Skip to content
This repository was archived by the owner on Jan 22, 2025. It is now read-only.

Commit 41ad75e

Browse files
teutat3smmou
teutat3s
and
mmou
committed
Add alpine dockerimage (#70)
* switch to alpine Dockerfile * remove unused kbfsfuse from generate script * switch to kbfsfuse built from source for alpine * correct entrypoint paths for alpine Dockerfile * remove redundant 2nd build from make serve * fix env.sh in Dockerfile and entrypoint scripts * fix tests for alpine Dockerfile * clean up teutat3s changes * fix oneshot command * remove mention of env.sh Co-authored-by: M Ember Mou <mmou@keyba.se>
1 parent 20cee26 commit 41ad75e

6 files changed

Lines changed: 59 additions & 54 deletions

File tree

‎docker/Dockerfile-ca‎

Lines changed: 43 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,49 @@
1-
# This dockerfile builds a container capable of running the SSH CA bot. Note that a lot of this code is duplicated
2-
# between this file and Dockerfile-kssh.
3-
FROM ubuntu:18.04
4-
5-
# Dependencies
6-
RUN apt-get -qq update
7-
RUN apt-get -qq install curl software-properties-common ca-certificates gnupg -y
8-
RUN useradd -ms /bin/bash keybase
9-
USER keybase
10-
WORKDIR /home/keybase
1+
# This dockerfile builds a container capable of running the SSH CA bot.
112

12-
# Download and verify the deb
13-
# Key fingerprint from https://keybase.io/docs/server_security/our_code_signing_key
14-
RUN curl --remote-name https://prerelease.keybase.io/keybase_amd64.deb
15-
RUN curl --remote-name https://prerelease.keybase.io/keybase_amd64.deb.sig
16-
# Import our gpg key from our website. Pulling from key servers caused a flakey build so
17-
# we get the key from the Keybase website instead.
18-
RUN curl -sSL https://keybase.io/docs/server_security/code_signing_key.asc | gpg --import
19-
# This line will error if the fingerprint of the key in the file does not match the
20-
# known fingerprint of the our PGP key
21-
RUN gpg --fingerprint 222B85B0F90BE2D24CFEB93F47484E50656D16C7
22-
# And then verify the signature now that we have the key
23-
RUN gpg --verify keybase_amd64.deb.sig keybase_amd64.deb
24-
25-
# Silence the error from dpkg about failing to configure keybase since `apt-get install -f` fixes it
26-
USER root
27-
RUN dpkg -i keybase_amd64.deb || true
28-
RUN apt-get install -fy
29-
USER keybase
3+
FROM alpine:3.11 AS builder
304

31-
# Install go
32-
USER root
33-
RUN add-apt-repository ppa:gophers/archive -y
34-
RUN apt-get update
35-
RUN apt-get install golang-1.11-go git sudo -y
36-
USER keybase
5+
# add dependencies
6+
RUN apk update && apk add --no-cache go curl git musl-dev gcc
7+
8+
# build keybase binary
9+
WORKDIR /go
10+
ENV GOPATH=/go
11+
ENV KEYBASE_VERSION=5.0.0
12+
RUN go get -d github.com/keybase/client/go/keybase
13+
RUN cd src/github.com/keybase/client/go/keybase && git checkout v$KEYBASE_VERSION
14+
RUN go install -tags production github.com/keybase/client/go/keybase
15+
16+
# build kbfsfuse binary (we won't use FUSE but the bot needs KBFS for exchanging Team config files)
17+
RUN go install -tags production github.com/keybase/client/go/kbfs/kbfsfuse
3718

38-
# Install go dependencies (speeds up future builds)
39-
COPY --chown=keybase go.mod .
40-
COPY --chown=keybase go.sum .
41-
RUN /usr/lib/go-1.11/bin/go mod download
19+
# build keybaseca
20+
WORKDIR /bot-sshca
21+
COPY . ./
22+
RUN go build -o bin/keybaseca src/cmd/keybaseca/keybaseca.go
4223

43-
COPY --chown=keybase ./ /home/keybase/
24+
FROM alpine:3.11
4425

45-
RUN /usr/lib/go-1.11/bin/go build -o bin/keybaseca src/cmd/keybaseca/keybaseca.go
26+
# add bash for entrypoint scripts, ssh for ssh-keygen used by the bot, sudo for stepping down to keybase user
27+
RUN apk update && apk add --no-cache bash openssh sudo
4628

47-
USER root
29+
# add the keybase user
30+
RUN adduser -s /bin/bash -h /home/keybase -D keybase
31+
RUN chown keybase:keybase /home/keybase
32+
33+
# this folder is needed for kbfsfuse
34+
RUN mkdir /keybase && chown -R keybase:keybase /keybase
35+
36+
USER keybase
37+
WORKDIR /home/keybase
38+
39+
# copy the keybase binaries from previous build step
40+
COPY --from=builder --chown=keybase:keybase /go/bin/keybase /usr/local/bin/
41+
COPY --from=builder --chown=keybase:keybase /go/bin/kbfsfuse /usr/local/bin/
42+
COPY --from=builder --chown=keybase:keybase /bot-sshca/bin/keybaseca bin/
43+
44+
# copy in entrypoint scripts and env.sh
45+
COPY --chown=keybase:keybase ./docker ./
46+
47+
# Run container as root but only to be able to chown the Docker bind-mount,
48+
# then immediatetly step down to the keybase user via sudo in the entrypoint scripts
49+
USER root

‎docker/Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ build: reset-permissions
1515

1616
# Generate a new CA key
1717
generate: env-file-exists build
18-
docker run -e FORCE_WRITE=$(FORCE_WRITE) -v $(CURDIR)/example-keybaseca-volume:/mnt:rw ca:latest docker/entrypoint-generate.sh
18+
docker run -e FORCE_WRITE=$(FORCE_WRITE) -v $(CURDIR)/example-keybaseca-volume:/mnt:rw ca:latest ./entrypoint-generate.sh
1919
@echo -e "\nRun these commands on each server that you wish to use with the CA chatbot\n"
2020
@echo "useradd developer && mkdir -p /home/developer && chown developer:developer /home/developer # The user that will be used for non-root logins"
2121
@echo "echo \"`cat $(CURDIR)/example-keybaseca-volume/keybase-ca-key.pub`\" > /etc/ssh/ca.pub"
@@ -26,8 +26,8 @@ generate: env-file-exists build
2626
@echo -e "\nSee the getting started docs for information on how to define which teams are allowed to access which servers"
2727

2828
# Start the CA chatbot in the background
29-
serve: env-file-exists ca-key-exists build
30-
docker run -d --restart unless-stopped -v $(CURDIR)/example-keybaseca-volume:/mnt:rw ca:latest docker/entrypoint-server.sh
29+
serve: env-file-exists ca-key-exists
30+
docker run -d --restart unless-stopped -v $(CURDIR)/example-keybaseca-volume:/mnt:rw ca:latest ./entrypoint-server.sh
3131
@echo "Started CA bot service in the background... Use `docker ps` and `docker logs` to monitor it"
3232

3333
# Stop the service

‎docker/entrypoint-generate.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ chown -R keybase:keybase /mnt
77

88
# Run everything else as the keybase user
99
sudo -i -u keybase bash << EOF
10-
source docker/env.sh
10+
source ./env.sh
1111
export "FORCE_WRITE=$FORCE_WRITE"
12-
nohup bash -c "run_keybase -g 2>&1 | grep -v 'KBFS failed to FUSE mount' &"
12+
nohup bash -c "KEYBASE_RUN_MODE=prod kbfsfuse /keybase | grep -v 'ERROR Mounting the filesystem failed' &"
1313
sleep 3
14-
keybase oneshot --username \$KEYBASE_USERNAME --paperkey "\$KEYBASE_PAPERKEY"
14+
keybase oneshot
1515
bin/keybaseca generate
16-
EOF
16+
EOF

‎docker/entrypoint-server.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ chown -R keybase:keybase /mnt
77

88
# Run everything else as the keybase user
99
sudo -i -u keybase bash << EOF
10-
source docker/env.sh
11-
nohup bash -c "run_keybase -g 2>&1 | grep -v 'KBFS failed to FUSE mount' &"
10+
source ./env.sh
11+
nohup bash -c "KEYBASE_RUN_MODE=prod kbfsfuse /keybase | grep -v 'ERROR Mounting the filesystem failed' &"
1212
sleep 3
13-
keybase oneshot --username \$KEYBASE_USERNAME --paperkey "\$KEYBASE_PAPERKEY"
13+
keybase oneshot
1414
bin/keybaseca service
15-
EOF
15+
EOF

‎tests/Dockerfile-cabot‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,8 @@ FROM ca:latest
22

33
USER root
44

5-
RUN apt-get install python3 python3-pip gettext -y
5+
RUN apk add python3 py3-pip gettext
6+
RUN pip3 install --upgrade pip
67
RUN pip3 install flask
8+
9+
COPY --chown=keybase:keybase ./tests ./tests/

‎tests/bot-entrypoint.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ touch /shared/.keep
1010
mkdir -p tests/generated-env
1111
ls tests/envFiles/ | xargs -I {} -- bash -c 'cat tests/envFiles/{} | envsubst > tests/generated-env/{}'
1212

13-
nohup bash -c "run_keybase -g 2>&1 | grep -v 'KBFS failed to FUSE mount' &"
13+
nohup bash -c "KEYBASE_RUN_MODE=prod kbfsfuse /keybase | grep -v 'ERROR Mounting the filesystem failed' &"
1414
sleep 3
1515
keybase oneshot --username $BOT_USERNAME --paperkey "$BOT_PAPERKEY"
1616
touch /shared/ready

0 commit comments

Comments
 (0)