Skip to content

Commit 1f84071

Browse files
holyspectralholyspectral
committed
feat: NVSHAS-9501 standalone Dockerfile
1. Provide cross-platform/standalone Dockerfile 2. Release.yml to publish SLSA-capable artifacts 3. Provide build target, test-image, build-image and push-image to sync with rancher. 4. Switch to golang:1.22 as its base image
1 parent 1fedaec commit 1f84071

File tree

8 files changed

+224
-41
lines changed

8 files changed

+224
-41
lines changed

‎build/dockerignore renamed to ‎.dockerignore

File renamed without changes.

‎.github/workflows/dev.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: dev build
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- master
8+
9+
jobs:
10+
build-push:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Set up QEMU
14+
uses: docker/setup-qemu-action@v3
15+
- name: Set up Docker Buildx
16+
uses: docker/setup-buildx-action@v3
17+
- name: Login to Docker Hub
18+
uses: docker/login-action@v3
19+
with:
20+
username: ${{ secrets.DEV_DOCKER_USERNAME }}
21+
password: ${{ secrets.DEV_DOCKER_PASSWORD }}
22+
- name: Checkout code
23+
uses: actions/checkout@v4
24+
- name: Create builder
25+
run: make buildx-machine
26+
- name: Build and push
27+
uses: docker/build-push-action@v6
28+
with:
29+
push: true
30+
file: package/Dockerfile
31+
tags: ${{ secrets.DEV_BUILD_REPOSITORY }}/registry-adapter:latest
32+
build-args: |
33+
COMMIT=${{ github.sha }}
34+
VERSION=${{ github.ref_name }}
35+
platforms: linux/arm64,linux/amd64
36+
- name: Retag
37+
run: |
38+
docker buildx imagetools create -t ${{ secrets.DEV_BUILD_REPOSITORY }}/registry-adapter:latest ${{ secrets.DEV_BUILD_REPOSITORY }}/registry-adapter:${{github.run_number}}

‎.github/workflows/release.yml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
jobs:
9+
10+
publish:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
# write is needed for:
15+
# - OIDC for cosign's use in ecm-distro-tools/publish-image.
16+
# - Read vault secrets in rancher-eio/read-vault-secrets.
17+
id-token: write
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Load Secrets from Vault
24+
uses: rancher-eio/read-vault-secrets@main
25+
with:
26+
secrets: |
27+
secret/data/github/repo/${{ github.repository }}/dockerhub/neuvector/credentials username | DOCKER_USERNAME ;
28+
secret/data/github/repo/${{ github.repository }}/dockerhub/neuvector/credentials password | DOCKER_PASSWORD ;
29+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
30+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
31+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD
32+
33+
- name: Publish manifest
34+
uses: rancher/ecm-distro-tools/actions/publish-image@master
35+
with:
36+
image: registry-adapter
37+
tag: ${{ github.ref_name }}
38+
platforms: linux/amd64,linux/arm64
39+
40+
public-registry: docker.io
41+
public-repo: neuvector
42+
public-username: ${{ env.DOCKER_USERNAME }}
43+
public-password: ${{ env.DOCKER_PASSWORD }}
44+
45+
prime-registry: ${{ env.PRIME_REGISTRY }}
46+
prime-repo: rancher
47+
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
48+
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}

‎Makefile

Lines changed: 71 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,79 @@
1-
BASE_IMAGE_TAG = latest
2-
BUILD_IMAGE_TAG = v2
1+
RUNNER := docker
2+
IMAGE_BUILDER := $(RUNNER) buildx
3+
MACHINE := neuvector
4+
BUILDX_ARGS ?= --sbom=true --attest type=provenance,mode=max
5+
DEFAULT_PLATFORMS := linux/amd64,linux/arm64,linux/x390s,linux/riscv64
36

4-
all:
5-
go build -ldflags='-s -w' -buildvcs=false -o adapter
7+
COMMIT = $(shell git rev-parse --short HEAD)
8+
ifeq ($(VERSION),)
9+
# Define VERSION, which is used for image tags or to bake it into the
10+
# compiled binary to enable the printing of the application version,
11+
# via the --version flag.
12+
CHANGES = $(shell git status --porcelain --untracked-files=no)
13+
ifneq ($(CHANGES),)
14+
DIRTY = -dirty
15+
endif
16+
17+
18+
COMMIT = $(shell git rev-parse --short HEAD)
19+
VERSION = $(COMMIT)$(DIRTY)
20+
21+
# Override VERSION with the Git tag if the current HEAD has a tag pointing to
22+
# it AND the worktree isn't dirty.
23+
GIT_TAG = $(shell git tag -l --contains HEAD | head -n 1)
24+
ifneq ($(GIT_TAG),)
25+
ifeq ($(DIRTY),)
26+
VERSION = $(GIT_TAG)
27+
endif
28+
endif
29+
endif
30+
31+
ifeq ($(TAG),)
32+
TAG = $(VERSION)
33+
ifneq ($(DIRTY),)
34+
TAG = dev
35+
endif
36+
endif
37+
38+
TARGET_PLATFORMS ?= linux/amd64,linux/arm64
39+
STAGE_DIR=stage
40+
REPO ?= neuvector
41+
IMAGE = $(REPO)/registry-adapter:$(TAG)
42+
BUILD_ACTION = --load
643

7-
STAGE_DIR = stage
44+
.PHONY: all build test copy_adpt
845

9-
copy_adpt:
46+
all: test build copy_adpt
47+
48+
test:
49+
go test ./...
50+
51+
copy_adpt: build
1052
mkdir -p ${STAGE_DIR}/usr/local/bin/
11-
#
12-
cp registry-adapter/adapter ${STAGE_DIR}/usr/local/bin/
53+
cp adapter ${STAGE_DIR}/usr/local/bin/
54+
55+
build:
56+
go build -ldflags='-s -w' -buildvcs=false -o adapter
57+
58+
buildx-machine:
59+
docker buildx ls
60+
@docker buildx ls | grep $(MACHINE) || \
61+
docker buildx create --name=$(MACHINE) --platform=$(DEFAULT_PLATFORMS)
1362

14-
stage_init:
15-
rm -rf ${STAGE_DIR}; mkdir -p ${STAGE_DIR}
63+
test-image:
64+
# Instead of loading image, target all platforms, effectivelly testing
65+
# the build for the target architectures.
66+
$(MAKE) build-image BUILD_ACTION="--platform=$(TARGET_PLATFORMS)"
1667

17-
stage_adpt: stage_init copy_adpt
68+
build-image: buildx-machine ## build (and load) the container image targeting the current platform.
69+
$(IMAGE_BUILDER) build -f package/Dockerfile \
70+
--builder $(MACHINE) $(IMAGE_ARGS) \
71+
--build-arg VERSION=$(VERSION) --build-arg COMMIT=$(COMMIT) -t "$(IMAGE)" $(BUILD_ACTION) .
72+
@echo "Built $(IMAGE)"
1873

19-
adapter_image: stage_adpt
20-
docker pull neuvector/adapter_base:${BASE_IMAGE_TAG}
21-
docker build --build-arg NV_TAG=$(NV_TAG) --build-arg BASE_IMAGE_TAG=${BASE_IMAGE_TAG} -t neuvector/registry-adapter -f registry-adapter/build/Dockerfile .
2274

23-
binary:
24-
@echo "Making $@ ..."
25-
@docker pull neuvector/build_fleet:${BUILD_IMAGE_TAG}
26-
@docker run --rm -ia STDOUT --name build --net=none -v $(CURDIR):/go/src/github.com/neuvector/registry-adapter -w /go/src/github.com/neuvector/registry-adapter --entrypoint ./make_bin.sh neuvector/build_fleet:${BUILD_IMAGE_TAG}
75+
push-image: buildx-machine
76+
$(IMAGE_BUILDER) build -f package/Dockerfile \
77+
--builder $(MACHINE) $(IMAGE_ARGS) $(IID_FILE_FLAG) $(BUILDX_ARGS) \
78+
--build-arg VERSION=$(VERSION) --build-arg COMMIT=$(COMMIT) --platform=$(TARGET_PLATFORMS) -t "$(REPO)/registry-adapter:$(TAG)" --push .
79+
@echo "Pushed $(IMAGE)"

‎build/Dockerfile

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎make_bin.sh

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎package/Dockerfile

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#
2+
# Builder image
3+
FROM registry.suse.com/bci/golang:1.22 AS builder
4+
5+
ENV GOPATH=/go
6+
ENV PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
7+
8+
COPY config/ /src/config
9+
COPY server/ /src/server
10+
COPY vendor/ /src/vendor
11+
COPY go.mod go.sum adapter.go version.go Makefile /src
12+
WORKDIR /src
13+
RUN make
14+
15+
#
16+
# base image
17+
FROM registry.suse.com/bci/bci-micro:15.6 AS micro
18+
FROM registry.suse.com/bci/bci-base:15.6 AS base
19+
FROM --platform=$BUILDPLATFORM rancher/mirrored-tonistiigi-xx:1.3.0 AS xx
20+
FROM --platform=$BUILDPLATFORM registry.suse.com/bci/bci-base:15.6 AS basebuilder
21+
22+
ARG TARGETPLATFORM
23+
ARG TARGETOS
24+
ARG TARGETARCH
25+
26+
COPY --from=xx / /
27+
COPY --from=micro / /chroot/
28+
29+
RUN echo "[main]" > /etc/zypp/zypp.conf && \
30+
echo -n "arch = " >> /etc/zypp/zypp.conf && \
31+
xx-info march >> /etc/zypp/zypp.conf
32+
33+
COPY --from=base /etc/products.d/ /etc/products.d/
34+
COPY --from=base /etc/zypp/ /chroot/etc/zypp/
35+
36+
# Runtime dependencies
37+
RUN zypper refresh && zypper --non-interactive --installroot /chroot install --no-recommends \
38+
ca-certificates && \
39+
zypper --non-interactive --installroot /chroot clean -a && \
40+
rm -rf /chroot/var/log/ /chroot/var/cache/zypp/* /chroot/etc/zypp/
41+
42+
RUN cd /chroot/usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch
43+
44+
RUN mkdir -p /chroot/etc/neuvector/certs/internal/
45+
46+
FROM micro
47+
ARG VERSION
48+
ARG COMMIT
49+
WORKDIR /
50+
COPY --from=basebuilder /chroot/ /
51+
COPY --from=builder /src/stage /
52+
53+
LABEL "name"="registry-adapter" \
54+
"vendor"="SUSE Security" \
55+
"neuvector.image"="neuvector/registry-adapter" \
56+
"neuvector.role"="registry-adapater" \
57+
"neuvector.rev"="${COMMIT}" \
58+
"io.artifacthub.package.logo-url"=https://avatars2.githubusercontent.com/u/19367275 \
59+
"io.artifacthub.package.readme-url"="https://raw.githubusercontent.com/neuvector/registry-adapter/${VERSION}/README.md" \
60+
"org.opencontainers.image.description"="SUSE Security Registry Adapter" \
61+
"org.opencontainers.image.title"="SUSE Security Registry Adapter" \
62+
"org.opencontainers.image.source"="https://github.com/neuvector/registry-adapter/" \
63+
"org.opencontainers.image.version"="${VERSION}" \
64+
"org.opensuse.reference"="neuvector/registry-adapter:${VERSION}"
65+
66+
67+
ENTRYPOINT ["/usr/local/bin/adapter"]

‎unitest.sh

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)