Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security optimizations for the container base image #10672

Merged
merged 16 commits into from
Jul 25, 2024

Commits on Jul 8, 2024

  1. refactor(ct): migrate to useradd style commands in base image

    The Ubuntu specific wrappers "adduser" and "addgroup" have been removed with Ubuntu 24.04. Also, lets be more compatible with LSB this way.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    d35a474 View commit details
    Browse the repository at this point in the history
  2. fix(ct): security fix to use the unprivileged user in base image

    It was left as "root" by accident, but should obviously be not.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    4a49552 View commit details
    Browse the repository at this point in the history
  3. refactor(ct): use pkg names compatible with Ubuntu 22 and 24

    Also delete some unused packages like gpg and dirmngr
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    7213c43 View commit details
    Browse the repository at this point in the history
  4. fix(ct): solve pre/post boot command file trouble

    - The entrypoint now defines two locations, which can be overridden by a user _without_ implicitely trying to execute these scripts.
    - The entrypoint now _removes_ any files found at these locations to _always_ start with a clean slate. Otherwise stale files might be looped over and over again.
    - A consequence of this: any kind of commands to be included must be provided via a script and cannot be provided by some initial file.
    - The configuration scripts no longer leave temporary files dangling and avoid these files if possible. Instead, we are injecting statements into these files while checking for duplicates as a safety measure.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    1278f5f View commit details
    Browse the repository at this point in the history
  5. refactor(ct): move Dataverse specific tweaks for reload from base to …

    …application
    
    Setting these env vars when reloading are highly application specific and shall not reside in the base image.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    bd0832a View commit details
    Browse the repository at this point in the history
  6. feat(ct): base image infrastructure to set passwords

    - Provide env vars for admin, linux user and domain master password.
    - These are set to the publicly known values, good enough for development or demo purposes.
    - For production purposes, these variables will be used to change passwords at run/boottime of the container.
    - As of this commit, do _not_ leave any password lying around in files, which could be exploited.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    db802f8 View commit details
    Browse the repository at this point in the history
  7. feat(ct): introduce runtime password changing

    A new init script allows to set passwords at boot time of the container. If the passwords are not changed, there will be warnings logged about the default in use.
    
    Slightly modifying the startInForeground.sh script to avoid keeping password files or sensitive passwords around after starting the server.
    poikilotherm committed Jul 8, 2024
    Configuration menu
    Copy the full SHA
    4073d6c View commit details
    Browse the repository at this point in the history

Commits on Jul 15, 2024

  1. Configuration menu
    Copy the full SHA
    aba7ab4 View commit details
    Browse the repository at this point in the history
  2. chore(ct): replace wait-for with wait4x

    Aligning configbaker and base image with same tool. wait4x has much more features to wait for different services.
    poikilotherm committed Jul 15, 2024
    Configuration menu
    Copy the full SHA
    119d9eb View commit details
    Browse the repository at this point in the history
  3. build(ct): make target architecture available in base image build

    As per https://docs.docker.com/reference/dockerfile/#automatic-platform-args-in-the-global-scope BuildKit / buildx will expose the target architecture. It requires adding an ARG in the Dockerfile to inject the data.
    poikilotherm committed Jul 15, 2024
    Configuration menu
    Copy the full SHA
    2176516 View commit details
    Browse the repository at this point in the history
  4. chore(ct): upgrade base image with jattach v2.2

    jattach binary is now available for ARM64 and AMD64, but requires special handling with download URLs and checksums.
    poikilotherm committed Jul 15, 2024
    Configuration menu
    Copy the full SHA
    904229f View commit details
    Browse the repository at this point in the history
  5. refactor(ct): change security related variable names for clarity

    Variable names related to user, password, and domain in Dockerfile and scripts have been modified for better clarity and consistency.
    
    This includes changing the names of admin user and password, domain master password, and Linux password and user.
    poikilotherm committed Jul 15, 2024
    Configuration menu
    Copy the full SHA
    c1c6b16 View commit details
    Browse the repository at this point in the history
  6. docs(ct): add documentation about changing passwords and some more

     Also includes a release note
    poikilotherm committed Jul 15, 2024
    Configuration menu
    Copy the full SHA
    5c7a91c View commit details
    Browse the repository at this point in the history

Commits on Jul 25, 2024

  1. Configuration menu
    Copy the full SHA
    146c927 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    610c184 View commit details
    Browse the repository at this point in the history
  3. Revert "bump to prevent "unknown flag: --driver" on Mac #10508 #9771"

    This reverts commit 146c927.
    
    We can't use 0.44 because of this error:
    
    "Unable to inspect image [solr:]"
    
    See https://github.com/fabric8io/docker-maven-plugin/issues/1756e
    pdurbin committed Jul 25, 2024
    Configuration menu
    Copy the full SHA
    4258900 View commit details
    Browse the repository at this point in the history