-
Notifications
You must be signed in to change notification settings - Fork 489
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
docker entrypoint/configuration fixes + refactoring (#1959)
- Loading branch information
Showing
6 changed files
with
119 additions
and
210 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| # We include .git in the build context because excluding it would break the | ||
| # "make release" target, which uses git to retrieve the build version and tag. | ||
| #.git | ||
| /tests/ansible |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,105 +4,37 @@ ARG GOVERSION=1.19 | |
|
|
||
| FROM golang:${GOVERSION}-alpine AS build | ||
|
|
||
| RUN go install github.com/mikefarah/yq/[email protected] | ||
|
|
||
| WORKDIR /go/src/crowdsec | ||
|
|
||
| COPY . . | ||
|
|
||
| # wizard.sh requires GNU coreutils | ||
| RUN apk add --no-cache git gcc libc-dev make bash gettext binutils-gold coreutils && \ | ||
| echo "githubciXXXXXXXXXXXXXXXXXXXXXXXX" > /etc/machine-id && \ | ||
| SYSTEM="docker" make clean release && \ | ||
| cd crowdsec-v* && \ | ||
| ./wizard.sh --docker-mode && \ | ||
| cd - && \ | ||
| cd - >/dev/null && \ | ||
| cscli hub update && \ | ||
| cscli collections install crowdsecurity/linux && \ | ||
| cscli parsers install crowdsecurity/whitelists | ||
|
|
||
| FROM alpine:latest as build-slim | ||
|
|
||
| RUN apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community tzdata yq bash && \ | ||
| RUN apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community tzdata bash && \ | ||
| mkdir -p /staging/etc/crowdsec && \ | ||
| mkdir -p /staging/var/lib/crowdsec && \ | ||
| mkdir -p /var/lib/crowdsec/data \ | ||
| yq -n '.url="http://0.0.0.0:8080"' | install -m 0600 /dev/stdin /staging/etc/crowdsec/local_api_credentials.yaml | ||
| mkdir -p /var/lib/crowdsec/data | ||
|
|
||
| COPY --from=build /go/bin/yq /usr/local/bin/yq | ||
| COPY --from=build /etc/crowdsec /staging/etc/crowdsec | ||
| COPY --from=build /usr/local/bin/crowdsec /usr/local/bin/crowdsec | ||
| COPY --from=build /usr/local/bin/cscli /usr/local/bin/cscli | ||
| COPY --from=build /go/src/crowdsec/docker/docker_start.sh / | ||
| COPY --from=build /go/src/crowdsec/docker/config.yaml /staging/etc/crowdsec/config.yaml | ||
|
|
||
| # NOTE: setting default values here would overwrite the ones set in config.yaml | ||
| # every time the container is started. We set the default in docker/config.yaml | ||
| # and document them in docker/README.md, but keep the variables empty here. | ||
|
|
||
| ENV CONFIG_FILE=/etc/crowdsec/config.yaml | ||
| ENV LOCAL_API_URL= | ||
| ENV CUSTOM_HOSTNAME=localhost | ||
| ENV PLUGIN_DIR= | ||
| ENV DISABLE_AGENT=false | ||
| ENV DISABLE_LOCAL_API=false | ||
| ENV DISABLE_ONLINE_API=false | ||
| ENV DSN= | ||
| ENV TYPE= | ||
| ENV TEST_MODE=false | ||
| ENV USE_WAL= | ||
|
|
||
| # register to app.crowdsec.net | ||
|
|
||
| ENV ENROLL_INSTANCE_NAME= | ||
| ENV ENROLL_KEY= | ||
| ENV ENROLL_TAGS= | ||
|
|
||
| # log verbosity | ||
|
|
||
| ENV LEVEL_TRACE= | ||
| ENV LEVEL_DEBUG= | ||
| ENV LEVEL_INFO= | ||
|
|
||
| # TLS setup ----------------------------------- # | ||
|
|
||
| ENV AGENT_USERNAME= | ||
| ENV AGENT_PASSWORD= | ||
|
|
||
| # TLS setup ----------------------------------- # | ||
|
|
||
| ENV USE_TLS=false | ||
| ENV INSECURE_SKIP_VERIFY= | ||
|
|
||
| ENV CACERT_FILE= | ||
|
|
||
| ENV LAPI_CERT_FILE= | ||
| ENV LAPI_KEY_FILE= | ||
|
|
||
| ENV CLIENT_CERT_FILE= | ||
| ENV CLIENT_KEY_FILE= | ||
|
|
||
| # deprecated in favor of LAPI_* | ||
| ENV CERT_FILE= | ||
| ENV KEY_FILE= | ||
|
|
||
| # comma-separated list of allowed OU values for TLS bouncer certificates | ||
| ENV BOUNCERS_ALLOWED_OU= | ||
|
|
||
| # comma-separated list of allowed OU values for TLS agent certificates | ||
| ENV AGENTS_ALLOWED_OU= | ||
|
|
||
| # Install the following hub items --------------# | ||
|
|
||
| ENV COLLECTIONS= | ||
| ENV PARSERS= | ||
| ENV SCENARIOS= | ||
| ENV POSTOVERFLOWS= | ||
|
|
||
| # Uninstall the following hub items ------------# | ||
|
|
||
| ENV DISABLE_COLLECTIONS= | ||
| ENV DISABLE_PARSERS= | ||
| ENV DISABLE_SCENARIOS= | ||
| ENV DISABLE_POSTOVERFLOWS= | ||
|
|
||
| ENV METRICS_PORT= | ||
| RUN yq -n '.url="http://0.0.0.0:8080"' | install -m 0600 /dev/stdin /staging/etc/crowdsec/local_api_credentials.yaml | ||
|
|
||
| ENTRYPOINT /bin/bash docker_start.sh | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,8 @@ ARG GOVERSION=1.19 | |
|
|
||
| FROM golang:${GOVERSION}-bullseye AS build | ||
|
|
||
| RUN go install github.com/mikefarah/yq/[email protected] | ||
|
|
||
| WORKDIR /go/src/crowdsec | ||
|
|
||
| COPY . . | ||
|
|
@@ -14,17 +16,20 @@ ENV DEBCONF_NOWARNINGS="yes" | |
| # wizard.sh requires GNU coreutils | ||
| RUN apt-get update && \ | ||
| apt-get install -y -q git gcc libc-dev make bash gettext binutils-gold coreutils tzdata && \ | ||
| SYSTEM="docker" make release && \ | ||
| echo "githubciXXXXXXXXXXXXXXXXXXXXXXXX" > /etc/machine-id && \ | ||
| SYSTEM="docker" make clean release && \ | ||
| cd crowdsec-v* && \ | ||
| ./wizard.sh --docker-mode && \ | ||
| cd - && \ | ||
| cd - >/dev/null && \ | ||
| cscli hub update && \ | ||
| cscli collections install crowdsecurity/linux && \ | ||
| cscli parsers install crowdsecurity/whitelists && \ | ||
| go install github.com/mikefarah/yq/[email protected] | ||
| cscli parsers install crowdsecurity/whitelists | ||
|
|
||
| FROM debian:bullseye-slim as build-slim | ||
|
|
||
| ENV DEBIAN_FRONTEND=noninteractive | ||
| ENV DEBCONF_NOWARNINGS="yes" | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y -q --install-recommends --no-install-suggests \ | ||
| procps \ | ||
|
|
@@ -35,88 +40,17 @@ RUN apt-get update && \ | |
| tzdata && \ | ||
| mkdir -p /staging/etc/crowdsec && \ | ||
| mkdir -p /staging/var/lib/crowdsec && \ | ||
| mkdir -p /var/lib/crowdsec/data \ | ||
| yq -n '.url="http://0.0.0.0:8080"' | install -m 0600 /dev/stdin /staging/etc/crowdsec/local_api_credentials.yaml | ||
| mkdir -p /var/lib/crowdsec/data | ||
|
|
||
| COPY --from=build /go/bin/yq /usr/local/bin/yq | ||
| COPY --from=build /etc/crowdsec /staging/etc/crowdsec | ||
| COPY --from=build /usr/local/bin/crowdsec /usr/local/bin/crowdsec | ||
| COPY --from=build /usr/local/bin/cscli /usr/local/bin/cscli | ||
| COPY --from=build /go/src/crowdsec/docker/docker_start.sh / | ||
| COPY --from=build /go/src/crowdsec/docker/config.yaml /staging/etc/crowdsec/config.yaml | ||
| RUN yq eval -i ".plugin_config.group = \"nogroup\"" /staging/etc/crowdsec/config.yaml | ||
|
|
||
| # NOTE: setting default values here would overwrite the ones set in config.yaml | ||
| # every time the container is started. We set the default in docker/config.yaml | ||
| # and document them in docker/README.md, but keep the variables empty here. | ||
|
|
||
| ENV CONFIG_FILE=/etc/crowdsec/config.yaml | ||
| ENV LOCAL_API_URL= | ||
| ENV CUSTOM_HOSTNAME=localhost | ||
| ENV PLUGIN_DIR= | ||
| ENV DISABLE_AGENT=false | ||
| ENV DISABLE_LOCAL_API=false | ||
| ENV DISABLE_ONLINE_API=false | ||
| ENV DSN= | ||
| ENV TYPE= | ||
| ENV TEST_MODE=false | ||
| ENV USE_WAL= | ||
|
|
||
| # register to app.crowdsec.net | ||
|
|
||
| ENV ENROLL_INSTANCE_NAME= | ||
| ENV ENROLL_KEY= | ||
| ENV ENROLL_TAGS= | ||
|
|
||
| # log verbosity | ||
|
|
||
| ENV LEVEL_TRACE= | ||
| ENV LEVEL_DEBUG= | ||
| ENV LEVEL_INFO= | ||
|
|
||
| # TLS setup ----------------------------------- # | ||
|
|
||
| ENV AGENT_USERNAME= | ||
| ENV AGENT_PASSWORD= | ||
|
|
||
| # TLS setup ----------------------------------- # | ||
|
|
||
| ENV USE_TLS=false | ||
| ENV INSECURE_SKIP_VERIFY= | ||
|
|
||
| ENV CACERT_FILE= | ||
|
|
||
| ENV LAPI_CERT_FILE= | ||
| ENV LAPI_KEY_FILE= | ||
|
|
||
| ENV CLIENT_CERT_FILE= | ||
| ENV CLIENT_KEY_FILE= | ||
|
|
||
| # deprecated in favor of LAPI_* | ||
| ENV CERT_FILE= | ||
| ENV KEY_FILE= | ||
|
|
||
| # comma-separated list of allowed OU values for TLS bouncer certificates | ||
| ENV BOUNCERS_ALLOWED_OU= | ||
|
|
||
| # comma-separated list of allowed OU values for TLS agent certificates | ||
| ENV AGENTS_ALLOWED_OU= | ||
|
|
||
| # Install the following hub items --------------# | ||
|
|
||
| ENV COLLECTIONS= | ||
| ENV PARSERS= | ||
| ENV SCENARIOS= | ||
| ENV POSTOVERFLOWS= | ||
|
|
||
| # Uninstall the following hub items ------------# | ||
|
|
||
| ENV DISABLE_COLLECTIONS= | ||
| ENV DISABLE_PARSERS= | ||
| ENV DISABLE_SCENARIOS= | ||
| ENV DISABLE_POSTOVERFLOWS= | ||
| RUN yq -n '.url="http://0.0.0.0:8080"' | install -m 0600 /dev/stdin /staging/etc/crowdsec/local_api_credentials.yaml && \ | ||
| yq eval -i ".plugin_config.group = \"nogroup\"" /staging/etc/crowdsec/config.yaml | ||
|
|
||
| ENV METRICS_PORT= | ||
|
|
||
| ENTRYPOINT /bin/bash docker_start.sh | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.