mirror of
https://github.com/mattermost/mattermost.git
synced 2026-05-28 04:35:04 -04:00
Move from ubuntu to distroless image (#31136)
* Move from ubuntu to distroless image * Update updated ubunty image for first stage * Update server/build/Dockerfile Co-authored-by: Daniel Schalla <daniel@mattermost.com> * Update server/build/Dockerfile Co-authored-by: Daniel Schalla <daniel@mattermost.com> * Add mising env var for health check * Add mattermost user in /etc/passwd * Fix e2e userId * use cypress in place of server. Wget and not curl * Simplify e2e changes --------- Co-authored-by: Daniel Schalla <daniel@mattermost.com>
This commit is contained in:
Eva Sarafianou
GitHub
parent
05585e5388
commit
0a7be9f034
3 changed files with 51 additions and 13 deletions
|
|
@ -23,11 +23,14 @@ fi
|
|||
|
||||
if [ "$TEST" = "cypress" ]; then
|
||||
mme2e_log "Prepare Cypress: install dependencies"
|
||||
${MME2E_DC_SERVER} exec -T -u 0 -- cypress bash -c "id $MME2E_UID || useradd -u $MME2E_UID -m nodeci" # Works around the node image's assumption that the app files are owned by user 1000
|
||||
# Create user in Cypress container and work around the node image's assumption that the app files are owned by user 1000
|
||||
mme2e_log "Creating user for Cypress container"
|
||||
${MME2E_DC_SERVER} exec -T -u 0 -- cypress bash -c "id $MME2E_UID || useradd -u $MME2E_UID -m nodeci"
|
||||
${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress npm i
|
||||
${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress cypress install
|
||||
mme2e_log "Prepare Cypress: populating fixtures"
|
||||
${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress tee tests/fixtures/keycloak.crt >/dev/null <../../server/build/docker/keycloak/keycloak.crt
|
||||
# Download plugins using wget in the Cypress container
|
||||
for PLUGIN_URL in \
|
||||
"https://github.com/mattermost/mattermost-plugin-gitlab/releases/download/v1.3.0/com.github.manland.mattermost-plugin-gitlab-1.3.0.tar.gz" \
|
||||
"https://github.com/mattermost/mattermost-plugin-demo/releases/download/v0.9.0/com.mattermost.demo-plugin-0.9.0.tar.gz" \
|
||||
|
|
@ -35,12 +38,16 @@ if [ "$TEST" = "cypress" ]; then
|
|||
do
|
||||
PLUGIN_NAME="${PLUGIN_URL##*/}"
|
||||
PLUGIN_PATH="tests/fixtures/$PLUGIN_NAME"
|
||||
|
||||
# Check if file exists
|
||||
if ${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress test -f "$PLUGIN_PATH"; then
|
||||
mme2e_log "Skipping installation of plugin $PLUGIN_NAME: file exists"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Use wget in the Cypress container instead of curl in server (for distroless compatibility)
|
||||
mme2e_log "Downloading $PLUGIN_NAME to fixtures directory"
|
||||
${MME2E_DC_SERVER} exec -T -- server curl -L --silent "${PLUGIN_URL}" | ${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress tee "$PLUGIN_PATH" >/dev/null
|
||||
${MME2E_DC_SERVER} exec -T -u "$MME2E_UID" -- cypress wget -q -O "/cypress/$PLUGIN_PATH" "$PLUGIN_URL"
|
||||
done
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -1,11 +1,8 @@
|
|||
FROM ubuntu:noble-20240605@sha256:2e863c44b718727c860746568e1d54afd13b2fa71b160f5cd9058fc436217b30
|
||||
|
||||
# First stage - Ubuntu with document processing dependencies and curl for downloading
|
||||
FROM ubuntu:noble-20250415.1@sha256:dc17125eaac86538c57da886e494a34489122fb6a3ebb6411153d742594c2ddc AS builder
|
||||
# Setting bash as our shell, and enabling pipefail option
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
|
||||
# Some ENV variables
|
||||
ENV PATH="/mattermost/bin:${PATH}"
|
||||
|
||||
# Build Arguments
|
||||
ARG PUID=2000
|
||||
ARG PGID=2000
|
||||
|
|
@ -13,7 +10,7 @@ ARG PGID=2000
|
|||
# i.e. https://releases.mattermost.com/9.7.1/mattermost-9.7.1-linux-amd64.tar.gz
|
||||
ARG MM_PACKAGE="https://latest.mattermost.com/mattermost-enterprise-linux"
|
||||
|
||||
# # Install needed packages and indirect dependencies
|
||||
# Install needed packages and indirect dependencies
|
||||
RUN apt-get update \
|
||||
&& DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
|
||||
ca-certificates \
|
||||
|
|
@ -34,18 +31,48 @@ RUN mkdir -p /mattermost/data /mattermost/plugins /mattermost/client/plugins \
|
|||
&& curl -L $MM_PACKAGE | tar -xvz \
|
||||
&& chown -R mattermost:mattermost /mattermost /mattermost/data /mattermost/plugins /mattermost/client/plugins
|
||||
|
||||
# Final stage using distroless for minimal attack surface
|
||||
FROM gcr.io/distroless/base-debian12
|
||||
|
||||
# Some ENV variables
|
||||
ENV PATH="/mattermost/bin:${PATH}"
|
||||
ENV MM_SERVICESETTINGS_ENABLELOCALMODE="true"
|
||||
|
||||
# Copy over metadata files needed by runtime
|
||||
COPY --from=builder /etc/mime.types /etc
|
||||
|
||||
# Copy document processing utilities and necessary support files
|
||||
COPY --from=builder /usr/bin/pdftotext /usr/bin/pdftotext
|
||||
COPY --from=builder /usr/bin/wvText /usr/bin/wvText
|
||||
COPY --from=builder /usr/bin/wvWare /usr/bin/wvWare
|
||||
COPY --from=builder /usr/bin/unrtf /usr/bin/unrtf
|
||||
COPY --from=builder /usr/bin/tidy /usr/bin/tidy
|
||||
COPY --from=builder /usr/share/wv /usr/share/wv
|
||||
|
||||
# Copy necessary libraries for document processing utilities
|
||||
COPY --from=builder /usr/lib/libpoppler.so* /usr/lib/
|
||||
COPY --from=builder /usr/lib/libfreetype.so* /usr/lib/
|
||||
COPY --from=builder /usr/lib/libpng.so* /usr/lib/
|
||||
COPY --from=builder /usr/lib/libwv.so* /usr/lib/
|
||||
COPY --from=builder /usr/lib/libtidy.so* /usr/lib/
|
||||
COPY --from=builder /usr/lib/libfontconfig.so* /usr/lib/
|
||||
|
||||
# Copy mattermost from builder stage
|
||||
COPY --from=builder --chown=2000:2000 /mattermost /mattermost
|
||||
|
||||
# Copy passwd including mattermost user
|
||||
COPY passwd /etc/passwd
|
||||
|
||||
# We should refrain from running as privileged user
|
||||
USER mattermost
|
||||
|
||||
# Healthcheck to make sure container is ready
|
||||
# Healthcheck to make sure container is ready - using mmctl instead of curl for distroless compatibility
|
||||
HEALTHCHECK --interval=30s --timeout=10s \
|
||||
CMD curl -f http://localhost:8065/api/v4/system/ping || exit 1
|
||||
CMD ["/mattermost/bin/mmctl", "system", "status", "--local"]
|
||||
|
||||
# Configure entrypoint and command with proper permissions
|
||||
COPY --chown=mattermost:mattermost --chmod=765 entrypoint.sh /
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
WORKDIR /mattermost
|
||||
CMD ["mattermost"]
|
||||
CMD ["/mattermost/bin/mattermost"]
|
||||
|
||||
EXPOSE 8065 8067 8074 8075
|
||||
|
||||
|
|
|
|||
4
server/build/passwd
Normal file
4
server/build/passwd
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
root:x:0:0:root:/root:/sbin/nologin
|
||||
nobody:x:65534:65534:nobody:/nonexistent:/sbin/nologin
|
||||
nonroot:x:65532:65532:nonroot:/home/nonroot:/sbin/nologin
|
||||
mattermost:x:2000:2000:nonroot:/home/nonroot:/sbin/nologin
|
||||
Loading…
Reference in a new issue