Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

distroless: Dockerfile works with distroless base image #2378

Merged
merged 3 commits into from
Feb 8, 2022
Merged

distroless: Dockerfile works with distroless base image #2378

merged 3 commits into from
Feb 8, 2022

Conversation

ankeesler
Copy link
Contributor

Overview

This PR hopes to add support for a distroless Dex container image:

docker build --build-arg BASEIMAGE=gcr.io/distroless/static:latest -t andrew:distroless .

What this PR does / why we need it

In order to get the Dex container built on distroless, I had to:

  1. rewrite docker-entrypoint.sh in go and compile it into the Dex image (to avoid the need for a shell in the Dex image)
  2. fetch CA certificates in an earlier build stage and copy them into the Dex image (to avoid the need for a package manager in the Dex image)
  3. add a "stager" build stage for creating some directories that should exist in the Dex container and copy them into the Dex image (to avoid the need for mkdir(1) in the Dex image)

Closes #1924.

Special notes for your reviewer

  • Perhaps see initial chatter about this in Provide distroless images #1924 comments.
  • Question: how do I setup E2E tests to run in CI with this distroless Dex container image?

Does this PR introduce a user-facing change?

Dex Dockerfile supports being built with distroless base layer (docker build --build-arg BASEIMAGE=gcr.io/distroless/static:latest ...)

@ankeesler
distroless: rewrite docker-entrypoint.sh in go
764ce71 
See go doc ./cmd/docker-entrypoint for why.

Signed-off-by: Andrew Keesler <[email protected]>
@ankeesler
distroless: fetch CA certificates in builder stage
a672ff9 
...so that we don't rely on a package manager to bring these down into the
runner stage.

Signed-off-by: Andrew Keesler <[email protected]>
@ankeesler
distroless: Dockerfile works with distroless base image
0394bf8 
I can build this via:
  docker build --build-arg BASEIMAGE=gcr.io/distroless/static:latest -t andrew:distroless .

Signed-off-by: Andrew Keesler <[email protected]>
ankeesler
ankeesler commented Jan 19, 2022
View reviewed changes
Makefile
@@ -18,7 +18,7 @@ group=$(shell id -g -n)

export GOBIN=$(PWD)/bin

LD_FLAGS="-w -X main.version=$(VERSION)"
LD_FLAGS="-w -X main.version=$(VERSION) -extldflags \"-static\""
Copy link
Contributor Author

@ankeesler ankeesler Jan 19, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how do y'all feel about always statically compiling C code into Go binaries? i added this since on distroless we don't have some C libraries that Go wants to dynamically load (i think they are related to somewhere around storage/sql/sqlite.go)

this looks like it would add 1 MB to the default alpine-based Dex container image

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

@ankeesler ankeesler mentioned this pull request Jan 19, 2022
Closed
@sagikazarmark
Copy link
Member

@ankeesler this is awesome, thanks for taking the time to submit this PR. It's gonna take a bit more time to review it, however I'm inclined to wait with the next release for this to land.

@sagikazarmark sagikazarmark self-requested a review January 25, 2022 23:51
@sagikazarmark sagikazarmark added this to the v2.31.0 milestone Jan 25, 2022
@ankeesler
Copy link
Contributor Author

thanks very much @sagikazarmark for the support and being willing to review and giving us a heads up on timeframe. let me know if you need anything from me in order to review.

sagikazarmark
sagikazarmark approved these changes Feb 4, 2022
View reviewed changes
Copy link
Member

@sagikazarmark sagikazarmark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ankeesler , this is great work! Kudos for providing tests.

Dockerfile Show resolved Hide resolved
Makefile
@@ -18,7 +18,7 @@ group=$(shell id -g -n)

export GOBIN=$(PWD)/bin

LD_FLAGS="-w -X main.version=$(VERSION)"
LD_FLAGS="-w -X main.version=$(VERSION) -extldflags \"-static\""
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

@ankeesler
Copy link
Contributor Author

thanks very much for reviewing @sagikazarmark - really appreciate you devoting the energy to this. i see you requested review from @nabokihms as well. i'll be on the lookout for that review...

@sagikazarmark
Copy link
Member

Yeah, @nabokihms did the original implementation of the entrypoint and gomplate, so I wanted to hear his opinion as well before merging.

nabokihms
nabokihms approved these changes Feb 7, 2022
View reviewed changes
Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I would say it looks even better with the test.

@ankeesler
Copy link
Contributor Author

ankeesler commented Feb 7, 2022 •
edited
Loading

thanks very much @nabokihms

2 things:

  • i didn't test this end-to-end...i just tested that the container could build and run, but i didn't test any logins. are there end-to-end tests that i should add to the existing dex tests to exercise this distroless container image?
  • do y'all have an estimate for when this will land in a release?

@nabokihms
Copy link
Member

  1. That is enough to check container could run.
  2. According to milestone v2.31.0, there is a couple of PRs we want to have reviewed. After checking them, we will release a new version.

@sagikazarmark sagikazarmark merged commit 75c27c8 into dexidp:master Feb 8, 2022
xtremerui pushed a commit to concourse/dex that referenced this pull request Feb 9, 2022
upstream dex release: v2.31.0
4147794 
The official docker release for this release can be pulled from

```
ghcr.io/dexidp/dex:v2.31.0
```

## What's Changed
* Bump Dex image to v2.30.0 for Kubernetes deployment example by @rdimitrov in dexidp#2232
* Update Go to 1.17 by @sagikazarmark in dexidp#2247
* refactor: move from io/ioutil to io and os package by @Juneezee in dexidp#2278
* feat: Add MySQL ent-based storage driver by @nabokihms in dexidp#2272
* chore: fix ioutil lint error after merging MySQL ent storage by @nabokihms in dexidp#2282
* Add parametrization of grant type supported in discovery endpoint by @ariary in dexidp#2265
* Resolves dexidp#2111 Option to fetch transitive group membership by @snuggie12 in dexidp#2268
* Return valid JWT access token from password grant by @enj in dexidp#2234
* fix: do not update offlinesession lastUsed field if refresh token was not updated by @nabokihms in dexidp#2300
* fix web static file path slash error for win platform by @copperyp in dexidp#2305
* Update grpc by @sagikazarmark in dexidp#2321
* ci: fix container image permissions by @sagikazarmark in dexidp#2329
* feat: print dex version in the logs by @iam-veeramalla in dexidp#2337
* OAuth connector by @xtremerui in dexidp#1630
* fix: return invalid_grant error on claiming token of another client by @nabokihms in dexidp#2344
* chore: warning about deprecated LDAP groupSearch fields by @nabokihms in dexidp#2026
* Add Nix environment by @sagikazarmark in dexidp#2324
* Update dependencies in the examples package by @sagikazarmark in dexidp#2372
* add sigstore to ADOPTERS.md by @bobcallaway in dexidp#2374
* Add claimMapping enforcement by @Happy2C0de in dexidp#2233
* ci: run trivy scan on container image by @sagikazarmark in dexidp#2387
* chore: update gomplate by @sagikazarmark in dexidp#2388
* chore: update golangci-lint download script by @nabokihms in dexidp#2394
* [fix] Replace /teams API w/ /workspaces endpoints by @rahulchheda in dexidp#2390
* ci: add Docker cache to speed builds up by @sagikazarmark in dexidp#2400
* distroless: Dockerfile works with distroless base image by @ankeesler in dexidp#2378
* Update dependencies by @sagikazarmark in dexidp#2404
* Update API package by @sagikazarmark in dexidp#2405

## Dependency updates
* build(deps): bump entgo.io/ent from 0.8.0 to 0.9.0 by @dependabot in dexidp#2226
* build(deps): bump golang from 1.16.6-alpine3.13 to 1.16.7-alpine3.13 by @dependabot in dexidp#2225
* build(deps): bump google.golang.org/grpc from 1.39.0 to 1.39.1 by @dependabot in dexidp#2227
* build(deps): bump google.golang.org/api from 0.52.0 to 0.53.0 by @dependabot in dexidp#2235
* build(deps): bump google.golang.org/grpc from 1.39.1 to 1.40.0 by @dependabot in dexidp#2236
* build(deps): bump alpine from 3.14.0 to 3.14.1 by @dependabot in dexidp#2229
* build(deps): bump github.com/go-ldap/ldap/v3 from 3.3.0 to 3.4.0 by @dependabot in dexidp#2239
* build(deps): bump google.golang.org/api from 0.53.0 to 0.54.0 by @dependabot in dexidp#2241
* build(deps): bump github.com/AppsFlyer/go-sundheit from 0.4.0 to 0.5.0 by @dependabot in dexidp#2240
* build(deps): bump google.golang.org/protobuf from 1.26.0 to 1.27.1 in /api/v2 by @dependabot in dexidp#2243
* build(deps): bump google.golang.org/grpc from 1.36.1 to 1.40.0 in /api/v2 by @dependabot in dexidp#2242
* build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.0 to 3.4.1 by @dependabot in dexidp#2246
* build(deps): bump entgo.io/ent from 0.9.0 to 0.9.1 by @dependabot in dexidp#2249
* build(deps): bump alpine from 3.14.1 to 3.14.2 by @dependabot in dexidp#2258
* build(deps): bump google.golang.org/api from 0.54.0 to 0.55.0 by @dependabot in dexidp#2259
* build(deps): bump google.golang.org/api from 0.55.0 to 0.56.0 by @dependabot in dexidp#2262
* build(deps): bump github.com/lib/pq from 1.10.2 to 1.10.3 by @dependabot in dexidp#2263
* build(deps): bump github.com/russellhaering/goxmldsig from 1.1.0 to 1.1.1 by @dependabot in dexidp#2270
* build(deps): bump golang from 1.17.0-alpine3.14 to 1.17.1-alpine3.14 by @dependabot in dexidp#2269
* build(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 by @dependabot in dexidp#2277
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 by @dependabot in dexidp#2279
* build(deps): bump golang from 1.17.1-alpine3.14 to 1.17.2-alpine3.14 by @dependabot in dexidp#2292
* build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.0 to 3.5.1 by @dependabot in dexidp#2298
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.0 to 3.5.1 by @dependabot in dexidp#2299
* build(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 by @dependabot in dexidp#2285
* build(deps): bump github.com/mattn/go-sqlite3 from 1.14.8 to 1.14.9 by @dependabot in dexidp#2302
* build(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 in /api/v2 by @dependabot in dexidp#2286
* build(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 by @dependabot in dexidp#2287
* build(deps): bump google.golang.org/api from 0.58.0 to 0.59.0 by @dependabot in dexidp#2303
* build(deps): bump google.golang.org/api from 0.59.0 to 0.60.0 by @dependabot in dexidp#2308
* build(deps): bump golang from 1.17.2-alpine3.14 to 1.17.3-alpine3.14 by @dependabot in dexidp#2317
* build(deps): bump github.com/lib/pq from 1.10.3 to 1.10.4 by @dependabot in dexidp#2320
* build(deps): bump alpine from 3.14.2 to 3.14.3 by @dependabot in dexidp#2325
* build(deps): bump alpine from 3.14.3 to 3.15.0 by @dependabot in dexidp#2336
* build(deps): bump google.golang.org/api from 0.60.0 to 0.61.0 by @dependabot in dexidp#2341
* build(deps): bump golang from 1.17.3-alpine3.14 to 1.17.4-alpine3.14 by @dependabot in dexidp#2345
* build(deps): bump google.golang.org/api from 0.61.0 to 0.62.0 by @dependabot in dexidp#2348
* build(deps): bump golang from 1.17.4-alpine3.14 to 1.17.5-alpine3.14 by @dependabot in dexidp#2349
* build(deps): bump github.com/spf13/cobra from 1.2.1 to 1.3.0 by @dependabot in dexidp#2354
* build(deps): bump google.golang.org/api from 0.62.0 to 0.63.0 by @dependabot in dexidp#2353
* build(deps): bump google.golang.org/grpc from 1.42.0 to 1.43.0 by @dependabot in dexidp#2355
* build(deps): bump google.golang.org/grpc from 1.42.0 to 1.43.0 in /api/v2 by @dependabot in dexidp#2356
* build(deps): bump github.com/mattn/go-sqlite3 from 1.14.9 to 1.14.10 by @dependabot in dexidp#2362
* build(deps): bump golang from 1.17.5-alpine3.14 to 1.17.6-alpine3.14 by @dependabot in dexidp#2363
* build(deps): bump google.golang.org/api from 0.63.0 to 0.64.0 by @dependabot in dexidp#2364
* build(deps): bump google.golang.org/api from 0.64.0 to 0.65.0 by @dependabot in dexidp#2368
* build(deps): bump github.com/prometheus/client_golang from 1.11.0 to 1.12.0 by @dependabot in dexidp#2380
* build(deps): bump google.golang.org/grpc from 1.43.0 to 1.44.0 by @dependabot in dexidp#2384
* build(deps): bump google.golang.org/grpc from 1.43.0 to 1.44.0 in /api/v2 by @dependabot in dexidp#2385
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.1 to 3.5.2 by @dependabot in dexidp#2395
* build(deps): bump aquasecurity/trivy-action from 0.2.1 to 0.2.2 by @dependabot in dexidp#2398
* build(deps): bump google.golang.org/api from 0.65.0 to 0.67.0 by @dependabot in dexidp#2399
* build(deps): bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1 by @dependabot in dexidp#2393

## New Contributors
* @rdimitrov made their first contribution in dexidp#2232
* @Juneezee made their first contribution in dexidp#2278
* @ariary made their first contribution in dexidp#2265
* @snuggie12 made their first contribution in dexidp#2268
* @enj made their first contribution in dexidp#2234
* @copperyp made their first contribution in dexidp#2305
* @iam-veeramalla made their first contribution in dexidp#2337
* @bobcallaway made their first contribution in dexidp#2374
* @Happy2C0de made their first contribution in dexidp#2233
* @rahulchheda made their first contribution in dexidp#2390
* @ankeesler made their first contribution in dexidp#2378

**Full Changelog**: dexidp/dex@v2.30.0...v2.31.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nabokihms nabokihms nabokihms approved these changes

@sagikazarmark sagikazarmark sagikazarmark approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v2.31.0
Development

Successfully merging this pull request may close these issues.

Provide distroless images
3 participants
@ankeesler @sagikazarmark @nabokihms