From 6ed8c2bdf80feb2e0f44593b8be5aa22c4460079 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9ophile=20Diot?= Date: Wed, 7 Aug 2024 13:42:47 +0100 Subject: [PATCH] refactor: Optimize Dockerfile build time --- src/autoconf/Dockerfile | 20 +++++++++++--------- src/bw/Dockerfile | 14 ++++++++------ src/scheduler/Dockerfile | 20 +++++++++++--------- src/ui/Dockerfile | 20 +++++++++++--------- 4 files changed, 41 insertions(+), 33 deletions(-) diff --git a/src/autoconf/Dockerfile b/src/autoconf/Dockerfile index 58f02705a..325e7ea19 100644 --- a/src/autoconf/Dockerfile +++ b/src/autoconf/Dockerfile @@ -36,16 +36,22 @@ FROM python:3.12.4-alpine@sha256:7f15e22f496c65cffbbac5e30e7e98d60f3e3b9cc5ee5d5 # Set default umask to prevent huge recursive chmod increasing the final image size RUN umask 027 +# Install bash and create autoconf user +RUN apk add --no-cache bash && \ + addgroup -g 101 autoconf && \ + adduser -h /var/cache/autoconf -g autoconf -s /bin/sh -G autoconf -D -H -u 101 autoconf + +# Fix CVEs +RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 +RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 + # Copy dependencies COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb WORKDIR /usr/share/bunkerweb -# Add autoconf user, drop bwcli, install runtime dependencies, create data folders and set permissions -RUN apk add --no-cache bash && \ - addgroup -g 101 autoconf && \ - adduser -h /var/cache/autoconf -g autoconf -s /bin/sh -G autoconf -D -H -u 101 autoconf && \ - cp helpers/bwcli /usr/bin/ && \ +# Drop bwcli, install runtime dependencies, create data folders and set permissions +RUN cp helpers/bwcli /usr/bin/ && \ echo "Docker" > INTEGRATION && \ mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ @@ -60,10 +66,6 @@ RUN apk add --no-cache bash && \ chmod 750 cli/main.py helpers/*.sh /usr/bin/bwcli autoconf/main.py && \ chmod 660 INTEGRATION -# Fix CVEs -RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 -RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 - LABEL maintainer="Bunkerity " LABEL version="1.6.0-beta" LABEL url="https://www.bunkerweb.io" diff --git a/src/bw/Dockerfile b/src/bw/Dockerfile index 945aef117..37462da84 100644 --- a/src/bw/Dockerfile +++ b/src/bw/Dockerfile @@ -47,14 +47,19 @@ FROM nginx:1.26.1-alpine-slim@sha256:154e108059468bed12d676c3c446e4767db24d6099f # Set default umask to prevent huge recursive chmod increasing the final image size RUN umask 027 +# Install runtime dependencies +RUN apk add --no-cache openssl pcre bash python3 yajl geoip libxml2 libgd curl + +# Fix CVEs +RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42366 + # Copy dependencies COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb WORKDIR /usr/share/bunkerweb -# Install runtime dependencies, pypi packages, move bwcli, create data folders and set permissions -RUN apk add --no-cache openssl pcre bash python3 yajl geoip libxml2 libgd curl && \ - cp helpers/bwcli /usr/bin/ && \ +# Move bwcli, create data folders and set permissions +RUN cp helpers/bwcli /usr/bin/ && \ mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www/html && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ for dir in $(echo "pro configs plugins") ; do mkdir -p "/data/${dir}" && ln -s "/data/${dir}" "/etc/bunkerweb/${dir}" ; done && \ @@ -67,9 +72,6 @@ RUN apk add --no-cache openssl pcre bash python3 yajl geoip libxml2 libgd curl & ln -s /proc/1/fd/2 /var/log/bunkerweb/modsec_audit.log && \ ln -s /proc/1/fd/1 /var/log/bunkerweb/access.log -# Fix CVEs -RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42366 - LABEL maintainer="Bunkerity " LABEL version="1.6.0-beta" LABEL url="https://www.bunkerweb.io" diff --git a/src/scheduler/Dockerfile b/src/scheduler/Dockerfile index 879df825f..732089d57 100644 --- a/src/scheduler/Dockerfile +++ b/src/scheduler/Dockerfile @@ -40,16 +40,22 @@ FROM python:3.12.4-alpine@sha256:7f15e22f496c65cffbbac5e30e7e98d60f3e3b9cc5ee5d5 # Set default umask to prevent huge recursive chmod increasing the final image size RUN umask 027 +# Install runtime dependencies and add scheduler user +RUN apk add --no-cache bash unzip libgcc libstdc++ libpq openssl libmagic mariadb-connector-c mariadb-client postgresql-client sqlite && \ + addgroup -g 101 scheduler && \ + adduser -h /var/cache/nginx -g scheduler -s /bin/sh -G scheduler -D -H -u 101 scheduler + +# Fix CVEs +RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 +RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" "openssl>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 + # Copy dependencies COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb WORKDIR /usr/share/bunkerweb -# Add scheduler user, drop bwcli, install runtime dependencies, create data folders and set permissions -RUN apk add --no-cache bash unzip libgcc libstdc++ libpq openssl libmagic mariadb-connector-c mariadb-client postgresql-client sqlite && \ - addgroup -g 101 scheduler && \ - adduser -h /var/cache/nginx -g scheduler -s /bin/sh -G scheduler -D -H -u 101 scheduler && \ - cp helpers/bwcli /usr/bin/ && \ +# Drop bwcli, install runtime dependencies, create data folders and set permissions +RUN cp helpers/bwcli /usr/bin/ && \ echo "Docker" > INTEGRATION && \ mkdir -p /etc/nginx /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ @@ -69,10 +75,6 @@ RUN rm -rf /var/cache/apk/* COPY --chown=root:scheduler --chmod=770 src/bw/misc/asn.mmdb /var/tmp/bunkerweb/asn.mmdb COPY --chown=root:scheduler --chmod=770 src/bw/misc/country.mmdb /var/tmp/bunkerweb/country.mmdb -# Fix CVEs -RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 -RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" "openssl>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 - LABEL maintainer="Bunkerity " LABEL version="1.6.0-beta" LABEL url="https://www.bunkerweb.io" diff --git a/src/ui/Dockerfile b/src/ui/Dockerfile index 60b4b0049..b036f1906 100644 --- a/src/ui/Dockerfile +++ b/src/ui/Dockerfile @@ -55,16 +55,22 @@ FROM python:3.12.4-alpine@sha256:7f15e22f496c65cffbbac5e30e7e98d60f3e3b9cc5ee5d5 # Set default umask to prevent huge recursive chmod increasing the final image size RUN umask 027 +# Install runtime dependencies and add ui user +RUN apk add --no-cache bash unzip libmagic mariadb-connector-c mariadb-client postgresql-client sqlite && \ + addgroup -g 101 ui && \ + adduser -h /var/cache/nginx -g ui -s /bin/sh -G ui -D -H -u 101 ui + +# Fix CVEs +RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 +RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 + # Copy dependencies COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb WORKDIR /usr/share/bunkerweb -# Add ui user, install runtime dependencies, create data folders and set permissions -RUN apk add --no-cache bash unzip libmagic mariadb-connector-c mariadb-client postgresql-client sqlite && \ - addgroup -g 101 ui && \ - adduser -h /var/cache/nginx -g ui -s /bin/sh -G ui -D -H -u 101 ui && \ - echo "Docker" > INTEGRATION && \ +# Create data folders and set permissions +RUN echo "Docker" > INTEGRATION && \ mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ mkdir -p /data/lib && ln -s /data/lib /var/lib/bunkerweb && \ @@ -77,10 +83,6 @@ RUN apk add --no-cache bash unzip libmagic mariadb-connector-c mariadb-client po ln -s /proc/1/fd/1 /var/log/bunkerweb/ui-access.log && \ ln -s /proc/1/fd/2 /var/log/bunkerweb/ui.log -# Fix CVEs -RUN apk add --no-cache "busybox>=1.36.1-r17" "busybox-binsh>=1.36.1-r17" "ssl_client>=1.36.1-r17" # CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 -RUN apk add --no-cache "libcrypto3>=3.1.6-r0" "libssl3>=3.1.6-r0" # CVE-2024-4741 CVE-2024-5535 - LABEL maintainer="Bunkerity " LABEL version="1.5.9" LABEL url="https://www.bunkerweb.io"