mirror of
https://github.com/vegardit/docker-openldap.git
synced 2026-05-21 12:14:16 +02:00
feat: multi-arch docker builds
This commit is contained in:
sebthom
parent
9cd4db6dbf
commit
deb35361a1
2
.github/workflows/build.yml
vendored
2
.github/workflows/build.yml
vendored
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
build:
|
||||
###########################################################
|
||||
runs-on: ubuntu-latest # https://github.com/actions/runner-images#available-images
|
||||
timeout-minutes: 10
|
||||
timeout-minutes: 30
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
|
|
|
|||
2
.github/workflows/stale.yml
vendored
2
.github/workflows/stale.yml
vendored
|
|
@ -1,4 +1,4 @@
|
|||
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
|
||||
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions
|
||||
name: Stale issues
|
||||
|
||||
on:
|
||||
|
|
|
|||
|
|
@ -23,10 +23,9 @@ # vegardit/openldap <a href="https://github.com/vegardit/docker-openldap/" title
|
|||
|
||||
## <a name="what-is-it"></a>What is it?
|
||||
|
||||
Opinionated docker image currently based on the [Debian](https://www.debian.org/) docker image [`debian:bookworm-slim`](https://hub.docker.com/_/debian?tab=tags&name=bookworm-slim) to run an [OpenLDAP 2.5](https://www.openldap.org/doc/admin25/) server.
|
||||
|
||||
It is automatically built **weekly** to include the latest OS security fixes.
|
||||
An opinionated, multi-architecture Docker image - currently based on [Debian](https://www.debian.org/)'s [`debian:bookworm-slim`](https://hub.docker.com/_/debian?tab=tags&name=bookworm-slim) - built for easy deployment of an [OpenLDAP 2.5](https://www.openldap.org/doc/admin25/) server.
|
||||
|
||||
Automatically rebuilt **weekly** to include the latest OS security fixes.
|
||||
|
||||
## <a name="config"></a>Configuration
|
||||
|
||||
|
|
|
|||
|
|
@ -27,21 +27,34 @@ image_name=$image_repo:latest
|
|||
# build the image
|
||||
#################################################
|
||||
log INFO "Building docker image [$image_name]..."
|
||||
if [[ $OSTYPE == cygwin || $OSTYPE == msys ]]; then
|
||||
if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
|
||||
project_root=$(cygpath -w "$project_root")
|
||||
fi
|
||||
|
||||
set -x
|
||||
|
||||
docker --version
|
||||
export DOCKER_BUILD_KIT=1
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=1 # prevents "docker: 'buildx' is not a docker command."
|
||||
|
||||
# shellcheck disable=SC2154 # base_layer_cache_key is referenced but not assigned.
|
||||
docker build "$project_root" \
|
||||
# Register QEMU emulators for all architectures so Docker can run and build multi-arch images
|
||||
docker run --privileged --rm ghcr.io/dockerhub-mirror/tonistiigi__binfmt --install all
|
||||
|
||||
# https://docs.docker.com/build/buildkit/configure/#resource-limiting
|
||||
echo "
|
||||
[worker.oci]
|
||||
max-parallelism = 3
|
||||
" | sudo tee /etc/buildkitd.toml
|
||||
|
||||
docker buildx version # ensures buildx is enabled
|
||||
docker buildx create --config /etc/buildkitd.toml --use # prevents: error: multiple platforms feature is currently not supported for docker driver. Please switch to a different driver (eg. "docker buildx create --use")
|
||||
trap 'docker buildx stop' EXIT
|
||||
# shellcheck disable=SC2154,SC2046 # base_layer_cache_key is referenced but not assigned / Quote this to prevent word splitting
|
||||
docker buildx build "$project_root" \
|
||||
--file "image/Dockerfile" \
|
||||
--progress=plain \
|
||||
--pull \
|
||||
--build-arg "INSTALL_SUPPORT_TOOLS=${INSTALL_SUPPORT_TOOLS:-0}" \
|
||||
--build-arg INSTALL_SUPPORT_TOOLS="${INSTALL_SUPPORT_TOOLS:-0}" \
|
||||
`# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
|
||||
--build-arg BASE_LAYER_CACHE_KEY="$base_layer_cache_key" \
|
||||
--build-arg BASE_IMAGE="$base_image_name" \
|
||||
|
|
@ -50,10 +63,19 @@ docker build "$project_root" \
|
|||
--build-arg GIT_COMMIT_DATE="$(date -d "@$(git log -1 --format='%at')" --utc +'%Y-%m-%d %H:%M:%S UTC')" \
|
||||
--build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
|
||||
--build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
|
||||
$(if [[ ${ACT:-} == "true" || ${DOCKER_PUSH:-} != "true" ]]; then \
|
||||
echo -n "--load --output type=docker"; \
|
||||
else \
|
||||
echo -n "--platform linux/amd64,linux/arm64,linux/arm/v7"; \
|
||||
fi) \
|
||||
--tag "$image_name" \
|
||||
$(if [[ ${DOCKER_PUSH:-} == "true" ]]; then echo -n "--push"; fi) \
|
||||
"$@"
|
||||
set +x
|
||||
|
||||
if [[ ${DOCKER_PUSH:-} == "true" ]]; then
|
||||
docker image pull "$image_name"
|
||||
fi
|
||||
|
||||
#################################################
|
||||
# determine effective OpenLDAP version
|
||||
|
|
@ -67,35 +89,38 @@ echo "ldap_version=$ldap_version"
|
|||
# apply tags
|
||||
#################################################
|
||||
declare -a tags=()
|
||||
tags+=("$image_name") # :latest
|
||||
tags+=("$image_repo:${ldap_version}") # :2.5.12
|
||||
tags+=("$image_repo:${ldap_version%.*}.x") # :2.5.x
|
||||
tags+=("$image_repo:${ldap_version%%.*}.x") # :2.x
|
||||
|
||||
for tag in "${tags[@]}"; do
|
||||
docker image tag "$image_name" "$tag"
|
||||
if [[ ${DOCKER_PUSH:-} == true ]]; then
|
||||
docker image tag "$image_name" "ghcr.io/$tag"
|
||||
(set -x; docker image tag "$image_name" "$tag")
|
||||
if [[ ${DOCKER_PUSH:-} == "true" ]]; then
|
||||
(set -x; docker push "$tag")
|
||||
fi
|
||||
done
|
||||
tags+=("$image_name") # :latest
|
||||
|
||||
|
||||
#################################################
|
||||
# perform security audit
|
||||
#################################################
|
||||
if [[ ${DOCKER_AUDIT_IMAGE:-1} == 1 ]]; then
|
||||
if [[ ${DOCKER_AUDIT_IMAGE:-1} == "1" ]]; then
|
||||
bash "$shared_lib/cmd/audit-image.sh" "$image_name"
|
||||
fi
|
||||
|
||||
|
||||
#################################################
|
||||
# push image with tags to remote docker image registry
|
||||
# push image to ghcr.io
|
||||
#################################################
|
||||
if [[ ${DOCKER_PUSH:-} == true ]]; then
|
||||
if [[ ${DOCKER_PUSH_GHCR:-} == "true" ]]; then
|
||||
for tag in "${tags[@]}"; do
|
||||
set -x
|
||||
docker push "$tag"
|
||||
docker push "ghcr.io/$tag"
|
||||
docker run --rm \
|
||||
-u "$(id -u):$(id -g)" -e HOME -v "$HOME:$HOME" \
|
||||
-v /etc/docker/certs.d:/etc/docker/certs.d:ro \
|
||||
ghcr.io/regclient/regctl:latest \
|
||||
image copy "$tag" "ghcr.io/$tag"
|
||||
set +x
|
||||
done
|
||||
fi
|
||||
|
|
|
|||
104
image/Dockerfile
104
image/Dockerfile
|
|
@ -10,9 +10,92 @@
|
|||
# https://hub.docker.com/_/debian/tags?name=bookworm-slim
|
||||
ARG BASE_IMAGE=debian:bookworm-slim
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG LC_ALL=C
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3006 Always tag the version of an image explicitly
|
||||
# hadolint ignore=DL3006
|
||||
FROM ${BASE_IMAGE}
|
||||
FROM ${BASE_IMAGE} AS pqchecker-build
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3008 Pin versions
|
||||
# hadolint ignore=DL3008
|
||||
RUN <<EOF
|
||||
set -eux
|
||||
apt-get update
|
||||
apt-get install --no-install-recommends -y \
|
||||
build-essential \
|
||||
ca-certificates \
|
||||
git
|
||||
|
||||
EOF
|
||||
|
||||
RUN <<EOF
|
||||
git config --global advice.detachedHead false
|
||||
git config --global core.sparseCheckout true
|
||||
git config --global init.defaultBranch main
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/openldap-src
|
||||
RUN <<EOF
|
||||
git clone --depth 1 --branch OPENLDAP_REL_ENG_2_5 https://github.com/openldap/openldap.git .
|
||||
./configure
|
||||
make depend
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/jni-headers
|
||||
|
||||
ENV JVM_DIR=/usr/lib/jvm/openjdk11
|
||||
|
||||
RUN <<EOF
|
||||
set -eux
|
||||
|
||||
git clone --depth 1 --filter=blob:none --no-checkout --branch jdk-11-ga https://github.com/openjdk/jdk.git .
|
||||
git sparse-checkout init --cone
|
||||
git sparse-checkout set \
|
||||
src/java.base/share/native/include/jni.h \
|
||||
src/java.base/unix/native/include/jni_md.h
|
||||
git checkout
|
||||
|
||||
mkdir -p "$JVM_DIR/include/linux"
|
||||
cp src/java.base/share/native/include/jni.h "$JVM_DIR/include/"
|
||||
cp src/java.base/unix/native/include/jni_md.h "$JVM_DIR/include/linux/"
|
||||
EOF
|
||||
|
||||
WORKDIR /opt/pqchecker
|
||||
|
||||
RUN <<EOF
|
||||
set -eu
|
||||
|
||||
# auto-detect JAVA_HOME from wherever jni.h landed
|
||||
JNI_HDR=$(find /usr/lib/jvm -path '*/include/jni.h' -print -quit)
|
||||
if [ -z "$JNI_HDR" ]; then
|
||||
echo "ERROR: jni.h not found under /usr/lib/jvm – cannot set JAVA_HOME" >&2
|
||||
exit 1
|
||||
fi
|
||||
JAVA_HOME=$(dirname "$(dirname "$JNI_HDR")")
|
||||
echo "Detected JAVA_HOME=$JAVA_HOME"
|
||||
export JAVA_HOME
|
||||
|
||||
set -x
|
||||
git init .
|
||||
# git remote add origin https://bitbucket.org/ameddeb/pqchecker.git
|
||||
git remote add origin https://github.com/pqchecker/pqchecker.git
|
||||
git fetch --depth 1 origin 2813c1922c4233d72066201d11b6b4ad4f61239d
|
||||
git checkout FETCH_HEAD
|
||||
|
||||
bash ./adjustdate.bash
|
||||
./configure \
|
||||
LDAPSRC=/opt/openldap-src \
|
||||
JAVAHOME="$JAVA_HOME" \
|
||||
libdir=/usr/lib/ldap \
|
||||
PARAMDIR=/etc/ldap/pqchecker
|
||||
make
|
||||
|
||||
EOF
|
||||
|
||||
# https://github.com/hadolint/hadolint/wiki/DL3006 Always tag the version of an image explicitly
|
||||
# hadolint ignore=DL3006
|
||||
FROM ${BASE_IMAGE} as final
|
||||
|
||||
LABEL maintainer="Vegard IT GmbH (vegardit.com)"
|
||||
|
||||
|
|
@ -22,16 +105,12 @@ USER root
|
|||
|
||||
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
|
||||
|
||||
ARG DEBIAN_FRONTEND=noninteractive
|
||||
ARG LC_ALL=C
|
||||
|
||||
ARG INSTALL_SUPPORT_TOOLS=0
|
||||
|
||||
ARG BASE_LAYER_CACHE_KEY
|
||||
|
||||
#ARG PQCHECKER_URL=https://meddeb.net/pub/pqchecker/deb/8/pqchecker_2.0.0_amd64.deb
|
||||
ARG PQCHECKER_URL=https://github.com/pqchecker/pqchecker-binaries/raw/main/deb/8/pqchecker_2.0.0_amd64.deb
|
||||
ARG PQCHECKER_MD5=c005ce596e97d13e39485e711dcbc7e1
|
||||
COPY --from=pqchecker-build /opt/pqchecker/src/.libs/pqchecker.so /usr/lib/ldap/pqchecker.so
|
||||
COPY --from=pqchecker-build /opt/pqchecker/pqparams.dat /etc/ldap/pqchecker/pqparams.dat
|
||||
|
||||
# see https://github.com/hadolint/hadolint/wiki/DL3008
|
||||
# hadolint ignore=DL3008,SC2016
|
||||
|
|
@ -59,17 +138,6 @@ RUN --mount=type=bind,source=.shared,target=/mnt/shared <<EOF
|
|||
# workaround for 'service slapd stop' not working, see https://stackoverflow.com/a/58792698/5116073
|
||||
sed -i 's/--exec $SLAPD 2/--name slapd 2/' /etc/init.d/slapd
|
||||
|
||||
echo "#################################################"
|
||||
echo "Installing pqChecker password quality checker module..."
|
||||
echo "#################################################"
|
||||
# https://www.meddeb.net/pqchecker/
|
||||
apt-get install --no-install-recommends -y curl
|
||||
curl -k -o /tmp/pqchecker.deb -SL "${PQCHECKER_URL}"
|
||||
echo "${PQCHECKER_MD5} /tmp/pqchecker.deb" | md5sum -c -
|
||||
dpkg -i /tmp/pqchecker.deb
|
||||
rm /tmp/pqchecker.deb
|
||||
apt-get remove --auto-remove -y curl
|
||||
|
||||
echo "#################################################"
|
||||
echo "Moving config and data directories..."
|
||||
echo "#################################################"
|
||||
|
|
|
|||
Loading…
Reference in a new issue