mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-27 16:06:48 +09:00
Jeremy Daer
2e83b56860
Name ca-certificates in the base stage's apt install so the image takes the distribution's current package rather than the one in the base image, and fail the build if either withdrawn root (emSign ECC Root CA - G3, AAA Certificate Services) is still in the store Ruby's OpenSSL loads.
96 lines
3.4 KiB
Docker
96 lines
3.4 KiB
Docker
# syntax = docker/dockerfile:1
|
|
|
|
# Make sure it matches the Ruby version in .ruby-version and Gemfile
|
|
ARG RUBY_VERSION=3.4.10
|
|
FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
|
|
|
|
# Rails app lives here
|
|
WORKDIR /rails
|
|
|
|
# Install base packages
|
|
RUN apt-get update -qq && \
|
|
apt-get install --no-install-recommends -y ca-certificates curl libsqlite3-0 libvips libjemalloc2 ffmpeg redis && \
|
|
ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \
|
|
rm -rf /var/lib/apt/lists /var/cache/apt/archive
|
|
|
|
# Naming ca-certificates above takes the distribution's current trusted roots rather than the
|
|
# ones frozen into the base image. Fail the build if either of these withdrawn roots is still
|
|
# where Ruby's OpenSSL looks for trusted certificates.
|
|
RUN ruby -ropenssl -e ' \
|
|
file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE; \
|
|
dir = ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR; \
|
|
pems = [file, *Dir.glob(File.join(dir, "*"))].select { |path| File.file?(path) } \
|
|
.flat_map { |path| File.read(path).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m) }; \
|
|
subjects = pems.map { |pem| OpenSSL::X509::Certificate.new(pem).subject.to_s }.uniq; \
|
|
abort "Only #{subjects.size} roots in #{file} and #{dir}" if subjects.size < 100; \
|
|
withdrawn = subjects.grep(%r{/CN=(emSign ECC Root CA - G3|AAA Certificate Services)\z}); \
|
|
abort "Withdrawn roots still trusted: #{withdrawn}" if withdrawn.any?'
|
|
|
|
# Set production environment
|
|
ENV RAILS_ENV="production" \
|
|
BUNDLE_DEPLOYMENT="1" \
|
|
BUNDLE_PATH="/usr/local/bundle" \
|
|
BUNDLE_WITHOUT="development" \
|
|
LD_PRELOAD="/usr/local/lib/libjemalloc.so"
|
|
|
|
|
|
# Throw-away build stage to reduce size of final image
|
|
FROM base AS build
|
|
|
|
# Install packages need to build gems
|
|
RUN apt-get update -qq && \
|
|
apt-get install -y build-essential git pkg-config libyaml-dev libssl-dev && \
|
|
rm -rf /var/lib/apt/lists /var/cache/apt/archives
|
|
|
|
# Install application gems
|
|
COPY Gemfile Gemfile.lock vendor ./
|
|
|
|
RUN bundle install && \
|
|
rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
|
|
|
|
# Copy application code
|
|
COPY . .
|
|
|
|
# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
|
|
RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
|
|
|
|
|
|
# Final stage for app image
|
|
FROM base
|
|
|
|
# Image metadata
|
|
ARG OCI_DESCRIPTION
|
|
LABEL org.opencontainers.image.description="${OCI_DESCRIPTION}"
|
|
ARG OCI_SOURCE
|
|
LABEL org.opencontainers.image.source="${OCI_SOURCE}"
|
|
LABEL org.opencontainers.image.licenses="MIT"
|
|
|
|
# Run and own only the runtime files as a non-root user for security
|
|
RUN groupadd --system --gid 1000 rails && \
|
|
useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash
|
|
USER 1000:1000
|
|
|
|
# Configure environment defaults
|
|
ENV HTTP_IDLE_TIMEOUT=60
|
|
ENV HTTP_READ_TIMEOUT=300
|
|
ENV HTTP_WRITE_TIMEOUT=300
|
|
|
|
# Copy built artifacts: gems, application
|
|
COPY --from=build --chown=rails:rails /usr/local/bundle /usr/local/bundle
|
|
COPY --from=build --chown=rails:rails /rails /rails
|
|
|
|
# Install ONCE backup/restore hooks
|
|
COPY --chmod=755 hooks /hooks
|
|
|
|
# Set version and revision
|
|
ARG APP_VERSION
|
|
ENV APP_VERSION=$APP_VERSION
|
|
ARG GIT_REVISION
|
|
ENV GIT_REVISION=$GIT_REVISION
|
|
|
|
# Expose ports for HTTP and HTTPS
|
|
EXPOSE 80 443
|
|
|
|
# Start the server by default, this can be overwritten at runtime
|
|
CMD ["bin/boot"]
|