-
Notifications
You must be signed in to change notification settings - Fork 42
/
Dockerfile.debug
86 lines (71 loc) · 3.14 KB
/
Dockerfile.debug
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
FROM golang:1.22-bookworm as secretless-builder
MAINTAINER CyberArk Software Ltd.
LABEL builder="secretless-builder"
# On CyberArk dev laptops, golang module dependencies are downloaded with a
# corporate proxy in the middle. For these connections to succeed we need to
# configure the proxy CA certificate in build containers.
#
# To allow this script to also work on non-CyberArk laptops where the CA
# certificate is not available, we copy the (potentially empty) directory
# and update container certificates based on that, rather than rely on the
# CA file itself.
ADD build_ca_certificate /usr/local/share/ca-certificates/
RUN update-ca-certificates
WORKDIR /secretless
# TODO: Expand this with build args when we support other arches
ENV GOOS=linux \
GOARCH=amd64 \
CGO_ENABLED=1
COPY go.mod go.sum /secretless/
COPY third_party/ /secretless/third_party
RUN go mod download
# Compile Delve (for debugging)
RUN go install github.com/go-delve/delve/cmd/dlv@latest
# secretless source files
COPY ./cmd /secretless/cmd
COPY ./internal /secretless/internal
COPY ./pkg /secretless/pkg
COPY ./resource-definitions /secretless/resource-definitions
ARG TAG="dev"
# The `Tag` override is there to provide the git commit information in the
# final binary. See `Static long version tags` in the `Building` section
# of `CONTRIBUTING.md` for more information.
RUN go build -ldflags="-X github.com/cyberark/secretless-broker/pkg/secretless.Tag=$TAG" \
-gcflags="all=-N -l" \
-o dist/$GOOS/$GOARCH/secretless-broker ./cmd/secretless-broker && \
go build -o dist/$GOOS/$GOARCH/summon2 ./cmd/summon2
# =================== MAIN CONTAINER ===================
FROM alpine:3.17 as secretless-broker
MAINTAINER CyberArk Software Ltd.
RUN apk add -u shadow libc6-compat && \
# Add Limited user
groupadd -r secretless \
-g 777 && \
useradd -c "secretless runner account" \
-g secretless \
-u 777 \
-m \
-r \
secretless && \
# Ensure plugin dir is owned by secretless user
mkdir -p /usr/local/lib/secretless && \
# Make and setup a directory for sockets at /sock
mkdir /sock && \
# Make and setup a directory for the Conjur client certificate/access token
mkdir -p /etc/conjur/ssl && \
mkdir -p /run/conjur && \
# Use GID of 0 since that is what OpenShift will want to be able to read things
chown secretless:0 /usr/local/lib/secretless \
/sock \
/etc/conjur/ssl \
/run/conjur && \
# We need open group permissions in these directories since OpenShift won't
# match our UID when we try to write files to them
chmod 770 /sock \
/etc/conjur/ssl \
/run/conjur
USER secretless
ENTRYPOINT [ "/usr/local/bin/dlv", "exec", "/usr/local/bin/secretless-broker", "--headless", "--listen=:40000", "--api-version=2", "--accept-multiclient", "--continue" ]
COPY --from=secretless-builder /secretless/dist/linux/amd64/secretless-broker \
/go/bin/dlv \
/secretless/dist/linux/amd64/summon2 /usr/local/bin/