NPO-Accounting/houdini
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
houdini/docker/build/Dockerfile

52 lines
3 KiB
Text
Raw Permalink Normal View History

docker: begin rewrite of Dockerfile setup for current instructions First step in rewriting the Dockerfile to match the current setup/installation/configuration instructions as found in README.md. First step it to comment out some of the later stuff, and begin setup of installing everything into /houdini (instead of /myapp) and doing everything under the houdini user.
2021-08-08 21:19:06 +00:00
# syntax=docker/dockerfile:1
Conservancy Houdini: use our bullseye build & our container name.
2021-08-08 21:23:24 +00:00
FROM bullseye-base
docker: begin rewrite of Dockerfile setup for current instructions First step in rewriting the Dockerfile to match the current setup/installation/configuration instructions as found in README.md. First step it to comment out some of the later stuff, and begin setup of installing everything into /houdini (instead of /myapp) and doing everything under the houdini user.
2021-08-08 21:19:06 +00:00
COPY script/build/debian/prebuild.sh houdini/script/build/debian/prebuild.sh
RUN houdini/script/build/debian/prebuild.sh
docker: Node/Yarn: install nodesource & yarn keys from local copy As an additional security measure, don't use the network version of setup_14.x. Instead, save nodesource and yarn keys locally and do the operations in the Dockerfile to install the keys. Then, simply do the apt install of the dependencies needed from both places. Keep a copy of the setup_14.x in the data directory as well. In future, it might be useful to have a script that compares the versions of that script and keys on the nodesource and yarn websites — mainly to semi-automatically verify if upstream details have changed.
2021-08-09 22:47:20 +00:00
# Use NodeSource for installation of Node 14.x
COPY --chown=root:root docker/data/nodesource.list /etc/apt/sources.list.d/nodesource.list
COPY --chown=root:root docker/data/nodesource.gpg.key /usr/share/keyrings/nodesource.gpg.key
RUN gpg --dearmor < /usr/share/keyrings/nodesource.gpg.key > /usr/share/keyrings/nodesource.gpg
RUN rm -f /usr/share/keyrings/nodesource.gpg.key
RUN chown root.root /usr/share/keyrings/nodesource.gpg
RUN chmod 644 /usr/share/keyrings/nodesource.gpg
# Use yarnkpkg for installation of Yarn
COPY --chown=root:root docker/data/yarn.list /etc/apt/sources.list.d/yarn.list
RUN chmod 644 /etc/apt/sources.list.d/yarn.list
COPY --chown=root:root docker/data/yarnpkg.gpg.key /usr/share/keyrings/yarnpkg.gpg.key
RUN gpg --dearmor < /usr/share/keyrings/yarnpkg.gpg.key > /usr/share/keyrings/yarnpkg.gpg
RUN rm -f /usr/share/keyrings/yarnpkg.gpg.key
RUN chown root.root /usr/share/keyrings/yarnpkg.gpg
RUN chmod 644 /usr/share/keyrings/yarnpkg.gpg
# Run script to put keys in place and install
docker: do not use `houdini` user account before it exists.
2021-08-10 01:44:15 +00:00
COPY --chown=root:root script/build/debian/node.sh houdini/script/build/debian/node.sh
docker: Node/Yarn: install nodesource & yarn keys from local copy As an additional security measure, don't use the network version of setup_14.x. Instead, save nodesource and yarn keys locally and do the operations in the Dockerfile to install the keys. Then, simply do the apt install of the dependencies needed from both places. Keep a copy of the setup_14.x in the data directory as well. In future, it might be useful to have a script that compares the versions of that script and keys on the nodesource and yarn websites — mainly to semi-automatically verify if upstream details have changed.
2021-08-09 22:47:20 +00:00
RUN houdini/script/build/debian/node.sh
# Switch to houdini user, rest of file run in as that user after created
docker: begin rewrite of Dockerfile setup for current instructions First step in rewriting the Dockerfile to match the current setup/installation/configuration instructions as found in README.md. First step it to comment out some of the later stuff, and begin setup of installing everything into /houdini (instead of /myapp) and doing everything under the houdini user.
2021-08-08 21:19:06 +00:00
RUN /sbin/useradd --home-dir /houdini --create-home --shell /bin/bash houdini
docker: rvm installation, but don't use get.rvm.io script. The README.md currently suggests these commands to install rvm: curl -sSL https://rvm.io/mpapis.asc | gpg --import - curl -sSL https://rvm.io/pkuczynski.asc | gpg --import - curl -sSL https://get.rvm.io | bash -s stable source $HOME/.rvm/scripts/rvm echo 'source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc rvm install 2.7.3 --disable-binary --with-jemalloc Instead of downloading the https://get.rvm.io script, just put the two keys in the repository and do the basic operations that are required, rather than grabbing a shell script from a website and just running it. Also, run `rvm autolibs disable` so that the `rvm` command, which does not run as root, will not seek to use sudo. I checked the Debian system requirements that `rvm requirements` was looking for, and added those to `script/build/debian/prebuild.sh`. Hopefully, the semantics of `rvm requirements` is that it will exit non-zero if some requirements are missing, which is the desired behavior, since it flags that `script/build/debian/prebuild.sh` must be updated.
2021-08-10 01:46:06 +00:00
RUN chown -R houdini.houdini /houdini
docker: begin rewrite of Dockerfile setup for current instructions First step in rewriting the Dockerfile to match the current setup/installation/configuration instructions as found in README.md. First step it to comment out some of the later stuff, and begin setup of installing everything into /houdini (instead of /myapp) and doing everything under the houdini user.
2021-08-08 21:19:06 +00:00
USER houdini
docker: rvm installation, but don't use get.rvm.io script. The README.md currently suggests these commands to install rvm: curl -sSL https://rvm.io/mpapis.asc | gpg --import - curl -sSL https://rvm.io/pkuczynski.asc | gpg --import - curl -sSL https://get.rvm.io | bash -s stable source $HOME/.rvm/scripts/rvm echo 'source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc rvm install 2.7.3 --disable-binary --with-jemalloc Instead of downloading the https://get.rvm.io script, just put the two keys in the repository and do the basic operations that are required, rather than grabbing a shell script from a website and just running it. Also, run `rvm autolibs disable` so that the `rvm` command, which does not run as root, will not seek to use sudo. I checked the Debian system requirements that `rvm requirements` was looking for, and added those to `script/build/debian/prebuild.sh`. Hopefully, the semantics of `rvm requirements` is that it will exit non-zero if some requirements are missing, which is the desired behavior, since it flags that `script/build/debian/prebuild.sh` must be updated.
2021-08-10 01:46:06 +00:00
# Install RVM 1.29.12
COPY --chown=houdini:houdini docker/data/rvm-mpapis.gpg.key /houdini/keys-for-rvm/rvm-mpapis.gpg.key
RUN gpg --import /houdini/keys-for-rvm/rvm-mpapis.gpg.key
COPY --chown=houdini:houdini docker/data/pkuczynski.gpg.key /houdini/keys-for-rvm/pkuczynski.gpg.key
RUN gpg --import /houdini/keys-for-rvm/pkuczynski.gpg.key
RUN curl --fail --location --max-redirs 10 --connect-timeout 30 --retry-delay 2 --retry 3 -sS --create-dirs --output /houdini/.rvm/archives/rvm-1.29.12.tgz https://github.com/rvm/rvm/archive/1.29.12.tar.gz
RUN curl --fail --location --max-redirs 10 --connect-timeout 30 --retry-delay 2 --retry 3 -sS --create-dirs --output /houdini/.rvm/archives/rvm-1.29.12.tgz.asc https://github.com/rvm/rvm/releases/download/1.29.12/1.29.12.tar.gz.asc
RUN gpg /houdini/.rvm/archives/rvm-1.29.12.tgz.asc
RUN mkdir -p /houdini/.rvm/src/rvm
RUN cd /houdini/.rvm/src/rvm && tar xzf /houdini/.rvm/archives/rvm-1.29.12.tgz --no-same-owner --strip-components 1
docker: run rvm install script from correct path
2021-08-10 17:36:10 +00:00
RUN cd /houdini/.rvm/src/rvm && ./scripts/install --path /houdini/.rvm
docker: rvm installation, but don't use get.rvm.io script. The README.md currently suggests these commands to install rvm: curl -sSL https://rvm.io/mpapis.asc | gpg --import - curl -sSL https://rvm.io/pkuczynski.asc | gpg --import - curl -sSL https://get.rvm.io | bash -s stable source $HOME/.rvm/scripts/rvm echo 'source "$HOME/.rvm/scripts/rvm"' >> ~/.bashrc rvm install 2.7.3 --disable-binary --with-jemalloc Instead of downloading the https://get.rvm.io script, just put the two keys in the repository and do the basic operations that are required, rather than grabbing a shell script from a website and just running it. Also, run `rvm autolibs disable` so that the `rvm` command, which does not run as root, will not seek to use sudo. I checked the Debian system requirements that `rvm requirements` was looking for, and added those to `script/build/debian/prebuild.sh`. Hopefully, the semantics of `rvm requirements` is that it will exit non-zero if some requirements are missing, which is the desired behavior, since it flags that `script/build/debian/prebuild.sh` must be updated.
2021-08-10 01:46:06 +00:00
ENV PATH="$PATH:/houdini/.rvm/bin"
RUN echo 'source "/houdini/.rvm/scripts/rvm"' >> ~/.bashrc
RUN rvm autolibs disable
RUN rvm requirements
RUN rvm install 2.7.3 --disable-binary --with-jemalloc
docker: begin rewrite of Dockerfile setup for current instructions First step in rewriting the Dockerfile to match the current setup/installation/configuration instructions as found in README.md. First step it to comment out some of the later stuff, and begin setup of installing everything into /houdini (instead of /myapp) and doing everything under the houdini user.
2021-08-08 21:19:06 +00:00
# COPY script/build/debian/postgres.sh houdini/script/build/debian/postgres.sh
# RUN houdini/script/build/debian/postgres.sh
# COPY gems /houdini/gems/
# WORKDIR /houdini
# COPY Gemfile /houdini/Gemfile
# COPY Gemfile.lock /houdini/Gemfile.lock
# RUN gem install bundler -v "~>1.0"
# RUN bundle install
# CMD rake -T
Reference in a new issue Copy permalink