container-openbolt/Containerfile at main · OpenVoxProject/container-openbolt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
ARG BASE_IMAGE=docker.io/library/ruby:3.2-alpine

# Define gem versions once; each stage imports these global defaults below.
# renovate: depName=bundler datasource=rubygems
ARG RUBYGEM_BUNDLER=4.0.19
# renovate: depName=openbolt datasource=rubygems
ARG RUBYGEM_OPENBOLT=5.6.0

FROM $BASE_IMAGE AS builder

# Import the global gem version defaults into this stage.
ARG RUBYGEM_BUNDLER
ARG RUBYGEM_OPENBOLT

ENV RUBYGEM_BUNDLER=${RUBYGEM_BUNDLER}
ENV RUBYGEM_OPENBOLT=${RUBYGEM_OPENBOLT}

COPY openbolt/Gemfile /opt/openbolt/Gemfile

RUN apk update \
    && apk upgrade \
    && apk add --no-cache --update \
       alpine-sdk \
       yaml-dev \
       libffi-dev \
    && rm -rf /usr/local/lib/ruby/gems/*/gems/bundler-* \
    && rm -rf /usr/local/lib/ruby/gems/*/specifications/default/bundler-*.gemspec \
    && gem install bundler -v ${RUBYGEM_BUNDLER} \
    && cd /opt/openbolt \
    && bundle config set jobs $(nproc) \
    && bundle config set path /opt/openbolt/vendor/bundle \
    && bundle install --gemfile=/opt/openbolt/Gemfile \
    && bundle clean --force

###############################################################################

FROM $BASE_IMAGE AS final

LABEL org.label-schema.maintainer="Voxpupuli Team <voxpupuli@groups.io>" \
      org.label-schema.vendor="Voxpupuli" \
      org.label-schema.url="https://github.com/openvoxproject/container-openbolt" \
      org.label-schema.name="Vox Pupuli OpenBolt" \
      org.label-schema.license="AGPL-3.0-or-later" \
      org.label-schema.vcs-url="https://github.com/openvoxproject/container-openbolt" \
      org.label-schema.schema-version="1.0" \
      org.label-schema.dockerfile="/Containerfile"

# Import the global gem version defaults into this stage.
ARG RUBYGEM_BUNDLER
ARG RUBYGEM_OPENBOLT

ENV RUBYGEM_BUNDLER=${RUBYGEM_BUNDLER}
ENV RUBYGEM_OPENBOLT=${RUBYGEM_OPENBOLT}

# Bundler needs to know where the Gemfile and gems are located.
ENV BUNDLE_GEMFILE=/opt/openbolt/Gemfile
ENV BUNDLE_PATH=/opt/openbolt/vendor/bundle
ENV BUNDLE_APP_CONFIG=/opt/openbolt/vendor/bundle

# We set this to silence the warning that OpenBolt is installed as a gem.
ENV BOLT_GEM=true

RUN apk update \
    && apk upgrade \
    && gem install bundler -v ${RUBYGEM_BUNDLER} \
    # CVE fixes are installed in the OpenBolt bundle, so remove vulnerable default gems.
    && rm -rf /usr/local/lib/ruby/gems/*/gems/erb-* \
    && rm -rf /usr/local/lib/ruby/gems/*/specifications/default/erb-*.gemspec \
    && rm -rf /usr/local/lib/ruby/gems/*/gems/net-imap-* \
    && rm -rf /usr/local/lib/ruby/gems/*/specifications/net-imap-*.gemspec \
    && addgroup -g 1001 -S openbolt \
    && adduser -u 1001 -S -G openbolt openbolt \
    && mkdir /data \
    && chown openbolt:openbolt /data

COPY --from=builder /opt/openbolt /opt/openbolt
RUN chown openbolt:openbolt /opt/openbolt/Gemfile.lock

COPY Containerfile /

WORKDIR /data
USER openbolt

ENTRYPOINT [ "bundle", "exec", "bolt" ]
CMD [ "-h" ]