Skip to content

Commit 5f07bce

Browse files
vitalykorolevvitalykorolev
authored
Merge pull request #316 from vitalykorolev/MLE-16553_combined-hardened-rootless
MLE-16553 combined hardened rootless
2 parents ecc665a + 11d5423 commit 5f07bce

13 files changed

+97
-419
lines changed

‎Jenkinsfile

+13-15
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ void copyRPMs() {
157157
RPMsuffix = ".nightly-rhel"
158158
}
159159
RPMbranch = "b11"
160-
RPMversion = "11.4"
160+
RPMversion = "11.3"
161161
}
162162
else if (marklogicVersion == "12") {
163163
//if dockerImageType contains "ubi9" then use nightly-rhel9 suffix
@@ -338,27 +338,25 @@ pipeline {
338338
skipStagesAfterUnstable()
339339
}
340340
triggers {
341-
parameterizedCron( env.BRANCH_NAME == 'develop' ? '''00 02 * * * % marklogicVersion=11;dockerImageType=ubi
342-
00 02 * * * % marklogicVersion=11;dockerImageType=ubi-rootless
343-
00 02 * * * % marklogicVersion=11;dockerImageType=ubi-rootless-hardened;SCAP_SCAN=true
344-
30 02 * * * % marklogicVersion=10;dockerImageType=ubi
345-
30 02 * * * % marklogicVersion=10;dockerImageType=ubi-rootless
346-
30 02 * * * % marklogicVersion=10;dockerImageType=ubi-rootless-hardened;SCAP_SCAN=true
347-
00 03 * * * % marklogicVersion=12;dockerImageType=ubi
348-
00 03 * * * % marklogicVersion=12;dockerImageType=ubi-rootless
349-
00 03 * * * % marklogicVersion=12;dockerImageType=ubi-rootless-hardened;SCAP_SCAN=true
350-
30 03 * * * % marklogicVersion=11;dockerImageType=ubi9
351-
30 03 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless
352-
30 03 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless-hardened;SCAP_SCAN=true''' : '')
341+
parameterizedCron( env.BRANCH_NAME == 'develop' ? '''00 02 * * * % marklogicVersion=10;dockerImageType=ubi
342+
00 02 * * * % marklogicVersion=10;dockerImageType=ubi-rootless;SCAP_SCAN=true
343+
00 02 * * * % marklogicVersion=11;dockerImageType=ubi
344+
30 02 * * * % marklogicVersion=11;dockerImageType=ubi-rootless;SCAP_SCAN=true
345+
30 02 * * * % marklogicVersion=12;dockerImageType=ubi
346+
30 02 * * * % marklogicVersion=12;dockerImageType=ubi-rootless;SCAP_SCAN=true
347+
00 03 * * * % marklogicVersion=11;dockerImageType=ubi9
348+
00 03 * * * % marklogicVersion=11;dockerImageType=ubi9-rootless;SCAP_SCAN=true
349+
00 03 * * * % marklogicVersion=12;dockerImageType=ubi9
350+
00 03 * * * % marklogicVersion=12;dockerImageType=ubi9-rootless;SCAP_SCAN=true''' : '')
353351
}
354352
environment {
355353
QA_LICENSE_KEY = credentials('QA_LICENSE_KEY')
356354
}
357355

358356
parameters {
359357
string(name: 'emailList', defaultValue: emailList, description: 'List of email for build notification', trim: true)
360-
string(name: 'dockerVersion', defaultValue: '2.0.1', description: 'ML Docker version. This version along with ML rpm package version will be the image tag as {ML_Version}_{dockerVersion}', trim: true)
361-
choice(name: 'dockerImageType', choices: 'ubi-rootless\nubi\nubi-rootless-hardened\nubi9-rootless\nubi9\nubi9-rootless-hardened\ncentos', description: 'Platform type for Docker image. Will be made part of the docker image tag')
358+
string(name: 'dockerVersion', defaultValue: '2.1.0', description: 'ML Docker version. This version along with ML rpm package version will be the image tag as {ML_Version}_{dockerVersion}', trim: true)
359+
choice(name: 'dockerImageType', choices: 'ubi-rootless\nubi\nubi9-rootless\nubi9', description: 'Platform type for Docker image. Will be made part of the docker image tag')
362360
string(name: 'upgradeDockerImage', defaultValue: '', description: 'Docker image for testing upgrades. Defaults to ubi image if left blank.\n Currently upgrading to ubi-rotless is not supported hence the test is skipped when ubi-rootless image is provided.', trim: true)
363361
choice(name: 'marklogicVersion', choices: '11\n12\n10', description: 'MarkLogic Server Branch. used to pick appropriate rpm')
364362
string(name: 'ML_RPM', defaultValue: '', description: 'URL for RPM to be used for Image creation. \n If left blank nightly ML rpm will be used.\n Please provide Jenkins accessible path e.g. /project/engineering or /project/qa', trim: true)

‎Makefile

+5-14
Original file line numberDiff line numberDiff line change
@@ -17,26 +17,17 @@ build:
1717
cp NOTICE.txt src/NOTICE.txt
1818

1919
# rootless images use the same dependencies as ubi image so we copy the file
20-
ifeq ($(docker_image_type),ubi-rootless)
21-
cp dockerFiles/marklogic-deps-ubi\:base dockerFiles/marklogic-deps-ubi-rootless\:base
22-
endif
23-
ifeq ($(docker_image_type),ubi-rootless-hardened)
24-
cp dockerFiles/marklogic-deps-ubi\:base dockerFiles/marklogic-deps-ubi-rootless-hardened\:base
25-
endif
2620
ifeq ($(docker_image_type),ubi9)
2721
cp dockerFiles/marklogic-server-ubi\:base dockerFiles/marklogic-server-ubi9\:base
2822
endif
29-
ifeq ($(docker_image_type),ubi9-rootless)
23+
ifeq ($(findstring rootless,$(docker_image_type)),rootless)
24+
cp dockerFiles/marklogic-deps-ubi\:base dockerFiles/marklogic-deps-ubi-rootless\:base
3025
cp dockerFiles/marklogic-deps-ubi9\:base dockerFiles/marklogic-deps-ubi9-rootless\:base
3126
cp dockerFiles/marklogic-server-ubi-rootless\:base dockerFiles/marklogic-server-ubi9-rootless\:base
3227
endif
33-
ifeq ($(docker_image_type),ubi9-rootless-hardened)
34-
cp dockerFiles/marklogic-deps-ubi9\:base dockerFiles/marklogic-deps-ubi9-rootless-hardened\:base
35-
cp dockerFiles/marklogic-server-ubi-rootless-hardened\:base dockerFiles/marklogic-server-ubi9-rootless-hardened\:base
36-
endif
3728

3829
# retrieve and copy open scap hardening script
39-
ifeq ($(findstring hardened,$(docker_image_type)),hardened)
30+
ifeq ($(findstring rootless,$(docker_image_type)),rootless)
4031
[ -f scap-security-guide-${open_scap_version}.zip ] || curl -Lo scap-security-guide-${open_scap_version}.zip https://github.com/ComplianceAsCode/content/releases/download/v${open_scap_version}/scap-security-guide-${open_scap_version}.zip
4132
#UBI9 needs a different version of the remediation script
4233
ifeq ($(findstring ubi9,$(docker_image_type)),ubi9)
@@ -49,10 +40,10 @@ endif
4940

5041
# build the image
5142
cd src/; docker build ${docker_build_options} -t "${repo_dir}/marklogic-deps-${docker_image_type}:${dockerTag}" -f ../dockerFiles/marklogic-deps-${docker_image_type}:base .
52-
cd src/; docker build ${docker_build_options} -t "${repo_dir}/marklogic-server-${docker_image_type}:${dockerTag}" --build-arg BASE_IMAGE=${repo_dir}/marklogic-deps-${docker_image_type}:${dockerTag} --build-arg ML_RPM=${package} --build-arg ML_USER=marklogic_user --build-arg ML_DOCKER_VERSION=${dockerVersion} --build-arg ML_VERSION=${marklogicVersion} --build-arg ML_CONVERTERS=${converters} --build-arg BUILD_BRANCH=${build_branch} -f ../dockerFiles/marklogic-server-${docker_image_type}:base .
43+
cd src/; docker build ${docker_build_options} -t "${repo_dir}/marklogic-server-${docker_image_type}:${dockerTag}" --build-arg BASE_IMAGE=${repo_dir}/marklogic-deps-${docker_image_type}:${dockerTag} --build-arg ML_RPM=${package} --build-arg ML_USER=marklogic_user --build-arg ML_DOCKER_VERSION=${dockerVersion} --build-arg ML_VERSION=${marklogicVersion} --build-arg ML_CONVERTERS=${converters} --build-arg BUILD_BRANCH=${build_branch} --build-arg ML_DOCKER_TYPE=${docker_image_type} -f ../dockerFiles/marklogic-server-${docker_image_type}:base .
5344

5445
# remove temporary files
55-
rm -f dockerFiles/marklogic-deps-ubi-rootless\:base dockerFiles/marklogic-deps-ubi-rootless-hardened\:base dockerFiles/marklogic-deps-ubi9-rootless\:base dockerFiles/marklogic-deps-ubi9-rootless-hardened\:base dockerFiles/marklogic-server-ubi9-rootless-hardened\:base src/NOTICE.txt src/rhel-script-cis.sh
46+
rm -f dockerFiles/marklogic-deps-ubi-rootless\:base dockerFiles/marklogic-deps-ubi9-rootless\:base dockerFiles/marklogic-server-ubi9-rootless\:base dockerFiles/marklogic-server-ubi9\:base src/NOTICE.txt src/rhel-script-cis.sh
5647

5748
#***************************************************************************
5849
# strcture test docker images

‎NOTICE.txt

+15-8
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
MarkLogic® Docker Container Image v2.0
1+
MarkLogic® Docker Container Image v2.1.0
22

33
Copyright © 2022-2024 MarkLogic Corporation. MarkLogic and MarkLogic logo are trademarks or registered trademarks of MarkLogic Corporation in the United States and other countries. All other trademarks are the property of their respective owners.
44

@@ -10,9 +10,9 @@ Unless required by applicable law or agreed to in writing, software distributed
1010

1111
To the extent required by the applicable open-source license, a complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by MarkLogic Corporation. To obtain such source code, send an email to [email protected]. Please specify the product and version for which you are requesting source code.
1212

13-
MarkLogic® - Docker Container Image. If Licensee selects the option to download the Product in the Docker container image, then the Product will be provided in a Docker container image that in a separate layer also contains third-party software, RedHat UBI Docker Base Image 8 and its components (collectively, “RedHat UBI”), licensed under the RedHat EULA found here (https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf), together with the third-party licenses applicable to each component.
13+
MarkLogic® - Docker Container Image. If Licensee selects the option to download the Product in the Docker container image, then the Product will be provided in a Docker container image that in a separate layer also contains third-party software, RedHat UBI Docker Base Image 8 and its components and RedHat UBI Docker Base Image 9 and its components (collectively, “RedHat UBI”), licensed under the RedHat EULA found here (https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf) and , together with the third-party licenses applicable to each component.
1414

15-
Notwithstanding anything to the contrary in the MarkLogic end user license agreement, MarkLogic makes no representations or warranties and assumes no indemnification obligations in regard to RedHat UBI, its operation, or its security. User modifications to the version of RedHat UBI provided by MarkLogic in the Docker Image, while permitted under The RedHat EULA, may result in errors or instability in performance of the Product, which are not covered by MarkLogic under warranty or maintenance terms. The source code for RedHat UBI Docker Base Image 8 may be obtained at http://iue.progress.com/3dpartysoftwares/Pages/default.aspx, and source code for any of its third-party components covered by a license requiring that source code be made available may be obtained at https://catalog.redhat.com/software/containers/ubi8/5c647760bed8bd28d0e38f9f?architecture=amd64&image=6643ab9ff6bc4ca6c09fb093&container-tabs=packages.
15+
Notwithstanding anything to the contrary in the MarkLogic end user license agreement, MarkLogic makes no representations or warranties and assumes no indemnification obligations in regard to RedHat UBI, its operation, or its security. User modifications to the version of RedHat UBI provided by MarkLogic in the Docker Image, while permitted under The RedHat EULA, may result in errors or instability in performance of the Product, which are not covered by MarkLogic under warranty or maintenance terms. The source code for RedHat UBI Docker Base Image 8 may be obtained at http://iue.progress.com/3dpartysoftwares/Pages/default.aspx, and source code for any of its third-party components covered by a license requiring that source code be made available may be obtained at https://catalog.redhat.com/software/containers/ubi8/5c647760bed8bd28d0e38f9f?architecture=amd64&image=6643ab9ff6bc4ca6c09fb093&container-tabs=packages (for UBI Docker Base Image 8) and https://catalog.redhat.com/software/containers/ubi9/ubi/615bcf606feffc5384e8452e?container-tabs=packages (for UBI Docker Base Image 9).
1616

1717
Licensee is responsible for obtaining, at its own expense, any required licenses from Docker to deploy the Docker container image that contains the Product and RedHat UBI and any such deployment of the Product must comply with the terms and conditions of this Agreement.
1818

@@ -21,10 +21,11 @@ Licensee is responsible for obtaining, at its own expense, any required licenses
2121
Third Party Components
2222

2323
RedHat UBI Docker Base Image 8 (Commercial)
24-
robotframework 7.0 (Apache-2.0)
25-
robotframework-requests 0.9.7 (MIT)
26-
test (MIT)
27-
Tini 0.19.0 (MIT)
24+
RedHat UBI Docker Base Image 9 (Commercial)
25+
robotframework 7.0 (Apache-2.0)
26+
robotframework-requests 0.9.7 (MIT)
27+
test (MIT)
28+
Tini 0.19.0 (MIT)
2829

2930
Common Licenses
3031

@@ -34,13 +35,19 @@ Apache License, Version 2.0, January 2004 (Apache-2.0)
3435

3536
Third-Party Components
3637

37-
The following is a list of third-party components used by MarkLogic Docker Container Image v2.0 (last updated June 14, 2024):
38+
The following is a list of third-party components used by MarkLogic Docker Container Image v2.1.0 (last updated October 18, 2024):
3839

3940
RedHat UBI Docker Base Image 8
4041
https://catalog.redhat.com/software/containers/ubi8/5c647760bed8bd28d0e38f9f?architecture=amd64&image=6643ab9ff6bc4ca6c09fb093&container-tabs=gti
4142

4243
https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf
4344

45+
RedHat UBI Docker Base Image 9
46+
https://catalog.redhat.com/software/containers/ubi9/ubi/615bcf606feffc5384e8452e?container-tabs=packages
47+
48+
https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf
49+
50+
4451
robotframework 7.0 (Apache-2.0)
4552
https://pypi.org/pypi/robotframework
4653

0 commit comments

Comments
 (0)