2019-05-22 23:49:55 +00:00
|
|
|
# syntax=docker/dockerfile:1.1.3-experimental
|
2013-09-07 02:58:05 +00:00
|
|
|
|
2019-04-06 00:20:06 +00:00
|
|
|
ARG CROSS="false"
|
bump golang 1.13.1 (CVE-2019-16276)
full diff: https://github.com/golang/go/compare/go1.13...go1.13.1
```
Hi gophers,
We have just released Go 1.13.1 and Go 1.12.10 to address a recently reported security issue. We recommend that all affected users update to one of these releases (if you're not sure which, choose Go 1.13.1).
net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.
The issue is CVE-2019-16276 and Go issue golang.org/issue/34540.
Thanks to Andrew Stucki, Adam Scarr (99designs.com), and Jan Masarik (masarik.sh) for discovering and reporting this issue.
Downloads are available at https://golang.org/dl for all supported platforms.
Alla prossima,
Filippo on behalf of the Go team
```
From the patch: https://github.com/golang/go/commit/6e6f4aaf70c8b1cc81e65a26332aa9409de03ad8
```
net/textproto: don't normalize headers with spaces before the colon
RFC 7230 is clear about headers with a space before the colon, like
X-Answer : 42
being invalid, but we've been accepting and normalizing them for compatibility
purposes since CL 5690059 in 2012.
On the client side, this is harmless and indeed most browsers behave the same
to this day. On the server side, this becomes a security issue when the
behavior doesn't match that of a reverse proxy sitting in front of the server.
For example, if a WAF accepts them without normalizing them, it might be
possible to bypass its filters, because the Go server would interpret the
header differently. Worse, if the reverse proxy coalesces requests onto a
single HTTP/1.1 connection to a Go server, the understanding of the request
boundaries can get out of sync between them, allowing an attacker to tack an
arbitrary method and path onto a request by other clients, including
authentication headers unknown to the attacker.
This was recently presented at multiple security conferences:
https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn
net/http servers already reject header keys with invalid characters.
Simply stop normalizing extra spaces in net/textproto, let it return them
unchanged like it does for other invalid headers, and let net/http enforce
RFC 7230, which is HTTP specific. This loses us normalization on the client
side, but there's no right answer on the client side anyway, and hiding the
issue sounds worse than letting the application decide.
```
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-09-27 12:26:12 +00:00
|
|
|
ARG GO_VERSION=1.13.1
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
2019-10-05 20:46:49 +00:00
|
|
|
ARG VPNKIT_DIGEST=e508a17cfacc8fd39261d5b4e397df2b953690da577e2c987a47630cd0c42f8e
|
2019-04-06 00:20:06 +00:00
|
|
|
|
2019-07-20 08:32:08 +00:00
|
|
|
FROM golang:${GO_VERSION}-stretch AS base
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
|
2019-07-16 10:16:56 +00:00
|
|
|
ARG APT_MIRROR
|
|
|
|
|
RUN sed -ri "s/(httpredir|deb).debian.org/${APT_MIRROR:-deb.debian.org}/g" /etc/apt/sources.list \
|
|
|
|
|
&& sed -ri "s/(security).debian.org/${APT_MIRROR:-security.debian.org}/g" /etc/apt/sources.list
|
2019-09-11 07:36:53 +00:00
|
|
|
ENV GO111MODULE=off
|
2016-11-20 22:14:51 +00:00
|
|
|
|
2017-09-29 21:09:14 +00:00
|
|
|
FROM base AS criu
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-05-22 23:49:55 +00:00
|
|
|
# Install dependency packages specific to criu
|
|
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-criu-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-criu-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
libnet-dev \
|
|
|
|
|
libprotobuf-c-dev \
|
|
|
|
|
libprotobuf-dev \
|
|
|
|
|
libnl-3-dev \
|
|
|
|
|
libcap-dev \
|
|
|
|
|
protobuf-compiler \
|
|
|
|
|
protobuf-c-compiler \
|
|
|
|
|
python-protobuf
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2016-05-12 14:52:00 +00:00
|
|
|
# Install CRIU for checkpoint/restore support
|
2019-08-14 18:43:52 +00:00
|
|
|
ENV CRIU_VERSION 3.12
|
2019-07-30 23:49:57 +00:00
|
|
|
RUN mkdir -p /usr/src/criu \
|
2019-10-05 20:41:27 +00:00
|
|
|
&& curl -sSL https://github.com/checkpoint-restore/criu/archive/v${CRIU_VERSION}.tar.gz | tar -C /usr/src/criu/ -xz --strip-components=1 \
|
|
|
|
|
&& cd /usr/src/criu \
|
|
|
|
|
&& make \
|
|
|
|
|
&& make PREFIX=/build/ install-criu
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2018-02-27 08:20:55 +00:00
|
|
|
FROM base AS registry
|
2019-06-17 21:50:31 +00:00
|
|
|
# Install two versions of the registry. The first is an older version that
|
|
|
|
|
# only supports schema1 manifests. The second is a newer version that supports
|
|
|
|
|
# both. This allows integration-cli tests to cover push/pull with both schema1
|
|
|
|
|
# and schema2 manifests.
|
|
|
|
|
ENV REGISTRY_COMMIT_SCHEMA1 ec87e9b6971d831f0eff752ddb54fb64693e51cd
|
2016-01-19 21:28:51 +00:00
|
|
|
ENV REGISTRY_COMMIT 47a064d4195a9b56133891bbb13620c3ac83a827
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
set -x \
|
|
|
|
|
&& export GOPATH="$(mktemp -d)" \
|
|
|
|
|
&& git clone https://github.com/docker/distribution.git "$GOPATH/src/github.com/docker/distribution" \
|
|
|
|
|
&& (cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT") \
|
|
|
|
|
&& GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH" \
|
|
|
|
|
go build -buildmode=pie -o /build/registry-v2 github.com/docker/distribution/cmd/registry \
|
|
|
|
|
&& case $(dpkg --print-architecture) in \
|
|
|
|
|
amd64|ppc64*|s390x) \
|
|
|
|
|
(cd "$GOPATH/src/github.com/docker/distribution" && git checkout -q "$REGISTRY_COMMIT_SCHEMA1"); \
|
|
|
|
|
GOPATH="$GOPATH/src/github.com/docker/distribution/Godeps/_workspace:$GOPATH"; \
|
|
|
|
|
go build -buildmode=pie -o /build/registry-v2-schema1 github.com/docker/distribution/cmd/registry; \
|
|
|
|
|
;; \
|
|
|
|
|
esac \
|
|
|
|
|
&& rm -rf "$GOPATH"
|
2015-01-21 03:40:19 +00:00
|
|
|
|
2018-02-27 08:20:55 +00:00
|
|
|
FROM base AS swagger
|
2016-11-03 17:15:27 +00:00
|
|
|
# Install go-swagger for validating swagger.yaml
|
2019-10-04 01:57:29 +00:00
|
|
|
# This is https://github.com/kolyshkin/go-swagger/tree/golang-1.13-fix
|
|
|
|
|
# TODO: move to under moby/ or fix upstream go-swagger to work for us.
|
|
|
|
|
ENV GO_SWAGGER_COMMIT 5793aa66d4b4112c2602c716516e24710e4adbb5
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
set -x \
|
|
|
|
|
&& export GOPATH="$(mktemp -d)" \
|
|
|
|
|
&& git clone https://github.com/kolyshkin/go-swagger.git "$GOPATH/src/github.com/go-swagger/go-swagger" \
|
|
|
|
|
&& (cd "$GOPATH/src/github.com/go-swagger/go-swagger" && git checkout -q "$GO_SWAGGER_COMMIT") \
|
|
|
|
|
&& go build -o /build/swagger github.com/go-swagger/go-swagger/cmd/swagger \
|
|
|
|
|
&& rm -rf "$GOPATH"
|
2016-11-03 17:15:27 +00:00
|
|
|
|
2018-02-27 08:20:55 +00:00
|
|
|
FROM base AS frozen-images
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-frozen-images-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-frozen-images-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
ca-certificates \
|
|
|
|
|
jq
|
2015-03-07 01:12:41 +00:00
|
|
|
# Get useful and necessary Hub images so we can "docker load" locally instead of pulling
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY contrib/download-frozen-image-v2.sh /
|
2018-04-13 18:45:57 +00:00
|
|
|
RUN /download-frozen-image-v2.sh /build \
|
2019-10-05 20:41:27 +00:00
|
|
|
buildpack-deps:jessie@sha256:dd86dced7c9cd2a724e779730f0a53f93b7ef42228d4344b25ce9a42a1486251 \
|
|
|
|
|
busybox:latest@sha256:bbc3a03235220b170ba48a157dd097dd1379299370e1ed99ce976df0355d24f0 \
|
|
|
|
|
busybox:glibc@sha256:0b55a30394294ab23b9afd58fab94e61a923f5834fba7ddbae7f8e0c11ba85e6 \
|
|
|
|
|
debian:jessie@sha256:287a20c5f73087ab406e6b364833e3fb7b3ae63ca0eb3486555dc27ed32c6e60 \
|
|
|
|
|
hello-world:latest@sha256:be0cd392e45be79ffeffa6b05338b98ebb16c87b255f48e297ec7f98e123905c
|
2016-12-31 19:11:30 +00:00
|
|
|
# See also ensureFrozenImagesLinux() in "integration-cli/fixtures_linux_daemon_test.go" (which needs to be updated when adding images to this list)
|
2015-02-28 05:53:36 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM base AS cross-false
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-10-08 17:54:39 +00:00
|
|
|
FROM --platform=linux/amd64 base AS cross-true
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-04-06 00:20:06 +00:00
|
|
|
RUN dpkg --add-architecture armhf
|
|
|
|
|
RUN dpkg --add-architecture arm64
|
|
|
|
|
RUN dpkg --add-architecture armel
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
crossbuild-essential-armhf \
|
|
|
|
|
crossbuild-essential-arm64 \
|
|
|
|
|
crossbuild-essential-armel
|
2019-04-16 23:31:49 +00:00
|
|
|
|
|
|
|
|
FROM cross-${CROSS} as dev-base
|
|
|
|
|
|
|
|
|
|
FROM dev-base AS runtime-dev-cross-false
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-cross-false-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-cross-false-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
libapparmor-dev \
|
|
|
|
|
libseccomp-dev
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2019-10-08 17:54:39 +00:00
|
|
|
FROM --platform=linux/amd64 cross-true AS runtime-dev-cross-true
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-04-06 00:20:06 +00:00
|
|
|
# These crossbuild packages rely on gcc-<arch>, but this doesn't want to install
|
|
|
|
|
# on non-amd64 systems.
|
|
|
|
|
# Additionally, the crossbuild-amd64 is currently only on debian:buster, so
|
|
|
|
|
# other architectures cannnot crossbuild amd64.
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-cross-true-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-cross-true-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
libseccomp-dev:armhf \
|
|
|
|
|
libseccomp-dev:arm64 \
|
|
|
|
|
libseccomp-dev:armel \
|
|
|
|
|
libapparmor-dev:armhf \
|
|
|
|
|
libapparmor-dev:arm64 \
|
|
|
|
|
libapparmor-dev:armel \
|
|
|
|
|
# install this arches seccomp here due to compat issues with the v0 builder
|
|
|
|
|
# This is as opposed to inheriting from runtime-dev-cross-false
|
|
|
|
|
libapparmor-dev \
|
|
|
|
|
libseccomp-dev
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2019-04-06 00:20:06 +00:00
|
|
|
|
|
|
|
|
FROM runtime-dev-cross-${CROSS} AS runtime-dev
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2018-02-27 08:20:55 +00:00
|
|
|
FROM base AS tomlv
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=tomlv
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG TOMLV_COMMIT
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2018-02-27 08:20:55 +00:00
|
|
|
FROM base AS vndr
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=vndr
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG VNDR_COMMIT
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM dev-base AS containerd
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG CONTAINERD_COMMIT
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-containerd-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-containerd-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
btrfs-tools
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=containerd
|
|
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM dev-base AS proxy
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=proxy
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG LIBNETWORK_COMMIT
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-08-05 10:32:43 +00:00
|
|
|
FROM base AS golangci_lint
|
|
|
|
|
ENV INSTALL_BINARY_NAME=golangci_lint
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG GOLANGCI_LINT_COMMIT
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-07-31 00:07:30 +00:00
|
|
|
FROM base AS gotestsum
|
|
|
|
|
ENV INSTALL_BINARY_NAME=gotestsum
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG GOTESTSUM_COMMIT
|
2019-07-31 00:07:30 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2019-07-31 00:07:30 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM dev-base AS dockercli
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=dockercli
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG DOCKERCLI_CHANNEL
|
|
|
|
|
ARG DOCKERCLI_VERSION
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
|
|
|
|
FROM runtime-dev AS runc
|
|
|
|
|
ENV INSTALL_BINARY_NAME=runc
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG RUNC_COMMIT
|
|
|
|
|
ARG RUNC_BUILDTAGS
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM dev-base AS tini
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG TINI_COMMIT
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-tini-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
cmake \
|
|
|
|
|
vim-common
|
2017-09-29 21:09:14 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
ENV INSTALL_BINARY_NAME=tini
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build ./install.sh $INSTALL_BINARY_NAME
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-04-16 23:31:49 +00:00
|
|
|
FROM dev-base AS rootlesskit
|
2018-10-15 07:52:53 +00:00
|
|
|
ENV INSTALL_BINARY_NAME=rootlesskit
|
2019-09-12 20:22:56 +00:00
|
|
|
ARG ROOTLESSKIT_COMMIT
|
2018-10-15 07:52:53 +00:00
|
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
|
|
|
COPY hack/dockerfile/install/$INSTALL_BINARY_NAME.installer ./
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
|
PREFIX=/build/ ./install.sh $INSTALL_BINARY_NAME
|
2018-10-15 07:52:53 +00:00
|
|
|
COPY ./contrib/dockerd-rootless.sh /build
|
2017-09-29 21:09:14 +00:00
|
|
|
|
2019-10-05 20:46:49 +00:00
|
|
|
FROM djs55/vpnkit@sha256:${VPNKIT_DIGEST} AS vpnkit
|
|
|
|
|
|
2017-09-29 21:09:14 +00:00
|
|
|
# TODO: Some of this is only really needed for testing, it would be nice to split this up
|
|
|
|
|
FROM runtime-dev AS dev
|
2019-08-11 15:08:33 +00:00
|
|
|
ARG DEBIAN_FRONTEND
|
2017-09-29 21:09:14 +00:00
|
|
|
RUN groupadd -r docker
|
|
|
|
|
RUN useradd --create-home --gid docker unprivilegeduser
|
2018-06-29 10:39:36 +00:00
|
|
|
# Let us use a .bashrc file
|
|
|
|
|
RUN ln -sfv /go/src/github.com/docker/docker/.bashrc ~/.bashrc
|
2017-06-24 21:51:06 +00:00
|
|
|
# Activate bash completion and include Docker's completion if mounted with DOCKER_BASH_COMPLETION_PATH
|
|
|
|
|
RUN echo "source /usr/share/bash-completion/bash_completion" >> /etc/bash.bashrc
|
2017-06-23 16:05:38 +00:00
|
|
|
RUN ln -s /usr/local/completion/bash/docker /etc/bash_completion.d/docker
|
2017-09-29 21:09:14 +00:00
|
|
|
RUN ldconfig
|
|
|
|
|
# This should only install packages that are specifically needed for the dev environment and nothing else
|
|
|
|
|
# Do you really need to add another package here? Can it be done in a different build stage?
|
2019-05-22 23:49:55 +00:00
|
|
|
RUN --mount=type=cache,sharing=locked,id=moby-dev-aptlib,target=/var/lib/apt \
|
2019-10-05 20:41:27 +00:00
|
|
|
--mount=type=cache,sharing=locked,id=moby-dev-aptcache,target=/var/cache/apt \
|
|
|
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
|
|
|
apparmor \
|
|
|
|
|
aufs-tools \
|
|
|
|
|
bash-completion \
|
|
|
|
|
btrfs-tools \
|
|
|
|
|
iptables \
|
|
|
|
|
jq \
|
|
|
|
|
libcap2-bin \
|
|
|
|
|
libdevmapper-dev \
|
|
|
|
|
libudev-dev \
|
|
|
|
|
libsystemd-dev \
|
|
|
|
|
binutils-mingw-w64 \
|
|
|
|
|
g++-mingw-w64-x86-64 \
|
|
|
|
|
net-tools \
|
|
|
|
|
pigz \
|
|
|
|
|
python3-pip \
|
|
|
|
|
python3-setuptools \
|
|
|
|
|
python3-wheel \
|
|
|
|
|
thin-provisioning-tools \
|
|
|
|
|
vim \
|
|
|
|
|
vim-common \
|
|
|
|
|
xfsprogs \
|
|
|
|
|
zip \
|
|
|
|
|
bzip2 \
|
|
|
|
|
xz-utils \
|
|
|
|
|
libprotobuf-c1 \
|
|
|
|
|
libnet1 \
|
|
|
|
|
libnl-3-200
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2019-07-30 23:59:02 +00:00
|
|
|
|
|
|
|
|
RUN pip3 install yamllint==1.16.0
|
|
|
|
|
|
2018-04-13 18:45:57 +00:00
|
|
|
COPY --from=swagger /build/swagger* /usr/local/bin/
|
|
|
|
|
COPY --from=frozen-images /build/ /docker-frozen-images
|
2019-08-05 10:32:43 +00:00
|
|
|
COPY --from=golangci_lint /build/ /usr/local/bin/
|
2019-07-31 00:07:30 +00:00
|
|
|
COPY --from=gotestsum /build/ /usr/local/bin/
|
2018-04-13 18:45:57 +00:00
|
|
|
COPY --from=tomlv /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=vndr /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=tini /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=runc /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=containerd /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=proxy /build/ /usr/local/bin/
|
|
|
|
|
COPY --from=dockercli /build/ /usr/local/cli
|
|
|
|
|
COPY --from=registry /build/registry* /usr/local/bin/
|
|
|
|
|
COPY --from=criu /build/ /usr/local/
|
2018-10-15 07:52:53 +00:00
|
|
|
COPY --from=rootlesskit /build/ /usr/local/bin/
|
2019-10-05 20:46:49 +00:00
|
|
|
COPY --from=vpnkit /vpnkit /usr/local/bin/vpnkit.x86_64
|
2017-06-23 16:05:38 +00:00
|
|
|
|
2017-09-29 21:09:14 +00:00
|
|
|
ENV PATH=/usr/local/cli:$PATH
|
|
|
|
|
ENV DOCKER_BUILDTAGS apparmor seccomp selinux
|
|
|
|
|
WORKDIR /go/src/github.com/docker/docker
|
|
|
|
|
VOLUME /var/lib/docker
|
|
|
|
|
# Wrap all commands in the "docker-in-docker" script to allow nested containers
|
|
|
|
|
ENTRYPOINT ["hack/dind"]
|
2019-10-08 18:17:15 +00:00
|
|
|
|
|
|
|
|
FROM dev AS src
|
2019-05-22 23:49:55 +00:00
|
|
|
COPY . /go/src/github.com/docker/docker
|
|
|
|
|
|
2019-10-08 18:17:15 +00:00
|
|
|
FROM src AS build-binary
|
2019-05-22 23:49:55 +00:00
|
|
|
ARG DOCKER_GITCOMMIT=HEAD
|
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
hack/make.sh binary
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2019-10-08 18:17:15 +00:00
|
|
|
FROM src AS build-dynbinary
|
2019-05-22 23:49:55 +00:00
|
|
|
ARG DOCKER_GITCOMMIT=HEAD
|
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
hack/make.sh dynbinary
|
2019-05-22 23:49:55 +00:00
|
|
|
|
2019-10-08 18:17:15 +00:00
|
|
|
FROM src AS build-cross
|
2019-05-22 23:49:55 +00:00
|
|
|
ARG DOCKER_GITCOMMIT=HEAD
|
|
|
|
|
ARG DOCKER_CROSSPLATFORMS=""
|
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
2019-10-05 20:41:27 +00:00
|
|
|
hack/make.sh cross
|
2019-05-22 23:49:55 +00:00
|
|
|
|
|
|
|
|
FROM scratch AS binary
|
|
|
|
|
COPY --from=build-binary /go/src/github.com/docker/docker/bundles/ /
|
|
|
|
|
|
|
|
|
|
FROM scratch AS dynbinary
|
|
|
|
|
COPY --from=build-dynbinary /go/src/github.com/docker/docker/bundles/ /
|
|
|
|
|
|
|
|
|
|
FROM scratch AS cross
|
|
|
|
|
COPY --from=build-cross /go/src/github.com/docker/docker/bundles/ /
|
2018-12-14 01:26:10 +00:00
|
|
|
|
2019-10-08 18:17:15 +00:00
|
|
|
FROM src AS final
|
