dockerfiles

szachovy · Oct 9, 2024 · 0ad953d · 0ad953d
1 parent 2b717f8
commit 0ad953d
Show file tree

Hide file tree

Showing 7 changed files with 278 additions and 105 deletions.
diff --git a/.hadolint.yaml b/.hadolint.yaml
@@ -0,0 +1,2 @@
+ignored:
+  - DL3002  # Using gosu in some entrypoints
diff --git a/services/mysql-mgmt/Dockerfile b/services/mysql-mgmt/Dockerfile
@@ -1,21 +1,42 @@
-FROM ubuntu:22.04
+ARG BUILDPLATFORM="amd64"
+FROM --platform=${BUILDPLATFORM} ubuntu:22.04
+
+LABEL version="1.0"
+
+ARG MYSQL_SHELL_VERSION="mysql-shell-8.3.0-linux-glibc2.28-x86-64bit" \
+    MYSQL_SHELL_MD5_CHECKSUM="c71280416014b9340b34b90160f42e23" \
+    MYSQL_ROUTER_VERSION="mysql-router-8.3.0-linux-glibc2.28-x86_64" \
+    MYSQL_ROUTER_MD5_CHECKSUM="6ea1c55a258d20fc51a4c383a1e7433e"
 
 COPY --chown=superset:superset . "/opt"
 
+ENV LANG="C.UTF-8" \
+    LC_ALL="C.UTF-8" \
+    DEBIAN_FRONTEND="noninteractive" \
+    PATH="${PATH}:/opt/${MYSQL_SHELL_VERSION}/bin:/opt/${MYSQL_ROUTER_VERSION}/bin"
+
+WORKDIR "/opt"
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN \
-  apt \
+  set \
+    -eux \
+  && \
+  apt-get \
     update \
   && \
-  apt \
+  apt-get \
     install \
       --yes \
-      libkeyutils1 \
-      wget \
-      xz-utils \
-      keepalived \
-      mysql-client \
-      ifmetric \
-      sudo \
+      "gpg=2.2.27-3ubuntu2.1" \
+      "ifmetric=0.3-5" \
+      "keepalived=1:2.2.4-0.2build1" \
+      "libkeyutils1=1.6.1-2ubuntu3" \
+      "mysql-client=8.0.39-0ubuntu0.22.04.1" \
+      "sudo=1.9.9-1ubuntu2.4" \
+      "wget=1.21.2-2ubuntu1.1" \
+      "xz-utils=5.2.5-2ubuntu1" \
   && \
   groupadd \
     --system \
@@ -35,26 +56,46 @@ RUN \
   mkdir \
     "/opt/initcontainer" \
   && \
-  rm \
-    --recursive \
-    --force \
-      "/var/lib/apt/lists/*"
-
-ARG MYSQL_SHELL_VERSION="mysql-shell-8.3.0-linux-glibc2.28-x86-64bit"
-ARG MYSQL_ROUTER_VERSION="mysql-router-8.3.0-linux-glibc2.28-x86_64"
-
-ENV DEBIAN_FRONTEND="noninteractive"
-ENV PATH="${PATH}:/opt/${MYSQL_SHELL_VERSION}/bin:/opt/${MYSQL_ROUTER_VERSION}/bin"
-
-WORKDIR "/opt"
-
-RUN \
+  gpg \
+    --import \
+      "/opt/dev_mysql_signature.asc" \
+  && \
   wget \
     --quiet \
       "https://github.com/a8m/envsubst/releases/download/v1.2.0/envsubst-Linux-x86_64" \
       "https://dev.mysql.com/get/Downloads/MySQL-Shell/${MYSQL_SHELL_VERSION}.tar.gz" \
       "https://dev.mysql.com/get/Downloads/MySQL-Router/${MYSQL_ROUTER_VERSION}.tar.xz" \
   && \
+  echo "${MYSQL_SHELL_MD5_CHECKSUM}  ${MYSQL_SHELL_VERSION}.tar.gz" \
+    | md5sum \
+      --check \
+        - \
+  && \
+  echo "${MYSQL_ROUTER_MD5_CHECKSUM}  ${MYSQL_ROUTER_VERSION}.tar.xz" \
+    | md5sum \
+      --check \
+        - \
+  && \
+  wget \
+    --quiet \
+    --output-document \
+      "${MYSQL_SHELL_VERSION}.tar.gz.asc" \
+        "https://downloads.mysql.com/archives/gpg/?file=${MYSQL_SHELL_VERSION}.tar.gz&p=43" \
+  && \
+  gpg \
+    --verify \
+      "${MYSQL_SHELL_VERSION}.tar.gz.asc" \
+  && \
+  wget \
+    --quiet \
+    --output-document \
+      "${MYSQL_ROUTER_VERSION}.tar.xz.asc" \
+        "https://downloads.mysql.com/archives/gpg/?file=${MYSQL_ROUTER_VERSION}.tar.xz&p=41" \
+  && \
+  gpg \
+    --verify \
+      "${MYSQL_ROUTER_VERSION}.tar.xz.asc" \
+  && \
   tar \
     --extract \
     --file \
@@ -70,11 +111,17 @@ RUN \
     744 \
       "/opt/envsubst-Linux-x86_64" \
   && \
-  rm \
-    "${MYSQL_SHELL_VERSION}.tar.gz" \
-    "${MYSQL_ROUTER_VERSION}.tar.xz" \
-  && \
   echo \
     "superset ALL=(ALL) NOPASSWD: /usr/sbin/keepalived" \
       >> \
-        "/etc/sudoers.d/keepalived"
+        "/etc/sudoers.d/keepalived" \
+  && \
+  apt-get \
+    clean \
+  && \
+  rm \
+    --recursive \
+    --force \
+      "${MYSQL_SHELL_VERSION}.tar.gz" \
+      "${MYSQL_ROUTER_VERSION}.tar.xz" \
+      "/var/lib/apt/lists/*"
diff --git a/services/mysql-mgmt/dev_mysql_signature.asc b/services/mysql-mgmt/dev_mysql_signature.asc
@@ -0,0 +1,49 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.6
+Comment: Hostname: pgp.mit.edu
+
+mQINBGU2rNoBEACSi5t0nL6/Hj3d0PwsbdnbY+SqLUIZ3uWZQm6tsNhvTnahvPPZBGdl99iW
+YTt2KmXp0KeN2s9pmLKkGAbacQP1RqzMFnoHawSMf0qTUVjAvhnI4+qzMDjTNSBq9fa3nHmO
+YxownnrRkpiQUM/yD7/JmVENgwWb6akZeGYrXch9jd4XV3t8OD6TGzTedTki0TDNr6YZYhC7
+jUm9fK9Zs299pzOXSxRRNGd+3H9gbXizrBu4L/3lUrNf//rM7OvV9Ho7u9YYyAQ3L3+OABK9
+FKHNhrpi8Q0cbhvWkD4oCKJ+YZ54XrOG0YTg/YUAs5/3//FATI1sWdtLjJ5pSb0onV3LIbar
+RTN8lC4Le/5kd3lcot9J8b3EMXL5p9OGW7wBfmNVRSUI74Vmwt+v9gyp0Hd0keRCUn8lo/1V
+0YD9i92KsE+/IqoYTjnya/5kX41jB8vr1ebkHFuJ404+G6ETd0owwxq64jLIcsp/GBZHGU0R
+KKAo9DRLH7rpQ7PVlnw8TDNlOtWt5EJlBXFcPL+NgWbqkADAyA/XSNeWlqonvPlYfmasnAHA
+pMd9NhPQhC7hJTjCiAwG8UyWpV8Dj07DHFQ5xBbkTnKH2OrJtguPqSNYtTASbsWz09S8ujoT
+DXFT17NbFM2dMIiq0a4VQB3SzH13H2io9Cbg/TzJrJGmwgoXgwARAQABtDZNeVNRTCBSZWxl
+YXNlIEVuZ2luZWVyaW5nIDxteXNxbC1idWlsZEBvc3Mub3JhY2xlLmNvbT6JAlQEEwEIAD4W
+IQS8pDQXw7SF3RKOxtS3s7eIqNN4XAUCZTas2gIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgID
+AQIeAQIXgAAKCRC3s7eIqNN4XLzoD/9PlpWtfHlI8eQTHwGsGIwFA+fgipyDElapHw3MO+K9
+VOEYRZCZSuBXHJe9kjGEVCGUDrfImvgTuNuqYmVUV+wyhP+w46W/cWVkqZKAW0hNp0TTvu3e
+Dwap7gdk80VF24Y2Wo0bbiGkpPiPmB59oybGKaJ756JlKXIL4hTtK3/hjIPFnb64Ewe4YLZy
+oJu0fQOyA8gXuBoalHhUQTbRpXI0XI3tpZiQemNbfBfJqXo6LP3/LgChAuOfHIQ8alvnhCwx
+hNUSYGIRqx+BEbJw1X99Az8XvGcZ36VOQAZztkW7mEfH9NDPz7MXwoEvduc61xwlMvEsUIaS
+fn6SGLFzWPClA98UMSJgF6sKb+JNoNbzKaZ8V5w13msLb/pq7hab72HH99XJbyKNliYj3+KA
+3q0YLf+Hgt4Y4EhIJ8x2+g690Np7zJF4KXNFbi1BGloLGm78akY1rQlzpndKSpZq5KWw8FY/
+1PEXORezg/BPD3Etp0AVKff4YdrDlOkNB7zoHRfFHAvEuuqti8aMBrbRnRSG0xunMUOEhbYS
+/wOOTl0g3bF9NpAkfU1Fun57N96Us2T9gKo9AiOY5DxMe+IrBg4zaydEOovgqNi2wbU0MOBQ
+b23Puhj7ZCIXcpILvcx9ygjkONr75w+XQrFDNeux4Znzay3ibXtAPqEykPMZHsZ2sbkCDQRl
+NqzaARAAsdvBo8WRqZ5WVVk6lReD8b6Zx83eJUkV254YX9zn5t8KDRjYOySwS75mJIaZLsv0
+YQjJk+5rt10tejyCrJIFo9CMvCmjUKtVbgmhfS5+fUDRrYCEZBBSa0Dvn68EBLiHugr+SPXF
+6o1hXEUqdMCpB6oVp6X45JVQroCKIH5vsCtw2jU8S2/IjjV0V+E/zitGCiZaoZ1f6NG7ozyF
+ep1CSAReZu/sssk0pCLlfCebRd9Rz3QjSrQhWYuJa+eJmiF4oahnpUGktxMD632I9aG+IMfj
+tNJNtX32MbO+Se+cCtVc3cxSa/pR+89a3cb9IBA5tFF2Qoekhqo/1mmLi93Xn6uDUhl5tVxT
+nB217dBT27tw+p0hjd9hXZRQbrIZUTyh3+8EMfmAjNSIeR+th86xRd9XFRr9EOqrydnALOUr
+9cT7TfXWGEkFvn6ljQX7f4RvjJOTbc4jJgVFyu8K+VU6u1NnFJgDiNGsWvnYxAf7gDDbUSXE
+uC2anhWvxPvpLGmsspngge4yl+3nv+UqZ9sm6LCebR/7UZ67tYz3p6xzAOVgYsYcxoIUuEZX
+jHQtsYfTZZhrjUWBJ09jrMvlKUHLnS437SLbgoXVYZmcqwAWpVNOLZf+fFm4IE5aGBG5Dho2
+CZ6ujngW9Zkn98T1d4N0MEwwXa2V6T1ijzcqD7GApZUAEQEAAYkCPAQYAQgAJhYhBLykNBfD
+tIXdEo7G1Lezt4io03hcBQJlNqzaAhsMBQkDwmcAAAoJELezt4io03hcXqMP/01aPT3A3Sg7
+oTQoHdCxj04ELkzrezNWGM+YwbSKrR2LoXR8zf2tBFzc2/Tl98V0+68f/eCvkvqCuOtq4392
+Ps23j9W3r5XG+GDOwDsx0gl0E+Qkw07pwdJctA6efsmnRkjF2YVO0N9MiJA1tc8NbNXpEEHJ
+Z7F8Ri5cpQrGUz/AY0eae2b7QefyP4rpUELpMZPjc8Px39Fe1DzRbT+5E19TZbrpbwlSYs1i
+CzS5YGFmpCRyZcLKXo3zS6N22+82cnRBSPPipiO6WaQawcVMlQO1SX0giB+3/DryfN9VuIYd
+1EWCGQa3O0MVu6o5KVHwPgl9R1P6xPZhurkDpAd0b1s4fFxin+MdxwmG7RslZA9CXRPpzo7/
+fCMW8sYOH15DP+YfUckoEreBt+zezBxbIX2CGGWEV9v3UBXadRtwxYQ6sN9bqW4jm1b41vNA
+17b6CVH6sVgtU3eN+5Y9an1e5jLD6kFYx+OIeqIIId/TEqwS61csY9aav4j4KLOZFCGNU0FV
+ji7NQewSpepTcJwfJDOzmtiDP4vol1ApJGLRwZZZ9PB6wsOgDOoP6sr0YrDI/NNX2RyXXbgl
+nQ1yJZVSH3/3eo6knG2qTthUKHCRDNKdy9Qqc1x4WWWtSRjh+zX8AvJK2q1rVLH2/3ilxe9w
+cAZUlaj3id3TxquAlud4lWDz
+=h5nH
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/services/mysql-server/Dockerfile b/services/mysql-server/Dockerfile
@@ -1,18 +1,29 @@
-FROM mysql:8.0-debian
+ARG BUILDPLATFORM="amd64"
+FROM --platform=${BUILDPLATFORM} mysql:8.0-debian
 
-COPY --chown=mysql "mysql_config.cnf.tpl" "/opt/"
+LABEL version="1.0"
+
+ENV LANG="C.UTF-8" \
+    LC_ALL="C.UTF-8"
+
+COPY --chown=mysql:mysql "mysql_config.cnf.tpl" "/opt/"
 COPY "store_credentials.exp" "/opt/"
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN \
-  apt \
+  set \
+    -eux \
+  && \
+  apt-get \
     update \
   && \
-  apt \
+  apt-get \
     install \
       --yes \
-      curl \
-      expect \
-      gosu \
+      "curl=7.88.1-10+deb12u7" \
+      "expect=5.45.4-2+b1" \
+      "gosu=1.14-1+b10" \
   && \
   curl \
     --location \
@@ -22,22 +33,60 @@ RUN \
   && \
   chmod \
     555 \
-      envsubst \
+      "envsubst" \
   && \
   mkdir \
     "/etc/mysql/ssl" \
   && \
+  apt-get \
+    clean \
+  && \
   rm \
     --recursive \
     --force \
       "/var/lib/apt/lists/*"
 
-ENTRYPOINT sh -c " \
-  chmod 444 /var/run/mysqld/mysql_root_password && \
-  chown --recursive mysql:mysql /etc/mysql/ssl /etc/mysql/conf.d /var/run/mysqld && \
-  gosu mysql ./envsubst -no-unset -no-empty < /opt/mysql_config.cnf.tpl > /etc/mysql/conf.d/mysql_config.cnf && \
-  exec gosu mysql docker-entrypoint.sh mysqld & \
-  sleep ${HEALTHCHECK_START_PERIOD} && \
-  chmod 400 /var/run/mysqld/mysql_root_password && \
-  chown --recursive root:root /var/run/mysqld && \
-  tail -f /dev/null"
+ENTRYPOINT [ "/bin/bash", "-c", " \
+  chmod \
+    444 \
+      /var/run/mysqld/mysql_root_password \
+  && \
+  chown \
+    --recursive \
+      mysql:mysql \
+    /etc/mysql/ssl \
+    /etc/mysql/conf.d \
+    /var/run/mysqld \
+  && \
+  gosu \
+    mysql \
+      ./envsubst \
+        -no-unset \
+        -no-empty \
+          < /opt/mysql_config.cnf.tpl \
+          > /etc/mysql/conf.d/mysql_config.cnf \
+  && \
+  exec \
+    gosu \
+      mysql \
+        docker-entrypoint.sh \
+        mysqld \
+  & \
+  sleep \
+    ${HEALTHCHECK_START_PERIOD} \
+  && \
+  chmod \
+    400 \
+      /var/run/mysqld/mysql_root_password \
+  && \
+  chown \
+    --recursive \
+      root:root \
+    /var/run/mysqld \
+  && \
+  tail \
+    --follow \
+      /dev/null \
+        -- \
+  " \
+]