Skip to content

Commit 6c39ced

Browse files
holyspectralholyspectral
committed
feat: NVSHAS-9501 standalone Dockerfile
1. Provide cross-platform/standalone Dockerfile 2. Release.yml to publish SLSA-capable artifacts 3. Provide build target, test-image, build-image and push-image to sync with rancher. 4. Switch to golang:1.22 as its base image
1 parent 1fedaec commit 6c39ced

File tree

7 files changed

+207
-41
lines changed

7 files changed

+207
-41
lines changed

‎build/dockerignore‎ renamed to ‎.dockerignore‎

File renamed without changes.

‎.github/workflows/release.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
jobs:
9+
10+
publish:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
# write is needed for:
15+
# - OIDC for cosign's use in ecm-distro-tools/publish-image.
16+
# - Read vault secrets in rancher-eio/read-vault-secrets.
17+
id-token: write
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Load Secrets from Vault
24+
uses: rancher-eio/read-vault-secrets@main
25+
with:
26+
secrets: |
27+
secret/data/github/repo/${{ github.repository }}/dockerhub/neuvector/credentials username | DOCKER_USERNAME ;
28+
secret/data/github/repo/${{ github.repository }}/dockerhub/neuvector/credentials password | DOCKER_PASSWORD ;
29+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
30+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
31+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD
32+
- name: Parse target tag
33+
run: |
34+
TARGET=${{ github.ref_name }}
35+
echo "TAG=${TARGET#v}" >> $GITHUB_ENV
36+
- name: Publish public manifest
37+
uses: rancher/ecm-distro-tools/actions/publish-image@master
38+
with:
39+
push-to-public: true
40+
push-to-prime: false
41+
make-target: push-image
42+
image: registry-adapter
43+
tag: ${{ env.TAG }}
44+
platforms: linux/amd64,linux/arm64
45+
46+
public-registry: docker.io
47+
public-repo: neuvector
48+
public-username: ${{ env.DOCKER_USERNAME }}
49+
public-password: ${{ env.DOCKER_PASSWORD }}
50+
- name: Publish prime manifest
51+
uses: rancher/ecm-distro-tools/actions/publish-image@master
52+
with:
53+
push-to-public: false
54+
push-to-prime: true
55+
make-target: push-rancher-image
56+
image: neuvector-registry-adapter
57+
tag: ${{ env.TAG }}
58+
platforms: linux/amd64,linux/arm64
59+
60+
prime-registry: ${{ env.PRIME_REGISTRY }}
61+
prime-repo: rancher
62+
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
63+
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}

‎Makefile‎

Lines changed: 77 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,85 @@
1-
BASE_IMAGE_TAG = latest
2-
BUILD_IMAGE_TAG = v2
1+
RUNNER := docker
2+
IMAGE_BUILDER := $(RUNNER) buildx
3+
MACHINE := neuvector
4+
BUILDX_ARGS ?= --sbom=true --attest type=provenance,mode=max
5+
DEFAULT_PLATFORMS := linux/amd64,linux/arm64,linux/x390s,linux/riscv64
36

4-
all:
5-
go build -ldflags='-s -w' -buildvcs=false -o adapter
7+
COMMIT = $(shell git rev-parse --short HEAD)
8+
ifeq ($(VERSION),)
9+
# Define VERSION, which is used for image tags or to bake it into the
10+
# compiled binary to enable the printing of the application version,
11+
# via the --version flag.
12+
CHANGES = $(shell git status --porcelain --untracked-files=no)
13+
ifneq ($(CHANGES),)
14+
DIRTY = -dirty
15+
endif
16+
17+
18+
COMMIT = $(shell git rev-parse --short HEAD)
19+
VERSION = $(COMMIT)$(DIRTY)
20+
21+
# Override VERSION with the Git tag if the current HEAD has a tag pointing to
22+
# it AND the worktree isn't dirty.
23+
GIT_TAG = $(shell git tag -l --contains HEAD | head -n 1)
24+
ifneq ($(GIT_TAG),)
25+
ifeq ($(DIRTY),)
26+
VERSION = $(GIT_TAG)
27+
endif
28+
endif
29+
endif
30+
31+
ifeq ($(TAG),)
32+
TAG = $(VERSION)
33+
ifneq ($(DIRTY),)
34+
TAG = dev
35+
endif
36+
endif
37+
38+
TARGET_PLATFORMS ?= linux/amd64,linux/arm64
39+
STAGE_DIR=stage
40+
REPO ?= neuvector
41+
IMAGE = $(REPO)/registry-adapter:$(TAG)
42+
BUILD_ACTION = --load
643

7-
STAGE_DIR = stage
44+
.PHONY: all build test copy_adpt
845

9-
copy_adpt:
46+
all: test build copy_adpt
47+
48+
test:
49+
go test ./...
50+
51+
copy_adpt: build
1052
mkdir -p ${STAGE_DIR}/usr/local/bin/
11-
#
12-
cp registry-adapter/adapter ${STAGE_DIR}/usr/local/bin/
53+
cp adapter ${STAGE_DIR}/usr/local/bin/
54+
55+
build:
56+
go build -ldflags='-s -w' -buildvcs=false -o adapter
57+
58+
buildx-machine:
59+
docker buildx ls
60+
@docker buildx ls | grep $(MACHINE) || \
61+
docker buildx create --name=$(MACHINE) --platform=$(DEFAULT_PLATFORMS)
62+
63+
test-image:
64+
# Instead of loading image, target all platforms, effectivelly testing
65+
# the build for the target architectures.
66+
$(MAKE) build-image BUILD_ACTION="--platform=$(TARGET_PLATFORMS)"
1367

14-
stage_init:
15-
rm -rf ${STAGE_DIR}; mkdir -p ${STAGE_DIR}
68+
build-image: buildx-machine ## build (and load) the container image targeting the current platform.
69+
$(IMAGE_BUILDER) build -f package/Dockerfile \
70+
--builder $(MACHINE) $(IMAGE_ARGS) \
71+
--build-arg VERSION=$(VERSION) --build-arg COMMIT=$(COMMIT) -t "$(IMAGE)" $(BUILD_ACTION) .
72+
@echo "Built $(IMAGE)"
1673

17-
stage_adpt: stage_init copy_adpt
1874

19-
adapter_image: stage_adpt
20-
docker pull neuvector/adapter_base:${BASE_IMAGE_TAG}
21-
docker build --build-arg NV_TAG=$(NV_TAG) --build-arg BASE_IMAGE_TAG=${BASE_IMAGE_TAG} -t neuvector/registry-adapter -f registry-adapter/build/Dockerfile .
75+
push-image: buildx-machine
76+
$(IMAGE_BUILDER) build -f package/Dockerfile \
77+
--builder $(MACHINE) $(IMAGE_ARGS) $(IID_FILE_FLAG) $(BUILDX_ARGS) \
78+
--build-arg VERSION=$(VERSION) --build-arg COMMIT=$(COMMIT) --platform=$(TARGET_PLATFORMS) -t "$(REPO)/registry-adapter:$(TAG)" --push .
79+
@echo "Pushed $(IMAGE)"
2280

23-
binary:
24-
@echo "Making $@ ..."
25-
@docker pull neuvector/build_fleet:${BUILD_IMAGE_TAG}
26-
@docker run --rm -ia STDOUT --name build --net=none -v $(CURDIR):/go/src/github.com/neuvector/registry-adapter -w /go/src/github.com/neuvector/registry-adapter --entrypoint ./make_bin.sh neuvector/build_fleet:${BUILD_IMAGE_TAG}
81+
push-rancher-image: buildx-machine
82+
$(IMAGE_BUILDER) build -f package/Dockerfile \
83+
--builder $(MACHINE) $(IMAGE_ARGS) $(IID_FILE_FLAG) $(BUILDX_ARGS) \
84+
--build-arg VERSION=$(VERSION) --build-arg COMMIT=$(COMMIT) --platform=$(TARGET_PLATFORMS) -t "$(REPO)/neuvector-registry-adapter:$(TAG)" --push .
85+
@echo "Pushed $(IMAGE)"

‎build/Dockerfile‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎make_bin.sh‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎package/Dockerfile‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#
2+
# Builder image
3+
FROM registry.suse.com/bci/golang:1.22 AS builder
4+
5+
ENV GOPATH=/go
6+
ENV PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
7+
8+
COPY config/ /src/config
9+
COPY server/ /src/server
10+
COPY vendor/ /src/vendor
11+
COPY go.mod go.sum adapter.go version.go Makefile /src
12+
WORKDIR /src
13+
RUN make
14+
15+
#
16+
# base image
17+
FROM registry.suse.com/bci/bci-micro:15.6 AS micro
18+
FROM registry.suse.com/bci/bci-base:15.6 AS base
19+
FROM --platform=$BUILDPLATFORM rancher/mirrored-tonistiigi-xx:1.3.0 AS xx
20+
FROM --platform=$BUILDPLATFORM registry.suse.com/bci/bci-base:15.6 AS basebuilder
21+
22+
ARG TARGETPLATFORM
23+
ARG TARGETOS
24+
ARG TARGETARCH
25+
26+
COPY --from=xx / /
27+
COPY --from=micro / /chroot/
28+
29+
RUN echo "[main]" > /etc/zypp/zypp.conf && \
30+
echo -n "arch = " >> /etc/zypp/zypp.conf && \
31+
xx-info march >> /etc/zypp/zypp.conf
32+
33+
COPY --from=base /etc/products.d/ /etc/products.d/
34+
COPY --from=base /etc/zypp/ /chroot/etc/zypp/
35+
36+
# Runtime dependencies
37+
RUN zypper refresh && zypper --non-interactive --installroot /chroot install --no-recommends \
38+
ca-certificates && \
39+
zypper --non-interactive --installroot /chroot clean -a && \
40+
rm -rf /chroot/var/log/ /chroot/var/cache/zypp/* /chroot/etc/zypp/
41+
42+
RUN cd /chroot/usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch
43+
44+
RUN mkdir -p /chroot/etc/neuvector/certs/internal/
45+
46+
FROM micro
47+
ARG VERSION
48+
ARG COMMIT
49+
WORKDIR /
50+
COPY --from=basebuilder /chroot/ /
51+
COPY --from=builder /src/stage /
52+
53+
LABEL "name"="registry-adapter" \
54+
"vendor"="SUSE Security" \
55+
"neuvector.image"="neuvector/registry-adapter" \
56+
"neuvector.role"="registry-adapater" \
57+
"neuvector.rev"="${COMMIT}" \
58+
"io.artifacthub.package.logo-url"=https://avatars2.githubusercontent.com/u/19367275 \
59+
"io.artifacthub.package.readme-url"="https://raw.githubusercontent.com/neuvector/registry-adapter/${VERSION}/README.md" \
60+
"org.opencontainers.image.description"="SUSE Security Registry Adapter" \
61+
"org.opencontainers.image.title"="SUSE Security Registry Adapter" \
62+
"org.opencontainers.image.source"="https://github.com/neuvector/registry-adapter/" \
63+
"org.opencontainers.image.version"="${VERSION}" \
64+
"org.opensuse.reference"="neuvector/registry-adapter:${VERSION}"
65+
66+
67+
ENTRYPOINT ["/usr/local/bin/adapter"]

‎unitest.sh‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)