x ./fetch-github-releases.sh ziti-edge-tunnel | ||
RUN bash ./fetch-github-releases.sh ziti-edge-tunnel | ||
|
||
################ | ||
# | ||
# Main Image | ||
# | ||
################ | ||
|
||
FROM debian:buster-slim | ||
FROM registry.access.redhat.com/ubi8/ubi-minimal | ||
|
||
RUN mkdir -p /usr/local/bin /etc/ssl/certs | ||
# libsystemd: install the shared object, necessary in conjunction with --volume "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket" to communicate with the host's dbus socket to configure systemd-resolved | ||
# iproute2: install /sbin/ip, necessary in conjunction with --device="/dev/net/tun:/dev/net/tun" to up the tun device, assign routes, and assign source IP | ||
RUN apt-get -q update && apt-get -q install -y --no-install-recommends iproute2 libsystemd0 | ||
# Use 32-bit arm binaries on arm64 until we have 64-bit arm builds. This also affects fetch-github-releases.sh. | ||
RUN /bin/bash -c 'if [[ "$(uname -m)" == "aarch64" ]]; then dpkg --add-architecture armhf; apt update; apt install -y libc6:armhf; fi' | ||
COPY --from=fetch-ziti-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs | ||
### Required OpenShift Labels | ||
LABEL name="openziti/ziti-edge-tunnel" \ | ||
maintainer="[email protected]" \ | ||
vendor="NetFoundry" \ | ||
summary="OpenZiti Tunneler" \ | ||
description="Configure a proxy and nameserver for OpenZiti Services" | ||
|
||
### add licenses to this directory | ||
RUN mkdir -m0755 /licenses | ||
COPY ./LICENSE-Apache /licenses/apache.txt | ||
|
||
### Add necessary Red Hat repos and packages | ||
RUN INSTALL_PKGS="iproute procps" && \ | ||
microdnf -y update --setopt=install_weak_deps=0 --setopt=tsflags=nodocs && \ | ||
microdnf -y install --setopt=install_weak_deps=0 --setopt=tsflags=nodocs ${INSTALL_PKGS} | ||
|
||
RUN mkdir -p /usr/local/bin | ||
COPY --from=fetch-ziti-artifacts /tmp/ziti-edge-tunnel /usr/local/bin | ||
COPY ./docker-entrypoint.sh / | ||
RUN chmod +x /docker-entrypoint.sh | ||
RUN mkdir -p /ziti-edge-tunnel | ||
RUN mkdir -m0777 /ziti-edge-tunnel | ||
USER root | ||
|
||
ENTRYPOINT [ "/docker-entrypoint.sh" ] | ||
CMD [ "run" ] |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,51 +1,14 @@ | ||
# this builds docker.io/openziti/ziti-host | ||
FROM registry.access.redhat.com/ubi8/ubi as fetch-ziti-artifacts | ||
# This build stage grabs artifacts that are copied into the final image. | ||
# It uses the same base as the final image to maximize docker cache hits. | ||
FROM docker.io/openziti/ziti-edge-tunnel | ||
|
||
ARG ZITI_VERSION | ||
|
||
ARG GITHUB_BASE_URL | ||
ARG GITHUB_REPO | ||
|
||
WORKDIR /tmp | ||
|
||
### Add necessary Red Hat repos and packages | ||
RUN REPOLIST=ubi-8-baseos-rpms \ | ||
INSTALL_PKGS="curl unzip" && \ | ||
yum -y update-minimal --disablerepo "*" --enablerepo ${REPOLIST} --setopt=tsflags=nodocs \ | ||
--security --sec-severity=Important --sec-severity=Critical && \ | ||
yum -y install --disablerepo "*" --enablerepo ${REPOLIST} --setopt=tsflags=nodocs ${INSTALL_PKGS} | ||
|
||
COPY fetch-github-releases.sh . | ||
RUN bash ./fetch-github-releases.sh ziti-edge-tunnel | ||
|
||
################ | ||
# | ||
# Main Image | ||
# | ||
################ | ||
|
||
FROM registry.access.redhat.com/ubi8/ubi | ||
|
||
### Required OpenShift Labels | ||
LABEL name="openziti/ziti-host" \ | ||
maintainer="[email protected]" \ | ||
vendor="NetFoundry" \ | ||
summary="OpenZiti hosting tunneler" \ | ||
description="Publish any server that is reachable by this container as an OpenZiti service" | ||
# version="0.2.2" \ | ||
# release="0.19.11" \ | ||
|
||
### add licenses to this directory | ||
RUN mkdir -m0755 /licenses | ||
COPY ./LICENSE-Apache /licenses/apache.txt | ||
summary="OpenZiti Hosting Tunneler" \ | ||
description="Configure a reverse proxy for OpenZiti Services" | ||
|
||
RUN mkdir -p /usr/local/bin | ||
COPY --from=fetch-ziti-artifacts /tmp/ziti-edge-tunnel /usr/local/bin | ||
COPY ./docker-entrypoint.sh / | ||
RUN chmod +x /docker-entrypoint.sh | ||
RUN mkdir -m0777 /ziti-edge-tunnel | ||
USER nobody | ||
|
||
ENTRYPOINT [ "/docker-entrypoint.sh" ] | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters