From 0aa601334299d795b06ce858670822af2535204e Mon Sep 17 00:00:00 2001 From: Nicola Murino Date: Sat, 3 Feb 2024 15:38:43 +0100 Subject: [PATCH] docker: add back Distroless image this is possible thanks to a new project sponsor Signed-off-by: Nicola Murino --- .github/workflows/docker.yml | 15 ++++++++++ Dockerfile.distroless | 58 ++++++++++++++++++++++++++++++++++++ docker/README.md | 10 +++++++ 3 files changed, 83 insertions(+) create mode 100644 Dockerfile.distroless diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 03ecf4a3..ffbb5283 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -25,6 +25,9 @@ jobs: - true - false include: + - os: ubuntu-latest + docker_pkg: distroless + optional_deps: false - os: ubuntu-latest docker_pkg: debian-plugins optional_deps: true @@ -61,6 +64,11 @@ jobs: VERSION="${VERSION}-alpine" VERSION_SLIM="${VERSION}-slim" DOCKERFILE=Dockerfile.alpine + elif [[ $DOCKER_PKG == distroless ]]; then + VERSION="${VERSION}-distroless" + VERSION_SLIM="${VERSION}-slim" + DOCKERFILE=Dockerfile.distroless + FEATURES="${FEATURES},nosqlite" elif [[ $DOCKER_PKG == debian-plugins ]]; then VERSION="${VERSION}-plugins" VERSION_SLIM="${VERSION}-slim" @@ -85,6 +93,13 @@ jobs: fi TAGS="${TAGS},${DOCKER_IMAGE}:latest" TAGS_SLIM="${TAGS_SLIM},${DOCKER_IMAGE}:slim" + elif [[ $DOCKER_PKG == distroless ]]; then + if [[ -n $MAJOR && -n $MINOR ]]; then + TAGS="${TAGS},${DOCKER_IMAGE}:${MINOR}-distroless,${DOCKER_IMAGE}:${MAJOR}-distroless" + TAGS_SLIM="${TAGS_SLIM},${DOCKER_IMAGE}:${MINOR}-distroless-slim,${DOCKER_IMAGE}:${MAJOR}-distroless-slim" + fi + TAGS="${TAGS},${DOCKER_IMAGE}:distroless" + TAGS_SLIM="${TAGS_SLIM},${DOCKER_IMAGE}:distroless-slim" elif [[ $DOCKER_PKG == debian-plugins ]]; then if [[ -n $MAJOR && -n $MINOR ]]; then TAGS="${TAGS},${DOCKER_IMAGE}:${MINOR}-plugins,${DOCKER_IMAGE}:${MAJOR}-plugins" diff --git a/Dockerfile.distroless b/Dockerfile.distroless new file mode 100644 index 00000000..6fdb3f58 --- /dev/null +++ b/Dockerfile.distroless @@ -0,0 +1,58 @@ +FROM golang:1.21-bookworm as builder + +ENV CGO_ENABLED=0 GOFLAGS="-mod=readonly" + +RUN apt-get update && apt-get -y upgrade && apt-get install --no-install-recommends -y media-types openssh-server && rm -rf /var/lib/apt/lists/* + +RUN mkdir -p /workspace +WORKDIR /workspace + +ARG GOPROXY + +COPY go.mod go.sum ./ +RUN go mod download + +ARG COMMIT_SHA + +# This ARG allows to disable some optional features and it might be useful if you build the image yourself. +# For this variant we disable SQLite support since it requires CGO and so a C runtime which is not installed +# in distroless/static-* images +ARG FEATURES + +COPY . . + +RUN set -xe && \ + export COMMIT_SHA=${COMMIT_SHA:-$(git describe --always --abbrev=8 --dirty)} && \ + go build $(if [ -n "${FEATURES}" ]; then echo "-tags ${FEATURES}"; fi) -trimpath -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=${COMMIT_SHA} -X github.com/drakkan/sftpgo/v2/internal/version.date=`date -u +%FT%TZ`" -v -o sftpgo + +# Modify the default configuration file +RUN sed -i 's|"users_base_dir": "",|"users_base_dir": "/srv/sftpgo/data",|' sftpgo.json && \ + sed -i 's|"backups"|"/srv/sftpgo/backups"|' sftpgo.json && \ + sed -i 's|"sqlite"|"bolt"|' sftpgo.json + +RUN mkdir /etc/sftpgo /var/lib/sftpgo /srv/sftpgo + +FROM gcr.io/distroless/static-debian12 + +COPY --from=builder --chown=1000:1000 /etc/sftpgo /etc/sftpgo +COPY --from=builder --chown=1000:1000 /srv/sftpgo /srv/sftpgo +COPY --from=builder --chown=1000:1000 /var/lib/sftpgo /var/lib/sftpgo +COPY --from=builder --chown=1000:1000 /workspace/sftpgo.json /etc/sftpgo/sftpgo.json +COPY --from=builder --chown=1000:1000 /etc/ssh/moduli /etc/sftpgo/moduli +COPY --from=builder /workspace/templates /usr/share/sftpgo/templates +COPY --from=builder /workspace/static /usr/share/sftpgo/static +COPY --from=builder /workspace/openapi /usr/share/sftpgo/openapi +COPY --from=builder /workspace/sftpgo /usr/local/bin/ +COPY --from=builder /etc/mime.types /etc/mime.types + +# Log to the stdout so the logs will be available using docker logs +ENV SFTPGO_LOG_FILE_PATH="" +# These env vars are required to avoid the following error when calling user.Current(): +# unable to get the current user: user: Current requires cgo or $USER set in environment +ENV USER=sftpgo +ENV HOME=/var/lib/sftpgo + +WORKDIR /var/lib/sftpgo +USER 1000:1000 + +CMD ["sftpgo", "serve"] \ No newline at end of file diff --git a/docker/README.md b/docker/README.md index 58c7acbd..37a03d1c 100644 --- a/docker/README.md +++ b/docker/README.md @@ -14,6 +14,7 @@ SFTPGo provides an official Docker image, it is available on both [Docker Hub](h - [edge-alpine](../Dockerfile.alpine) - [edge-slim](../Dockerfile) - [edge-alpine-slim](../Dockerfile.alpine) +- [edge-distroless-slim](../Dockerfile.distroless) ## How to use the SFTPGo image @@ -200,6 +201,15 @@ This image is based on the popular [Alpine Linux project](https://alpinelinux.or This variant is highly recommended when final image size being as small as possible is desired. The main caveat to note is that it does use [musl libc](https://musl.libc.org/) instead of [glibc and friends](https://www.etalabs.net/compare_libcs.html), so certain software might run into issues depending on the depth of their libc requirements. However, most software doesn't have an issue with this, so this variant is usually a very safe choice. See [this Hacker News comment thread](https://news.ycombinator.com/item?id=10782897) for more discussion of the issues that might arise and some pro/con comparisons of using Alpine-based images. +### `sftpgo:-distroless` + +This image is based on the popular [Distroless project](https://github.com/GoogleContainerTools/distroless). We use the latest Debian based distroless image as base. + +Distroless variant contains only a statically linked sftpgo binary and its minimal runtime dependencies and so it doesn't allow shell access (no shell is installed). +SQLite support is disabled since it requires CGO and so a C runtime which is not installed. +The default data provider is `bolt`, all the supported data providers except `sqlite` work. +We only provide the slim variant and so the optional `git` dependency is not available. + ### `sftpgo:-slim` These tags provide a slimmer image that does not include `jq` and the optional `git` and `rsync` dependencies.