Skip to content

Switching from Alpine Image to multistaged opensuse/leap - #2347

Merged
drwetter merged 11 commits into
3.1devfrom
suse_docker
Mar 24, 2023
Merged

drwetter merged 11 commits into
3.1devfrom
suse_docker

Conversation

@drwetter

Copy link
Copy Markdown
Collaborator

polarathene and others added 7 commits March 22, 2023 21:19
BusyBox `adduser` was reading config from `/etc` that unnecessarily populates the home folder with various dot files.

Alternative approach is to create the user and home folder manually. This avoids some extra files like the `-` suffixed backup copies from `adduser`.
The additions from `adduser` reading `/etc` does not appear to apply if the directory already exists, and permissions (including SGID) are adjusted properly for the home dir.

This mean the excess backup copies in `/etc` are introduced again however.
- Removing bulk of the noise from inline documentation.
- Packages bundled into single line like previous the Alpine version had.
- `CACHE_ZYPPER` is only used as an `ARG` in the `builder` stage.
- `zypper clean` wasn't able to clear anything from the install root, other than the `CACHE_ZYPPER` mount.
These have been available via opt-in prior to v23 of Docker Engine with `DOCKER_BUILDKIT=1` ENV as a prefix to running `docker build`, however it's been requested to avoid the syntax.

No HereDoc (multi-line RUN with EOF marker) or `RUN --mount` available. This makes the `busybox` approach a hassle, so I've brought back the explicit creation of user and home dir.

Without the cache mounts, bring back `zypper clean`. It's not doing much as the `--cache-dir` is still set, but should reduce disk space for the `builder` layer. Local builds will be slower as a result when this layer is invalidated.

AFAIK, this also makes it tricky to use the `ZYPPER_OPTIONS`? So no longer DRY.
…suse

refactor(dockerfile): Change base Alpine (3.17) => openSUSE Leap (15.4)
@drwetter

Copy link
Copy Markdown
Collaborator Author

@polarathene : Care to update the Dockerfile.git too?

If so, please commit to the suse_docker branch, so that it'll show up here. git is needed in that file?

Comment thread CREDITS.md Resolved
@polarathene

Copy link
Copy Markdown
Contributor

@polarathene : Care to update the Dockerfile.git too?

I need to prioritize other tasks sorry 😖

I'm not likely to have time to spare until April.


ARG BUILD_VERSION
ARG URL=https://github.com/drwetter/testssl.sh.git
RUN git clone --depth 1 --branch "${BUILD_VERSION}" "${URL}" /home/testssl

That is the main difference (the test -n condition fails earlier, but if the ARG is empty git will still throw an error).

  • I am not sure what you need to offer this for vs just cloning locally to build the image if you're going to build one anyway? IIRC, it was primarily added for CI usage.
  • Not an option for you, but there is ADD instruction support for remote git repo sources that doesn't requiring installing git into the container.
  • You could also add this into the builder stage (not ideal), and add two more stages where they diverge at the COPY instruction, this would use docker build --target stage-name-here to decide what to build.

Personally, if your CI is the only known consumer of it, I'd advise adjusting your CI to provide the git repo branch instead.

That said, easiest fix is to just copy this Dockerfile, and place the 3 instructions above into the builder stage (change the /home/testssl to "S{INSTALL_ROOT}/home/testssl) and drop the last COPY in the final stage. I think that'll work, just extra maintenance to keep them in sync.


git is needed in that file?

Yeah, you'd need to add that package if you want to keep that image variant.

@drwetter

Copy link
Copy Markdown
Collaborator Author

Personally, if your CI is the only known consumer of it,

probably not.

I need to prioritize other tasks sorry

no prob. Thanks for your work so far!

(not related to this PR but it'll be forgotten otherwise)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants