From 2fed7b15d0bd1e325bd6698922130276aa3fb62a Mon Sep 17 00:00:00 2001 From: Sebastian Gode Date: Tue, 1 Sep 2026 11:50:23 +0000 Subject: [PATCH 1/2] Dockerfile with hardened image and GitHub Action --- .../docker-build-push-on-tag-or-release.yaml | 64 ++++++++++ .github/workflows/docker-build.yml | 109 ++++++++++++++++++ Dockerfile | 66 ++++++----- 3 files changed, 209 insertions(+), 30 deletions(-) create mode 100644 .github/workflows/docker-build-push-on-tag-or-release.yaml create mode 100644 .github/workflows/docker-build.yml diff --git a/.github/workflows/docker-build-push-on-tag-or-release.yaml b/.github/workflows/docker-build-push-on-tag-or-release.yaml new file mode 100644 index 0000000..0b4f320 --- /dev/null +++ b/.github/workflows/docker-build-push-on-tag-or-release.yaml @@ -0,0 +1,64 @@ +name: Docker Image Build on tag or release + +on: + push: + tags: + - '*' + release: + types: [published] + +env: + ORG: opentelekomcloud + PROJECT: apimon + +jobs: + push_if_tag: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: | + "${{ secrets.SWR_URL }}/t-cloud-public/${{ env.PROJECT }}" + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to SWR Registry + uses: docker/login-action@v3 + with: + registry: ${{ secrets.SWR_URL }} + username: ${{ secrets.SWR_USERNAME }} + password: ${{ secrets.SWR_PASSWORD }} + + - name: Login to Artifactory DHI + uses: docker/login-action@v3 + with: + registry: ${{ secrets.ARTIFACTORY_URL }} + username: ${{ secrets.ARTIFACTORY_AUTH_USERNAME }} + password: ${{ secrets.ARTIFACTORY_AUTH_PASSWORD }} + + - name: Build and push + id: build + uses: docker/build-push-action@v5 + with: + context: . + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + push: true + provenance: false + sbom: false + build-args: | + ARTIFACTORY_URL=${{ secrets.ARTIFACTORY_URL }} diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml new file mode 100644 index 0000000..968aee2 --- /dev/null +++ b/.github/workflows/docker-build.yml @@ -0,0 +1,109 @@ +name: Docker Image Build + +on: + pull_request: + types: + - opened + - closed + - edited + - reopened + - synchronize + +env: + ORG: opentelekomcloud + PROJECT: apimon + +jobs: + + build: + if: github.event.pull_request.merged == false + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Login to Artifactory DHI + uses: docker/login-action@v3 + with: + registry: ${{ secrets.ARTIFACTORY_URL }} + username: ${{ secrets.ARTIFACTORY_AUTH_USERNAME }} + password: ${{ secrets.ARTIFACTORY_AUTH_PASSWORD }} + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: | + "${{ secrets.SWR_URL }}/${{ env.PROJECT }}" + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build + uses: docker/build-push-action@v5 + with: + context: . + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + push: false + build-args: | + ARTIFACTORY_URL=${{ secrets.ARTIFACTORY_URL }} + + push_if_merged: + if: github.event.pull_request.merged == true + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Login to SWR Registry + uses: docker/login-action@v3 + with: + registry: ${{ secrets.SWR_URL }} + username: ${{ secrets.SWR_USERNAME }} + password: ${{ secrets.SWR_PASSWORD }} + + - name: Login to Artifactory DHI + uses: docker/login-action@v3 + with: + registry: ${{ secrets.ARTIFACTORY_URL }} + username: ${{ secrets.ARTIFACTORY_AUTH_USERNAME }} + password: ${{ secrets.ARTIFACTORY_AUTH_PASSWORD }} + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: | + "${{ secrets.SWR_URL }}/t-cloud-public/${{ env.PROJECT }}" + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push + uses: docker/build-push-action@v5 + with: + context: . + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + push: true + provenance: false + sbom: false + build-args: | + ARTIFACTORY_URL=${{ secrets.ARTIFACTORY_URL }} diff --git a/Dockerfile b/Dockerfile index 112af49..b2e8d56 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,53 +10,59 @@ # implied. # See the License for the specific language governing permissions and # limitations under the License. -FROM quay.io/fedora/fedora:38 + +# Base image is pulled from the DHI Artifactory mirror (hardened, non-root +# capable) rather than the public upstream. The mirror host is passed in as a +# build arg (ARTIFACTORY_URL) so the build works both locally and in CI where +# the secret is injected. +ARG ARTIFACTORY_URL=artifactory.devops.telekom.de +FROM ${ARTIFACTORY_URL}/dhi.io/python:3.11-debian13-dev LABEL description="StackMon component: APImon (OpenStack API monitoring) container" LABEL maintainer="StackMon members" -RUN dnf --disablerepo updates-modular --disablerepo fedora-modular \ - install -y git gcc nmap-ncat procps-ng net-tools xz \ - python3-devel python3-setuptools python3-pip \ - python3-sqlalchemy \ - python3-dns && dnf clean all +ENV DEBIAN_FRONTEND=noninteractive +# PEP 668: Debian 13 marks the system Python as externally managed, so pip +# refuses to install into it without this. +ENV PIP_BREAK_SYSTEM_PACKAGES=1 + +# Runtime + build dependencies (Debian 13 / trixie package names). +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + git \ + gcc \ + ncat \ + procps \ + iproute2 \ + xz-utils \ + python3-dev \ + python3-pip \ + python3-setuptools \ + python3-sqlalchemy \ + python3-dnspython \ + python3-psycopg2 && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* RUN git config --global user.email "apimon@test.com" RUN git config --global user.name "apimon" -RUN useradd apimon - -RUN mkdir -p /var/{lib/apimon,log/apimon,log/executor,log/scheduler} +# Create a dedicated, non-root user with a real home directory (the container +# runs as this user at the end). +RUN useradd -m -d /home/apimon apimon -RUN chown apimon:apimon /var/lib/apimon && chown -R apimon:apimon /var/log/apimon +RUN mkdir -p /var/lib/apimon /var/log/apimon /var/log/executor /var/log/scheduler +RUN chown -R apimon:apimon /var/lib/apimon /var/log/apimon /var/log/executor /var/log/scheduler WORKDIR /usr/app COPY ./requirements.txt /usr/app/requirements.txt -#RUN \ -# git clone https://github.com/opentelekomcloud/python-otcextensions && \ -# git clone https://github.com/ansible/ansible --branch stable-2.10 && \ -# git clone https://review.opendev.org/openstack/openstacksdk - -RUN pip3 install -r /usr/app/requirements.txt - -#RUN cd ansible && python3 setup.py install --user -#RUN cd openstacksdk && python3 setup.py install --force -#RUN cd python-otcextensions && python3 setup.py install --force +RUN pip install --no-cache-dir --break-system-packages -r /usr/app/requirements.txt ADD . /usr/app/apimon -# RUN cd openstacksdk \ -# && git fetch https://review.opendev.org/openstack/openstacksdk \ -# refs/changes/97/727097/7 \ -# && git checkout FETCH_HEAD \ -# && python3 setup.py install --user - -RUN cd apimon && python3 setup.py install - -RUN rm -rf /usr/app/{ansible,apimon,python-otcextensions} +RUN cd /usr/app/apimon && python3 setup.py install USER apimon - ENV HOME=/home/apimon From fc3ab5998ed6e39fe1ce7dafd8c1a1027db4ac0e Mon Sep 17 00:00:00 2001 From: Sebastian Gode Date: Tue, 1 Sep 2026 12:04:36 +0000 Subject: [PATCH 2/2] fix issue --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b2e8d56..1760345 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,7 +40,8 @@ RUN apt-get update && \ python3-setuptools \ python3-sqlalchemy \ python3-dnspython \ - python3-psycopg2 && \ + python3-psycopg2 \ + passwd && \ apt-get clean && \ rm -rf /var/lib/apt/lists/*