Skip to content

Commit 98b0dc1

Browse files
breskebybreskeby
authored
[8.19] Address review feedback on fips docker image (#126330) (#127640)
* Address review feedback on es default docker image (#126330) This addresses feedback we got for our default image at docker-library/official-images#18692 This also introduces separate docker source files to make maintaining those easier. We cannot take over all suggested changes as we require certain settings to have our packaging tests pass as expected. (cherry picked from commit ca19573) # Conflicts: # build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java # distribution/docker/src/docker/Dockerfile * Adjust docker fips entrypoint and cmd (#127630) Also extract docker fips configuration in explicit docker file * Fix merge issue
1 parent 097f2fa commit 98b0dc1

File tree

6 files changed

+236
-67
lines changed

6 files changed

+236
-67
lines changed

‎.ci/scripts/packaging-test.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# opensuse 15 has a missing dep for systemd
44

55
if which zypper > /dev/null ; then
6-
sudo zypper install -y insserv-compat
6+
sudo zypper install -y insserv-compat docker-buildx
77
fi
88

99
if [ -e /etc/sysctl.d/99-gce.conf ]; then

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java

+17-8
Original file line numberDiff line numberDiff line change
@@ -13,45 +13,50 @@
1313
* This class models the different Docker base images that are used to build Docker distributions of Elasticsearch.
1414
*/
1515
public enum DockerBase {
16-
DEFAULT("ubuntu:20.04", "", "apt-get"),
16+
DEFAULT("ubuntu:20.04", "", "apt-get", "Dockerfile"),
1717

1818
// "latest" here is intentional, since the image name specifies "8"
19-
UBI("docker.elastic.co/ubi8/ubi-minimal:latest", "-ubi8", "microdnf"),
19+
UBI("docker.elastic.co/ubi8/ubi-minimal:latest", "-ubi8", "microdnf", "Dockerfile"),
2020

2121
// The Iron Bank base image is UBI (albeit hardened), but we are required to parameterize the Docker build
22-
IRON_BANK("${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}", "-ironbank", "yum"),
22+
IRON_BANK("${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}", "-ironbank", "yum", "Dockerfile"),
2323

2424
// Chainguard based wolfi image with latest jdk
2525
// This is usually updated via renovatebot
2626
// spotless:off
2727
WOLFI(
2828
"docker.elastic.co/wolfi/chainguard-base:latest@sha256:1c7f5aa0e7997455b8500d095c7a90e617102d3941eb0757ac62cfea509e09b9",
2929
"-wolfi",
30-
"apk"
30+
"apk",
31+
"Dockerfile"
3132
),
3233
// spotless:on
3334

3435
// Based on WOLFI above, with more extras. We don't set a base image because
3536
// we programmatically extend from the wolfi image.
36-
CLOUD_ESS(null, "-cloud-ess", "apk"),
37+
CLOUD_ESS(null, "-cloud-ess", "apk", "Dockerfile.ess"),
38+
3739
CLOUD_ESS_FIPS(
3840
"docker.elastic.co/wolfi/chainguard-base-fips:sha256-ebfc3f1d7dba992231747a2e05ad1b859843e81b5e676ad342859d7cf9e425a7",
3941
"-cloud-ess-fips",
40-
"apk"
42+
"apk",
43+
"Dockerfile.ess-fips"
4144
);
4245

4346
private final String image;
4447
private final String suffix;
4548
private final String packageManager;
49+
private final String dockerfile;
4650

4751
DockerBase(String image, String suffix) {
48-
this(image, suffix, "apt-get");
52+
this(image, suffix, "apt-get", "dockerfile");
4953
}
5054

51-
DockerBase(String image, String suffix, String packageManager) {
55+
DockerBase(String image, String suffix, String packageManager, String dockerfile) {
5256
this.image = image;
5357
this.suffix = suffix;
5458
this.packageManager = packageManager;
59+
this.dockerfile = dockerfile;
5560
}
5661

5762
public String getImage() {
@@ -65,4 +70,8 @@ public String getSuffix() {
6570
public String getPackageManager() {
6671
return packageManager;
6772
}
73+
74+
public String getDockerfile() {
75+
return dockerfile;
76+
}
6877
}

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/docker/DockerBuildTask.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ private void pullBaseImage(String baseImage) {
170170
maybeConfigureDockerConfig(spec);
171171
spec.executable("docker");
172172
spec.args("pull");
173+
spec.environment("DOCKER_BUILDKIT", "1");
173174
spec.args(baseImage);
174175
});
175176

@@ -205,7 +206,7 @@ public void execute() {
205206
maybeConfigureDockerConfig(spec);
206207

207208
spec.executable("docker");
208-
209+
spec.environment("DOCKER_BUILDKIT", "1");
209210
if (isCrossPlatform) {
210211
spec.args("buildx");
211212
}

‎distribution/docker/build.gradle

+2-1
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,10 @@ ext.dockerBuildContext = { Architecture architecture, DockerBase base ->
201201
from projectDir.resolve("src/docker/config")
202202
}
203203
}
204-
from(projectDir.resolve("src/docker/Dockerfile")) {
204+
from(projectDir.resolve("src/docker/${base.dockerfile}")) {
205205
expand(varExpansions)
206206
filter SquashNewlinesFilter
207+
rename base.dockerfile, "Dockerfile"
207208
}
208209
}
209210
}

‎distribution/docker/src/docker/Dockerfile

+8-56
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ RUN chmod 0555 /bin/tini
4343
# Install required packages to extract the Elasticsearch distribution
4444
<% if (docker_base == 'default') { %>
4545
RUN <%= retry.loop(package_manager, "${package_manager} update && DEBIAN_FRONTEND=noninteractive ${package_manager} install -y curl ") %>
46-
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
46+
<% } else if (docker_base == "wolfi") { %>
4747
RUN <%= retry.loop(package_manager, "export DEBIAN_FRONTEND=noninteractive && ${package_manager} update && ${package_manager} update && ${package_manager} add --no-cache curl") %>
4848
<% } else { %>
4949
RUN <%= retry.loop(package_manager, "${package_manager} install -y findutils tar gzip") %>
5050
<% } %>
5151
52-
<% if (docker_base != 'wolfi' && docker_base != 'cloud_ess_fips' ) { %>
52+
<% if (docker_base != 'wolfi') { %>
5353
# `tini` is a tiny but valid init for containers. This is used to cleanly
5454
# control how ES and any child processes are shut down.
5555
# For wolfi we pick it from the blessed wolfi package registry.
@@ -117,47 +117,6 @@ RUN sed -i -e 's/ES_DISTRIBUTION_TYPE=tar/ES_DISTRIBUTION_TYPE=docker/' bin/elas
117117
chmod 0775 bin config config/jvm.options.d data logs plugins && \\
118118
find config -type f -exec chmod 0664 {} +
119119

120-
<% if (docker_base == 'cloud_ess_fips') { %>
121-
# Add plugins infrastructure
122-
RUN mkdir -p /opt/plugins/archive
123-
RUN chmod -R 0555 /opt/plugins
124-
125-
RUN mkdir -p /fips/libs
126-
COPY fips/libs/*.jar /fips/libs/
127-
128-
COPY filebeat-${version}.tar.gz metricbeat-${version}.tar.gz /tmp/
129-
RUN set -eux ; \\
130-
for beat in filebeat metricbeat ; do \\
131-
if [ ! -s /tmp/\$beat-${version}.tar.gz ]; then \\
132-
echo "/tmp/\$beat-${version}.tar.gz is empty - cannot uncompress" 2>&1 ; \\
133-
exit 1 ; \\
134-
fi ; \\
135-
if ! tar tf /tmp/\$beat-${version}.tar.gz >/dev/null; then \\
136-
echo "/tmp/\$beat-${version}.tar.gz is corrupt - cannot uncompress" 2>&1 ; \\
137-
exit 1 ; \\
138-
fi ; \\
139-
mkdir -p /opt/\$beat ; \\
140-
tar xf /tmp/\$beat-${version}.tar.gz -C /opt/\$beat --strip-components=1 ; \\
141-
done
142-
143-
COPY plugins/*.zip /opt/plugins/archive/
144-
145-
RUN chown 1000:1000 /opt/plugins/archive/*
146-
RUN chmod 0444 /opt/plugins/archive/*
147-
148-
COPY fips/resources/fips_java.security /usr/share/elasticsearch/config/fips_java.security
149-
COPY fips/resources/fips_java.policy /usr/share/elasticsearch/config/fips_java.policy
150-
151-
WORKDIR /usr/share/elasticsearch/config
152-
153-
## Add fips specific JVM options
154-
RUN cat <<EOF > /usr/share/elasticsearch/config/jvm.options.d/fips.options
155-
-Djavax.net.ssl.keyStoreType=BCFKS
156-
-Dorg.bouncycastle.fips.approved_only=true
157-
-Djava.security.properties=config/fips_java.security
158-
-Djava.security.policy=config/fips_java.policy
159-
EOF
160-
<% } %>
161120

162121
################################################################################
163122
# Build stage 2 (the actual Elasticsearch image):
@@ -178,7 +137,7 @@ RUN ${package_manager} update --setopt=tsflags=nodocs -y && \\
178137
nc shadow-utils zip findutils unzip procps-ng && \\
179138
${package_manager} clean all
180139
181-
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
140+
<% } else if (docker_base == "wolfi") { %>
182141
RUN <%= retry.loop(package_manager,
183142
"export DEBIAN_FRONTEND=noninteractive && \n" +
184143
" ${package_manager} update && \n" +
@@ -227,7 +186,7 @@ RUN groupadd -g 1000 elasticsearch && \\
227186
adduser --uid 1000 --gid 1000 --home /usr/share/elasticsearch elasticsearch && \\
228187
adduser elasticsearch root && \\
229188
chown -R 0:0 /usr/share/elasticsearch
230-
<% } else if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
189+
<% } else if (docker_base == "wolfi") { %>
231190
RUN groupadd -g 1000 elasticsearch && \
232191
adduser -G elasticsearch -u 1000 elasticsearch -D --home /usr/share/elasticsearch elasticsearch && \
233192
adduser elasticsearch root && \
@@ -243,7 +202,7 @@ ENV ELASTIC_CONTAINER true
243202
WORKDIR /usr/share/elasticsearch
244203
245204
COPY --from=builder --chown=0:0 /usr/share/elasticsearch /usr/share/elasticsearch
246-
<% if (docker_base != "wolfi" && docker_base != 'cloud_ess_fips') { %>
205+
<% if (docker_base != "wolfi") { %>
247206
COPY --from=builder --chown=0:0 /bin/tini /bin/tini
248207
<% } %>
249208
@@ -277,7 +236,7 @@ RUN chmod g=u /etc/passwd && \\
277236
# stays up-to-date with changes to Ubuntu's store)
278237
COPY bin/docker-openjdk /etc/ca-certificates/update.d/docker-openjdk
279238
RUN /etc/ca-certificates/update.d/docker-openjdk
280-
<% } else if (docker_base == 'wolfi' || docker_base == 'cloud_ess_fips') { %>
239+
<% } else if (docker_base == 'wolfi') { %>
281240
RUN ln -sf /etc/ssl/certs/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
282241
<% } else { %>
283242
RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
@@ -324,7 +283,7 @@ RUN mkdir /licenses && cp LICENSE.txt /licenses/LICENSE
324283
COPY LICENSE /licenses/LICENSE.addendum
325284
<% } %>
326285

327-
<% if (docker_base == "wolfi" || docker_base == 'cloud_ess_fips') { %>
286+
<% if (docker_base == "wolfi") { %>
328287
# Our actual entrypoint is `tini`, a minimal but functional init program. It
329288
# calls the entrypoint we provide, while correctly forwarding signals.
330289
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
@@ -343,13 +302,6 @@ USER 1000:0
343302
<% if (docker_base == 'iron_bank') { %>
344303
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD curl -I -f --max-time 5 http://localhost:9200 || exit 1
345304
<% } %>
346-
347-
<% if (docker_base == 'cloud_ess_fips') { %>
348-
COPY --from=builder --chown=0:0 /opt /opt
349-
ENV ES_PLUGIN_ARCHIVE_DIR /opt/plugins/archive
350-
WORKDIR /usr/share/elasticsearch
351-
COPY --from=builder --chown=0:0 /fips/libs/*.jar /usr/share/elasticsearch/lib/
352-
<% } %>
353305
################################################################################
354306
# End of multi-stage Dockerfile
355-
################################################################################
307+
################################################################################

0 commit comments

Comments
 (0)