mirror of
https://github.com/bunkerity/bunkerweb
synced 2026-05-24 09:28:37 +00:00
Refactor Dockerfiles + use nginx:1.24.0-alpine-slim now for bw
This commit is contained in:
Théophile Diot
parent
e393a7be8e
commit
741f779a91
4 changed files with 48 additions and 89 deletions
|
|
@ -1,27 +1,19 @@
|
|||
FROM python:3.12.2-alpine3.19@sha256:1a0501213b470de000d8432b3caab9d8de5489e9443c2cc7ccaa6b0aa5c3148e as builder
|
||||
|
||||
# Install python dependencies
|
||||
RUN apk add --no-cache build-base postgresql-dev
|
||||
|
||||
# Copy python requirements
|
||||
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements.txt
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements.txt.1
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements-gen.txt
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements-db.txt
|
||||
|
||||
WORKDIR /usr/share/bunkerweb
|
||||
|
||||
RUN mkdir -p deps/python && \
|
||||
cat /tmp/req/requirements.txt* > deps/requirements.txt && \
|
||||
rm -rf /tmp/req
|
||||
|
||||
# Install python dependencies
|
||||
RUN apk add --no-cache --virtual .build-deps g++ gcc musl-dev jpeg-dev zlib-dev libffi-dev cairo-dev pango-dev gdk-pixbuf-dev openssl-dev cargo postgresql-dev
|
||||
|
||||
# Install python requirements
|
||||
RUN export MAKEFLAGS="-j$(nproc)" && \
|
||||
pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt
|
||||
|
||||
# Remove build dependencies
|
||||
RUN apk del .build-deps && \
|
||||
rm -rf /var/cache/apk/*
|
||||
pip install --no-cache-dir --require-hashes --break-system-packages -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python $(for file in $(ls /tmp/req/requirements*.txt) ; do echo "-r ${file}" ; done | xargs)
|
||||
|
||||
# Copy files
|
||||
# can't exclude specific files/dir from . so we are copying everything by hand
|
||||
|
|
@ -49,9 +41,8 @@ RUN apk add --no-cache bash && \
|
|||
addgroup -g 101 autoconf && \
|
||||
adduser -h /var/cache/autoconf -g autoconf -s /bin/sh -G autoconf -D -H -u 101 autoconf && \
|
||||
cp helpers/bwcli /usr/bin/ && \
|
||||
mkdir -p /var/tmp/bunkerweb && \
|
||||
mkdir -p /var/www && \
|
||||
mkdir -p /etc/bunkerweb && \
|
||||
echo "Docker" > INTEGRATION && \
|
||||
mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \
|
||||
mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \
|
||||
mkdir -p /data/lib && ln -s /data/lib /var/lib/bunkerweb && \
|
||||
mkdir -p /data/www && ln -s /data/www /var/www/html && \
|
||||
|
|
@ -59,14 +50,15 @@ RUN apk add --no-cache bash && \
|
|||
for dir in $(echo "configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \
|
||||
chown -R root:autoconf /data && \
|
||||
chmod -R 770 /data && \
|
||||
chown -R root:autoconf /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /usr/bin/bwcli && \
|
||||
chown -R root:autoconf INTEGRATION /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /usr/bin/bwcli && \
|
||||
chmod -R 770 /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb && \
|
||||
chmod 750 cli/main.py helpers/*.sh /usr/bin/bwcli autoconf/main.py deps/python/bin/*
|
||||
chmod 750 cli/main.py helpers/*.sh /usr/bin/bwcli autoconf/main.py deps/python/bin/* && \
|
||||
chmod 660 INTEGRATION
|
||||
|
||||
# Fix CVEs
|
||||
RUN apk add --no-cache "libexpat>=2.6.0-r0"
|
||||
|
||||
VOLUME /data /etc/nginx
|
||||
VOLUME /data
|
||||
|
||||
WORKDIR /usr/share/bunkerweb/autoconf
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
FROM nginx:1.24.0-alpine@sha256:6845649eadc1f0a5dacaf5bb3f01b480ce200ae1249114be11fef9d389196eaf AS builder
|
||||
FROM nginx:1.24.0-alpine-slim@sha256:9cec4fd40a4e5156b4f4f555ee44a597491b6e8b91380c32b63ed45a4053a763 AS builder
|
||||
|
||||
# Install temporary requirements for the dependencies
|
||||
RUN apk add --no-cache --virtual .build-deps bash autoconf libtool automake geoip-dev g++ gcc curl-dev libxml2-dev pcre-dev make linux-headers musl-dev gd-dev gnupg brotli-dev openssl-dev patch readline-dev yajl yajl-dev yajl-tools py3-pip
|
||||
RUN apk add --no-cache bash autoconf libtool automake geoip-dev g++ gcc curl-dev libxml2-dev pcre-dev make linux-headers musl-dev gd-dev gnupg brotli-dev openssl-dev patch readline-dev yajl yajl-dev yajl-tools py3-pip
|
||||
|
||||
WORKDIR /tmp/bunkerweb/deps
|
||||
|
||||
|
|
@ -9,27 +9,21 @@ WORKDIR /tmp/bunkerweb/deps
|
|||
COPY src/deps/misc misc
|
||||
COPY src/deps/src src
|
||||
COPY src/deps/deps.json deps.json
|
||||
COPY src/deps/install.sh install.sh
|
||||
COPY --chmod=644 src/deps/install.sh install.sh
|
||||
|
||||
# Compile and install dependencies
|
||||
RUN mkdir -p /usr/share/bunkerweb/deps/python && \
|
||||
chmod +x install.sh && \
|
||||
bash install.sh
|
||||
RUN bash install.sh
|
||||
|
||||
WORKDIR /usr/share/bunkerweb
|
||||
|
||||
# Copy python requirements
|
||||
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
|
||||
COPY src/common/gen/requirements.txt deps/requirements.txt
|
||||
COPY src/common/gen/requirements.txt deps/requirements-gen.txt
|
||||
|
||||
# Install python requirements
|
||||
RUN export MAKEFLAGS="-j$(nproc)" && \
|
||||
pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt
|
||||
|
||||
# Clean up temporary dependencies
|
||||
RUN apk del .build-deps && \
|
||||
rm -rf /var/cache/apk/*
|
||||
pip install --no-cache-dir --require-hashes --ignore-installed -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements-gen.txt
|
||||
|
||||
# Copy files
|
||||
# can't exclude deps from . so we are copying everything by hand
|
||||
|
|
@ -48,7 +42,7 @@ COPY src/common/utils utils
|
|||
COPY src/VERSION VERSION
|
||||
COPY misc/*.ascii misc/
|
||||
|
||||
FROM nginx:1.24.0-alpine@sha256:76ca7f6bfe01c3e22e3af85fd37c30149ece3ac2a444973687cab1765abca115
|
||||
FROM nginx:1.24.0-alpine-slim@sha256:9cec4fd40a4e5156b4f4f555ee44a597491b6e8b91380c32b63ed45a4053a763
|
||||
|
||||
# Set default umask to prevent huge recursive chmod increasing the final image size
|
||||
RUN umask 027
|
||||
|
|
@ -59,13 +53,9 @@ COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb
|
|||
WORKDIR /usr/share/bunkerweb
|
||||
|
||||
# Install runtime dependencies, pypi packages, move bwcli, create data folders and set permissions
|
||||
RUN apk add --no-cache pcre bash python3 yajl && \
|
||||
RUN apk add --no-cache openssl pcre bash python3 yajl geoip libxml2 libgd && \
|
||||
cp helpers/bwcli /usr/bin/ && \
|
||||
mkdir -p /var/tmp/bunkerweb && \
|
||||
mkdir -p /var/run/bunkerweb && \
|
||||
mkdir -p /var/log/bunkerweb && \
|
||||
mkdir -p /var/www/html && \
|
||||
mkdir -p /etc/bunkerweb && \
|
||||
mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www/html && \
|
||||
mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \
|
||||
for dir in $(echo "pro configs plugins") ; do mkdir -p "/data/${dir}" && ln -s "/data/${dir}" "/etc/bunkerweb/${dir}" ; done && \
|
||||
for dir in $(echo "pro/plugins configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \
|
||||
|
|
@ -80,6 +70,8 @@ RUN apk add --no-cache pcre bash python3 yajl && \
|
|||
# Fix CVEs
|
||||
RUN apk add --no-cache "curl>=8.5.0-r0" "libcurl>=8.5.0-r0" "libcrypto3>=3.0.12-r4" "libexpat>=2.6.0-r0" "libssl3>=3.0.12-r4" "libwebp>=1.2.4-r3" "libx11>=1.8.7-r0" "nghttp2-libs>=1.51.0-r2"
|
||||
|
||||
VOLUME /data /etc/nginx
|
||||
|
||||
EXPOSE 8080/tcp 8443/tcp
|
||||
|
||||
USER nginx:nginx
|
||||
|
|
|
|||
|
|
@ -1,28 +1,20 @@
|
|||
FROM python:3.12.2-alpine3.19@sha256:1a0501213b470de000d8432b3caab9d8de5489e9443c2cc7ccaa6b0aa5c3148e as builder
|
||||
|
||||
# Install python dependencies
|
||||
RUN apk add --no-cache --virtual .build-deps g++ gcc musl-dev jpeg-dev zlib-dev libffi-dev cairo-dev pango-dev gdk-pixbuf-dev openssl-dev cargo postgresql-dev
|
||||
RUN apk add --no-cache build-base postgresql-dev
|
||||
|
||||
# Copy python requirements
|
||||
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
|
||||
COPY src/scheduler/requirements.txt /tmp/req/requirements.txt
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements.txt.1
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements.txt.2
|
||||
COPY src/scheduler/requirements.txt /tmp/req/requirements-scheduler.txt
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements-gen.txt
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements-db.txt
|
||||
|
||||
WORKDIR /usr/share/bunkerweb
|
||||
|
||||
RUN mkdir -p deps/python && \
|
||||
cat /tmp/req/requirements.txt* > deps/requirements.txt && \
|
||||
rm -rf /tmp/req
|
||||
|
||||
# Install python requirements
|
||||
RUN export MAKEFLAGS="-j$(nproc)" && \
|
||||
pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt
|
||||
|
||||
# Remove build dependencies
|
||||
RUN apk del .build-deps && \
|
||||
rm -rf /var/cache/apk/*
|
||||
pip install --no-cache-dir --require-hashes --break-system-packages -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python $(for file in $(ls /tmp/req/requirements*.txt) ; do echo "-r ${file}" ; done | xargs)
|
||||
|
||||
# Copy files
|
||||
# can't exclude specific files/dir from . so we are copying everything by hand
|
||||
|
|
@ -54,22 +46,19 @@ RUN apk add --no-cache bash libgcc libstdc++ libpq openssl libmagic && \
|
|||
adduser -h /var/cache/nginx -g scheduler -s /bin/sh -G scheduler -D -H -u 101 scheduler && \
|
||||
cp helpers/bwcli /usr/bin/ && \
|
||||
echo "Docker" > INTEGRATION && \
|
||||
mkdir -p /etc/nginx && \
|
||||
mkdir -p /var/tmp/bunkerweb && \
|
||||
mkdir -p /var/run/bunkerweb && \
|
||||
mkdir -p /var/log/bunkerweb && \
|
||||
mkdir -p /var/www && \
|
||||
mkdir -p /etc/bunkerweb && \
|
||||
mkdir -p /etc/nginx /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \
|
||||
mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \
|
||||
mkdir -p /data/lib && ln -s /data/lib /var/lib/bunkerweb && \
|
||||
for dir in $(echo "pro configs plugins") ; do mkdir -p "/data/${dir}" && ln -s "/data/${dir}" "/etc/bunkerweb/${dir}" ; done && \
|
||||
for dir in $(echo "pro/plugins configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \
|
||||
chown -R root:scheduler /data /etc/nginx /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /usr/bin/bwcli && \
|
||||
chown -R root:scheduler INTEGRATION /data /etc/nginx /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /usr/bin/bwcli && \
|
||||
chmod -R 770 /data /etc/nginx /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb && \
|
||||
find core/*/jobs/* -type f -exec chmod 750 {} \; && \
|
||||
chmod 750 cli/main.py gen/*.py scheduler/main.py scheduler/entrypoint.sh helpers/*.sh deps/python/bin/* /usr/bin/bwcli && \
|
||||
chmod 660 INTEGRATION && \
|
||||
chown root:scheduler INTEGRATION
|
||||
chmod 660 INTEGRATION
|
||||
|
||||
# Cleanup
|
||||
RUN rm -rf /var/cache/apk/*
|
||||
|
||||
COPY --chown=root:scheduler src/bw/misc/asn.mmdb /var/tmp/bunkerweb/asn.mmdb
|
||||
COPY --chown=root:scheduler src/bw/misc/country.mmdb /var/tmp/bunkerweb/country.mmdb
|
||||
|
|
@ -79,7 +68,7 @@ RUN chmod 770 /var/tmp/bunkerweb/asn.mmdb /var/tmp/bunkerweb/country.mmdb
|
|||
# Fix CVEs
|
||||
RUN apk add --no-cache "libexpat>=2.6.0-r0"
|
||||
|
||||
VOLUME /data /etc/nginx
|
||||
VOLUME /data
|
||||
|
||||
WORKDIR /usr/share/bunkerweb/scheduler
|
||||
|
||||
|
|
|
|||
|
|
@ -1,28 +1,20 @@
|
|||
FROM python:3.12.2-alpine3.19@sha256:1a0501213b470de000d8432b3caab9d8de5489e9443c2cc7ccaa6b0aa5c3148e as builder
|
||||
|
||||
# Install python dependencies
|
||||
RUN apk add --no-cache --virtual .build-deps g++ gcc musl-dev jpeg-dev zlib-dev libffi-dev cairo-dev pango-dev gdk-pixbuf-dev openssl-dev cargo postgresql-dev file make
|
||||
RUN apk add --no-cache build-base postgresql-dev
|
||||
|
||||
# Copy python requirements
|
||||
COPY src/deps/requirements.txt /tmp/requirements-deps.txt
|
||||
COPY src/ui/requirements.txt /tmp/req/requirements.txt
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements.txt.1
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements.txt.2
|
||||
COPY src/ui/requirements.txt /tmp/req/requirements-ui.txt
|
||||
COPY src/common/gen/requirements.txt /tmp/req/requirements-gen.txt
|
||||
COPY src/common/db/requirements.txt /tmp/req/requirements-db.txt
|
||||
|
||||
WORKDIR /usr/share/bunkerweb
|
||||
|
||||
RUN mkdir -p deps/python && \
|
||||
cat /tmp/req/requirements.txt* > deps/requirements.txt && \
|
||||
rm -rf /tmp/req
|
||||
|
||||
# Install python requirements
|
||||
RUN export MAKEFLAGS="-j$(nproc)" && \
|
||||
pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt
|
||||
|
||||
# Remove build dependencies
|
||||
RUN apk del .build-deps && \
|
||||
rm -rf /var/cache/apk/*
|
||||
pip install --no-cache-dir --require-hashes --break-system-packages -r /tmp/requirements-deps.txt && \
|
||||
pip install --no-cache-dir --require-hashes --target deps/python $(for file in $(ls /tmp/req/requirements*.txt) ; do echo "-r ${file}" ; done | xargs)
|
||||
|
||||
# Copy files
|
||||
# can't exclude specific files/dir from . so we are copying everything by hand
|
||||
|
|
@ -51,28 +43,22 @@ RUN apk add --no-cache bash && \
|
|||
addgroup -g 101 ui && \
|
||||
adduser -h /var/cache/nginx -g ui -s /bin/sh -G ui -D -H -u 101 ui && \
|
||||
echo "Docker" > INTEGRATION && \
|
||||
mkdir -p /var/tmp/bunkerweb && \
|
||||
mkdir -p /var/run/bunkerweb && \
|
||||
mkdir -p /etc/bunkerweb && \
|
||||
mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \
|
||||
mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \
|
||||
mkdir -p /data/lib && ln -s /data/lib /var/lib/bunkerweb && \
|
||||
mkdir -p /var/log/bunkerweb/ && \
|
||||
for dir in $(echo "pro configs plugins") ; do mkdir -p "/data/${dir}" && ln -s "/data/${dir}" "/etc/bunkerweb/${dir}" ; done && \
|
||||
for dir in $(echo "pro/plugins configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \
|
||||
chown -R root:ui /data && \
|
||||
chmod -R 770 /data && \
|
||||
chown -R root:ui INTEGRATION /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb && \
|
||||
chmod 770 /var/cache/bunkerweb /var/lib/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb && \
|
||||
chown -R root:ui INTEGRATION /data /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb && \
|
||||
chmod 770 /data /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb && \
|
||||
chmod 750 gen/*.py ui/*.py ui/src/*.py deps/python/bin/* helpers/*.sh && \
|
||||
chmod 660 INTEGRATION && \
|
||||
chown root:ui INTEGRATION && \
|
||||
ln -s /proc/1/fd/1 /var/log/bunkerweb/ui-access.log && \
|
||||
ln -s /proc/1/fd/2 /var/log/bunkerweb/ui.log
|
||||
|
||||
# Fix CVEs
|
||||
RUN apk add --no-cache "libexpat>=2.6.0-r0"
|
||||
|
||||
VOLUME /data /etc/nginx
|
||||
VOLUME /data
|
||||
|
||||
EXPOSE 7000
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue