Skip to content

Commit ae871d8

Browse files
WyriHaximusWyriHaximus
committed
Build (optional) multi arch support into our build toolkit
1 parent f6ce09f commit ae871d8

18 files changed

+349
-469
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 262 additions & 399 deletions
Large diffs are not rendered by default.

‎Dockerfile-cli‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# syntax=docker/dockerfile:experimental
22
FROM php:7.2-cli-alpine3.7 as cli
3+
ARG TARGETOS
4+
ARG TARGETARCH
35

46
# Add usabilla user and group
57
RUN set -x \
@@ -15,6 +17,7 @@ COPY src/php/utils/docker/ /usr/local/bin/
1517
# Install PHP extensions
1618
# hadolint ignore=DL4006
1719
RUN set -x \
20+
&& apk upgrade --no-cache \
1821
# Install curl-dev in order to address the curl binary issue in some Alpine versions
1922
&& apk add --no-cache curl-dev \
2023
# Adding sodium purely for the 7.1 image, it's already in 7.2 and up: https://www.php.net/manual/en/sodium.installation.php \
@@ -31,9 +34,6 @@ RUN set -x \
3134
&& docker-php-source-tarball clean && rm /usr/local/bin/php-cgi && rm /usr/local/bin/phpdbg && rm -rf /tmp/pear ~/.pearrc \
3235
&& apk del .phpize-deps \
3336

34-
# Patch CVE-2018-14618 (curl), CVE-2018-16842 (libxml2), CVE-2019-11068 (libxslt)
35-
&& apk upgrade --no-cache curl libxml2 libxslt \
36-
3737
# Create a symlink to the recommended production configuration
3838
# ref: https://github.com/docker-library/docs/tree/master/php#configuration
3939
&& ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini

‎Dockerfile-fpm‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# syntax=docker/dockerfile:experimental
22
FROM php:7.2-fpm-alpine3.7 as fpm
3+
ARG TARGETOS
4+
ARG TARGETARCH
35

46
ENV FCGI_CONNECT=/var/run/php-fpm.sock
57
ENV PHP_FPM_PM=dynamic
@@ -26,6 +28,7 @@ COPY src/php/utils/install-* /usr/local/bin/
2628
# Install PHP extensions
2729
# hadolint ignore=DL4006
2830
RUN set -x \
31+
&& apk upgrade --no-cache \
2932
# Install curl-dev in order to address the curl binary issue in some Alpine versions
3033
&& apk add --no-cache curl-dev \
3134
# Adding sodium purely for the 7.1 image, it's already in 7.2 and up: https://www.php.net/manual/en/sodium.installation.php \
@@ -43,9 +46,6 @@ RUN set -x \
4346
&& apk del .phpize-deps \
4447
&& apk add --no-cache fcgi \
4548

46-
# Patch CVE-2018-14618 (curl), CVE-2018-16842 (libxml2), CVE-2019-11068 (libxslt)
47-
&& apk upgrade --no-cache curl libxml2 libxslt \
48-
4949
# Create a symlink to the recommended production configuration
5050
# ref: https://github.com/docker-library/docs/tree/master/php#configuration
5151
&& ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini

‎Dockerfile-http‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM nginx:1.15-alpine as http
1+
FROM nginx:1.15-alpine AS http
22

33
# Add usabilla user and group
44
RUN set -x \
@@ -21,8 +21,8 @@ ENV NGINX_LARGE_CLIENT_HEADER_BUFFERS="4 8k"
2121
ENV NGINX_CORS_ENABLE=false
2222
ENV NGINX_CORS_ALLOW_ORIGIN="*"
2323

24-
# Patch gCVE-2019-11068 (libxslt)
25-
RUN apk upgrade --no-cache libxslt
24+
RUN set -x \
25+
&& apk upgrade --no-cache
2626

2727
# Nginx helper scripts
2828
COPY src/http/nginx/docker-nginx-* /usr/local/bin/
@@ -37,6 +37,6 @@ CMD ["docker-nginx-entrypoint"]
3737
# this can be overriden in the child images
3838
HEALTHCHECK NONE
3939

40-
FROM http as http-dev
40+
FROM http AS http-dev
4141

4242
ENV NGINX_EXPOSE_VERSION=on

‎Makefile‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ build-http: clean-tags
5252
# Adding arbitrary version 1.0 in order to make sure if we break compatibility we have to up it
5353
build-prometheus-exporter-file: BUILDINGIMAGE=prometheus-exporter-file
5454
build-prometheus-exporter-file: clean-tags
55-
./build-prometheus-exporter-file.sh 1.18 prometheus-exporter-file1.0 prometheus-exporter-file1
55+
./build-prometheus-exporter-file.sh 1.29 prometheus-exporter-file1.0 prometheus-exporter-file1
5656

5757
.NOTPARALLEL: clean-tags
5858
clean-tags:
@@ -103,8 +103,4 @@ test-prometheus-exporter-file-e2e: ./tmp/build-prometheus-exporter-file.tags
103103
xargs -I % ./test-prometheus-exporter-file-e2e.sh % < ./tmp/build-prometheus-exporter-file.tags
104104

105105
scan-vulnerability:
106-
docker compose -f test/security/docker-compose.yml -p clair-ci up -d
107-
RETRIES=0 && while ! wget -T 10 -q -O /dev/null http://localhost:6060/v1/namespaces ; do sleep 1 ; echo -n "." ; if [ $${RETRIES} -eq 10 ] ; then echo " Timeout, aborting." ; exit 1 ; fi ; RETRIES=$$(($${RETRIES}+1)) ; done
108-
mkdir -p ./tmp/clair/usabillabv
109-
cat ./tmp/build-*.tags | xargs -I % sh -c 'clair-scanner --ip 172.17.0.1 -r "./tmp/clair/%.json" -l ./tmp/clair/clair.log % || echo "% is vulnerable"'
110-
docker compose -f test/security/docker-compose.yml -p clair-ci down
106+
cat ./tmp/build-*.tags | xargs -I % sh -c 'docker run -v /tmp/trivy:/var/lib/trivy -v /var/run/docker.sock:/var/run/docker.sock -t aquasec/trivy:latest --cache-dir /var/lib/trivy image --skip-files "/usr/local/bin/shush" --exit-code 1 --no-progress % || (echo "% is vulnerable" && exit 1)'

‎build-http.sh‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,32 @@ declare -r IMAGE_ORIGINAL_TAG="nginx:1.[0-9][0-9]?-alpine"
1515

1616
declare -r IMAGE_TAG="nginx:${VERSION_NGINX}-alpine"
1717
declare -r USABILLA_TAG_PREFIX="usabillabv/php"
18-
declare -r USABILLA_TAG="${USABILLA_TAG_PREFIX}:nginx${VERSION_NGINX}"
19-
declare -r USABILLA_TAG_DEV="${USABILLA_TAG}-dev"
20-
21-
TAG_FILE="./tmp/build-${IMAGE}.tags"
22-
18+
if [[ ! -v DOCKER_BUILD_PLATFORM ]]; then
19+
declare -r DOCKER_BUILD_FLAGS=""
20+
declare -r USABILLA_TAG_SUFFIX=""
21+
else
22+
declare -r DOCKER_BUILD_FLAGS="--platform=${DOCKER_BUILD_PLATFORM}"
23+
# shellcheck disable=SC2155
24+
declare -r USABILLA_TAG_SUFFIX="-${DOCKER_BUILD_PLATFORM//\//-}"
25+
fi
26+
declare -r USABILLA_TAG="${USABILLA_TAG_PREFIX}:nginx${VERSION_NGINX}${USABILLA_TAG_SUFFIX}"
27+
declare -r USABILLA_TAG_DEV="${USABILLA_TAG_PREFIX}:nginx${VERSION_NGINX}-dev${USABILLA_TAG_SUFFIX}"
28+
29+
declare -r TAG_FILE="./tmp/build-${IMAGE}${USABILLA_TAG_SUFFIX}.tags"
30+
31+
# shellcheck disable=SC2086
2332
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG}" \
24-
--build-arg=NGINX_VHOST_TEMPLATE=php-fpm --target="${IMAGE}" -f - . \
33+
--build-arg=NGINX_VHOST_TEMPLATE=php-fpm --target="${IMAGE}" ${DOCKER_BUILD_FLAGS} -f - . \
2534
&& echo "${USABILLA_TAG}" >> "${TAG_FILE}"
2635

36+
# shellcheck disable=SC2086
2737
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG_DEV}" \
28-
--build-arg=NGINX_VHOST_TEMPLATE=php-fpm --target="${IMAGE}-dev" -f - . \
38+
--build-arg=NGINX_VHOST_TEMPLATE=php-fpm --target="${IMAGE}-dev" ${DOCKER_BUILD_FLAGS} -f - . \
2939
&& echo "$USABILLA_TAG_DEV" >> "${TAG_FILE}"
3040

3141
for IMAGE_EXTRA_TAG in "${@:2}"
3242
do
3343
declare NEW_TAG="${USABILLA_TAG_PREFIX}:${IMAGE_EXTRA_TAG}"
34-
docker tag "${USABILLA_TAG}" "${NEW_TAG}" && echo "${NEW_TAG}" >> "${TAG_FILE}"
35-
docker tag "${USABILLA_TAG_DEV}" "${NEW_TAG}-dev" && echo "${NEW_TAG}-dev" >> "${TAG_FILE}"
44+
docker tag "${USABILLA_TAG}" "${NEW_TAG}${USABILLA_TAG_SUFFIX}" && echo "${NEW_TAG}${USABILLA_TAG_SUFFIX}" >> "${TAG_FILE}"
45+
docker tag "${USABILLA_TAG_DEV}" "${NEW_TAG}-dev${USABILLA_TAG_SUFFIX}" && echo "${NEW_TAG}-dev${USABILLA_TAG_SUFFIX}" >> "${TAG_FILE}"
3646
done

‎build-php.sh‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,24 @@ declare -r VERSION_ALPINE=$3
1616
declare -r IMAGE_ORIGINAL_TAG="7.[0-9]-${IMAGE}-alpine3.[0-9]"
1717

1818
declare -r IMAGE_TAG="${VERSION_PHP}-${IMAGE}-alpine${VERSION_ALPINE}"
19-
declare -r USABILLA_TAG="usabillabv/php:${VERSION_PHP}-${IMAGE}-alpine${VERSION_ALPINE}"
20-
declare -r USABILLA_TAG_DEV="${USABILLA_TAG}-dev"
21-
22-
declare -r TAG_FILE="./tmp/build-${IMAGE}.tags"
23-
24-
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG}" --target="${IMAGE}" -f - . \
19+
if [[ ! -v DOCKER_BUILD_PLATFORM ]]; then
20+
declare -r DOCKER_BUILD_FLAGS=""
21+
declare -r USABILLA_TAG_SUFFIX=""
22+
else
23+
declare -r DOCKER_BUILD_FLAGS="--platform=${DOCKER_BUILD_PLATFORM}"
24+
# shellcheck disable=SC2155
25+
declare -r USABILLA_TAG_SUFFIX="-${DOCKER_BUILD_PLATFORM//\//-}"
26+
fi
27+
declare -r USABILLA_TAG_PREFIX="usabillabv/php:${VERSION_PHP}-${IMAGE}-alpine${VERSION_ALPINE}"
28+
declare -r USABILLA_TAG="${USABILLA_TAG_PREFIX}${USABILLA_TAG_SUFFIX}"
29+
declare -r USABILLA_TAG_DEV="${USABILLA_TAG_PREFIX}-dev${USABILLA_TAG_SUFFIX}"
30+
31+
declare -r TAG_FILE="./tmp/build-${IMAGE}${USABILLA_TAG_SUFFIX}.tags"
32+
33+
# shellcheck disable=SC2086
34+
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG}" --target="${IMAGE}" ${DOCKER_BUILD_FLAGS} -f - . \
2535
&& echo "$USABILLA_TAG" >> "$TAG_FILE"
2636

27-
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG_DEV}" --target="${IMAGE}-dev" -f - . \
37+
# shellcheck disable=SC2086
38+
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${IMAGE}" | docker build --pull -t "${USABILLA_TAG_DEV}" --target="${IMAGE}-dev" ${DOCKER_BUILD_FLAGS} -f - . \
2839
&& echo "$USABILLA_TAG_DEV" >> "$TAG_FILE"

‎build-prometheus-exporter-file.sh‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,25 @@ declare -r IMAGE_ORIGINAL_TAG="nginx:1.[0-9][0-9]?-alpine"
1717

1818
declare -r IMAGE_TAG="nginx:${VERSION_NGINX}-alpine"
1919
declare -r USABILLA_TAG_PREFIX="usabillabv/php"
20-
declare -r USABILLA_TAG="${USABILLA_TAG_PREFIX}:${IMAGE}"
21-
22-
TAG_FILE="./tmp/build-${IMAGE}.tags"
23-
20+
if [[ ! -v DOCKER_BUILD_PLATFORM ]]; then
21+
declare -r DOCKER_BUILD_FLAGS=""
22+
declare -r USABILLA_TAG_SUFFIX=""
23+
else
24+
declare -r DOCKER_BUILD_FLAGS="--platform=${DOCKER_BUILD_PLATFORM}"
25+
# shellcheck disable=SC2155
26+
declare -r USABILLA_TAG_SUFFIX="-${DOCKER_BUILD_PLATFORM//\//-}"
27+
fi
28+
declare -r USABILLA_TAG="${USABILLA_TAG_PREFIX}:${IMAGE}${USABILLA_TAG_SUFFIX}"
29+
30+
declare -r TAG_FILE="./tmp/build-${IMAGE}${USABILLA_TAG_SUFFIX}.tags"
31+
32+
# shellcheck disable=SC2086
2433
sed -E "s/${IMAGE_ORIGINAL_TAG}/${IMAGE_TAG}/g" "Dockerfile-${DOCKER_FILE}" | docker build --pull -t "${USABILLA_TAG}" \
25-
--build-arg=NGINX_VHOST_TEMPLATE=prometheus-exporter-file --target="http" -f - . \
34+
--build-arg=NGINX_VHOST_TEMPLATE=prometheus-exporter-file --target="http" ${DOCKER_BUILD_FLAGS} -f - . \
2635
&& echo "${USABILLA_TAG}" >> "${TAG_FILE}"
2736

2837
for USABILLA_TAG_EXTRA in "${@:2}"
2938
do
30-
docker tag "${USABILLA_TAG}" "${USABILLA_TAG_PREFIX}:${USABILLA_TAG_EXTRA}" \
31-
&& echo "${USABILLA_TAG_PREFIX}:${USABILLA_TAG_EXTRA}" >> "${TAG_FILE}"
39+
docker tag "${USABILLA_TAG}" "${USABILLA_TAG_PREFIX}:${USABILLA_TAG_EXTRA}${USABILLA_TAG_SUFFIX}" \
40+
&& echo "${USABILLA_TAG_PREFIX}:${USABILLA_TAG_EXTRA}${USABILLA_TAG_SUFFIX}" >> "${TAG_FILE}"
3241
done

‎src/php/utils/install-dumb-init‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ set -xeu
44

55
VERSION="1.2.2"
66

7-
curl -sL -o /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v"$VERSION"/dumb-init_"$VERSION"_amd64
7+
curl -sL -o /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v"$VERSION"/dumb-init_"$VERSION"_"${TARGETARCH}"
88

99
chmod +x /usr/local/bin/dumb-init
1010

‎src/php/utils/install-shush‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22

33
set -xe
44

5-
curl -sL -o /usr/local/bin/shush https://github.com/realestate-com-au/shush/releases/download/v1.5.0/shush_linux_amd64
5+
curl -sL -o /usr/local/bin/shush "https://github.com/realestate-com-au/shush/releases/download/v1.5.5/shush_linux_${TARGETARCH}"
66

7-
echo "cdec941dc5f45dda2d981169aa1845540d2c5bf98bfd1d8a85deaa6a6a43a4d1 /usr/local/bin/shush" | sha256sum -c
7+
(echo "d0e091405a18b6d11a65ea1d7449802c0cbac51971031897089d038e6f7cc750 /usr/local/bin/shush" | sha256sum -c) || (echo "138af0f1eec3af50176d542fead8824c3ca0f6ba27a4a50e1db8af5959a13116 /usr/local/bin/shush" | sha256sum -c)
88

99
chmod +x /usr/local/bin/shush
1010

0 commit comments

Comments
 (0)