-
Notifications
You must be signed in to change notification settings - Fork 490
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security optimizations for the container base image #10672
Commits on Jul 8, 2024
-
refactor(ct): migrate to useradd style commands in base image
The Ubuntu specific wrappers "adduser" and "addgroup" have been removed with Ubuntu 24.04. Also, lets be more compatible with LSB this way.
Configuration menu - View commit details
-
Copy full SHA for d35a474 - Browse repository at this point
Copy the full SHA d35a474View commit details -
fix(ct): security fix to use the unprivileged user in base image
It was left as "root" by accident, but should obviously be not.
Configuration menu - View commit details
-
Copy full SHA for 4a49552 - Browse repository at this point
Copy the full SHA 4a49552View commit details -
refactor(ct): use pkg names compatible with Ubuntu 22 and 24
Also delete some unused packages like gpg and dirmngr
Configuration menu - View commit details
-
Copy full SHA for 7213c43 - Browse repository at this point
Copy the full SHA 7213c43View commit details -
fix(ct): solve pre/post boot command file trouble
- The entrypoint now defines two locations, which can be overridden by a user _without_ implicitely trying to execute these scripts. - The entrypoint now _removes_ any files found at these locations to _always_ start with a clean slate. Otherwise stale files might be looped over and over again. - A consequence of this: any kind of commands to be included must be provided via a script and cannot be provided by some initial file. - The configuration scripts no longer leave temporary files dangling and avoid these files if possible. Instead, we are injecting statements into these files while checking for duplicates as a safety measure.
Configuration menu - View commit details
-
Copy full SHA for 1278f5f - Browse repository at this point
Copy the full SHA 1278f5fView commit details -
refactor(ct): move Dataverse specific tweaks for reload from base to …
…application Setting these env vars when reloading are highly application specific and shall not reside in the base image.
Configuration menu - View commit details
-
Copy full SHA for bd0832a - Browse repository at this point
Copy the full SHA bd0832aView commit details -
feat(ct): base image infrastructure to set passwords
- Provide env vars for admin, linux user and domain master password. - These are set to the publicly known values, good enough for development or demo purposes. - For production purposes, these variables will be used to change passwords at run/boottime of the container. - As of this commit, do _not_ leave any password lying around in files, which could be exploited.
Configuration menu - View commit details
-
Copy full SHA for db802f8 - Browse repository at this point
Copy the full SHA db802f8View commit details -
feat(ct): introduce runtime password changing
A new init script allows to set passwords at boot time of the container. If the passwords are not changed, there will be warnings logged about the default in use. Slightly modifying the startInForeground.sh script to avoid keeping password files or sensitive passwords around after starting the server.
Configuration menu - View commit details
-
Copy full SHA for 4073d6c - Browse repository at this point
Copy the full SHA 4073d6cView commit details
Commits on Jul 15, 2024
-
Configuration menu - View commit details
-
Copy full SHA for aba7ab4 - Browse repository at this point
Copy the full SHA aba7ab4View commit details -
chore(ct): replace wait-for with wait4x
Aligning configbaker and base image with same tool. wait4x has much more features to wait for different services.
Configuration menu - View commit details
-
Copy full SHA for 119d9eb - Browse repository at this point
Copy the full SHA 119d9ebView commit details -
build(ct): make target architecture available in base image build
As per https://docs.docker.com/reference/dockerfile/#automatic-platform-args-in-the-global-scope BuildKit / buildx will expose the target architecture. It requires adding an ARG in the Dockerfile to inject the data.
Configuration menu - View commit details
-
Copy full SHA for 2176516 - Browse repository at this point
Copy the full SHA 2176516View commit details -
chore(ct): upgrade base image with jattach v2.2
jattach binary is now available for ARM64 and AMD64, but requires special handling with download URLs and checksums.
Configuration menu - View commit details
-
Copy full SHA for 904229f - Browse repository at this point
Copy the full SHA 904229fView commit details -
refactor(ct): change security related variable names for clarity
Variable names related to user, password, and domain in Dockerfile and scripts have been modified for better clarity and consistency. This includes changing the names of admin user and password, domain master password, and Linux password and user.
Configuration menu - View commit details
-
Copy full SHA for c1c6b16 - Browse repository at this point
Copy the full SHA c1c6b16View commit details -
docs(ct): add documentation about changing passwords and some more
Also includes a release note
Configuration menu - View commit details
-
Copy full SHA for 5c7a91c - Browse repository at this point
Copy the full SHA 5c7a91cView commit details
Commits on Jul 25, 2024
-
Configuration menu - View commit details
-
Copy full SHA for 146c927 - Browse repository at this point
Copy the full SHA 146c927View commit details -
Configuration menu - View commit details
-
Copy full SHA for 610c184 - Browse repository at this point
Copy the full SHA 610c184View commit details -
Revert "bump to prevent "unknown flag: --driver" on Mac #10508 #9771"
This reverts commit 146c927. We can't use 0.44 because of this error: "Unable to inspect image [solr:]" See https://github.com/fabric8io/docker-maven-plugin/issues/1756e
Configuration menu - View commit details
-
Copy full SHA for 4258900 - Browse repository at this point
Copy the full SHA 4258900View commit details