Skip to content

Commit 0bcea86

Browse files
vyadhvyadh
committed
Refactored Dockerfile.base install into dedicated scripts
Additionally, this change: - Configures upfront to reduce number of apt updates - Removes use of lsb-release to allow simplification and avoid unnecessary dependencies in the base image (i.e. Python)
1 parent b8ce684 commit 0bcea86

File tree

4 files changed

+239
-84
lines changed

4 files changed

+239
-84
lines changed

‎Dockerfile.base

+4-84
Original file line numberDiff line numberDiff line change
@@ -2,94 +2,14 @@ FROM ubuntu:focal
22
LABEL maintainer="[email protected]"
33

44
ARG DUMB_INIT_VERSION="1.2.2"
5-
ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
6-
75
# TODO: remove git PPA and skopeo customizations for focal when focal hits EOL
86
ENV GIT_LFS_VERSION="3.2.0"
7+
98
ENV LANG=en_US.UTF-8
109
ENV LANGUAGE=en_US.UTF-8
1110
ENV LC_ALL=en_US.UTF-8
1211
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
1312
ENV DEBIAN_FRONTEND=noninteractive
14-
# hadolint ignore=SC2086,DL3015,DL3008,DL3013,SC2015
15-
RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
16-
&& apt-get update \
17-
&& apt-get install -y --no-install-recommends gnupg \
18-
&& ( \
19-
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
20-
|| apt-key adv --keyserver pgp.mit.edu --recv-keys ${GIT_CORE_PPA_KEY} \
21-
|| apt-key adv --keyserver keyserver.pgp.com --recv-keys ${GIT_CORE_PPA_KEY} \
22-
) \
23-
&& apt-get update \
24-
&& apt-get install -y --no-install-recommends \
25-
gnupg \
26-
lsb-release \
27-
curl \
28-
tar \
29-
unzip \
30-
zip \
31-
apt-transport-https \
32-
ca-certificates \
33-
sudo \
34-
gpg-agent \
35-
software-properties-common \
36-
build-essential \
37-
zlib1g-dev \
38-
zstd \
39-
gettext \
40-
libcurl4-openssl-dev \
41-
inetutils-ping \
42-
jq \
43-
wget \
44-
dirmngr \
45-
openssh-client \
46-
locales \
47-
python3-pip \
48-
python3-setuptools \
49-
python3-venv \
50-
python3 \
51-
dumb-init \
52-
nodejs \
53-
rsync \
54-
libpq-dev \
55-
gosu \
56-
pkg-config \
57-
&& DPKG_ARCH="$(dpkg --print-architecture)" \
58-
&& LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
59-
&& sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
60-
&& ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && (echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list ) || : ) \
61-
&& apt-get update \
62-
&& ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git ) \
63-
&& ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
64-
&& ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
65-
&& ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
66-
&& ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz /tmp/git-lfs-${GIT_LFS_VERSION}) \
67-
&& distro=$(lsb_release -is | awk '{print tolower($0)}') \
68-
&& mkdir -p /etc/apt/keyrings \
69-
&& ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
70-
&& version=$(lsb_release -cs | sed 's/trixie\|n\/a/bookworm/g') \
71-
&& ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
72-
&& apt-get update \
73-
&& apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated \
74-
&& echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose \
75-
&& ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "available in 20.10 and higher" && echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" | apt-key add - ) || : ) \
76-
&& apt-get update \
77-
&& ( apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
78-
&& GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
79-
&& GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
80-
&& curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
81-
&& YQ_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
82-
&& YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" | jq -r '.browser_download_url') \
83-
&& ( curl -s ${YQ_DOWNLOAD_URL} -L -o /tmp/yq.tar.gz && tar -xzf /tmp/yq.tar.gz -C /tmp && mv /tmp/yq_linux_${DPKG_ARCH} /usr/local/bin/yq) \
84-
&& PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
85-
&& PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url") \
86-
&& ( curl -L -o /tmp/powershell.tar.gz $PWSH_DOWNLOAD_URL && mkdir -p /opt/powershell && tar zxf /tmp/powershell.tar.gz -C /opt/powershell && chmod +x /opt/powershell/pwsh && ln -s /opt/powershell/pwsh /usr/bin/pwsh ) \
87-
&& rm -rf /var/lib/apt/lists/* \
88-
&& rm -rf /tmp/* \
89-
&& sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker \
90-
&& groupadd -g 121 runner \
91-
&& useradd -mr -d /home/runner -u 1001 -g 121 runner \
92-
&& usermod -aG sudo runner \
93-
&& usermod -aG docker runner \
94-
&& echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
95-
&& ( [[ -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list ]] && rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list || : )
13+
14+
COPY --chmod=700 build/ /tmp/build/
15+
RUN /tmp/build/install_base.sh

‎build/install_base.sh

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
function bootstrap_sources() {
6+
apt-get install -y --no-install-recommends \
7+
ca-certificates \
8+
curl \
9+
gnupg
10+
}
11+
12+
function install_tools_apt() {
13+
apt-get install -y --no-install-recommends \
14+
tar \
15+
unzip \
16+
zip \
17+
apt-transport-https \
18+
sudo \
19+
gpg-agent \
20+
software-properties-common \
21+
jq \
22+
dirmngr \
23+
locales \
24+
dumb-init \
25+
gosu \
26+
build-essential \
27+
zlib1g-dev \
28+
zstd \
29+
gettext \
30+
libcurl4-openssl-dev \
31+
inetutils-ping \
32+
wget \
33+
openssh-client \
34+
python3-pip \
35+
python3-setuptools \
36+
python3-venv \
37+
python3 \
38+
nodejs \
39+
rsync \
40+
libpq-dev \
41+
pkg-config
42+
}
43+
44+
function remove_caches() {
45+
rm -rf /var/lib/apt/lists/*
46+
rm -rf /tmp/*
47+
}
48+
49+
function setup_sudoers() {
50+
sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers
51+
echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
52+
}
53+
54+
echo en_US.UTF-8 UTF-8 >> /etc/locale.gen
55+
56+
scripts_dir=$(dirname "$0")
57+
. "$scripts_dir/sources.sh"
58+
. "$scripts_dir/tools.sh"
59+
60+
apt-get update
61+
bootstrap_sources
62+
configure_sources
63+
64+
apt-get update
65+
install_tools_apt
66+
install_tools
67+
remove_sources
68+
remove_caches
69+
70+
setup_sudoers
71+
groupadd -g 121 runner
72+
useradd -mr -d /home/runner -u 1001 -g 121 runner
73+
usermod -aG sudo runner
74+
usermod -aG docker runner

‎build/sources.sh

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
function configure_git() {
5+
source /etc/os-release
6+
7+
local GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
8+
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
9+
|| apt-key adv --keyserver pgp.mit.edu --recv-keys ${GIT_CORE_PPA_KEY} \
10+
|| apt-key adv --keyserver keyserver.pgp.com --recv-keys ${GIT_CORE_PPA_KEY}
11+
12+
( [[ "${VERSION_CODENAME}" == "focal" ]] \
13+
&& (echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list ) || : )
14+
}
15+
16+
function configure_docker() {
17+
source /etc/os-release
18+
19+
mkdir -p /etc/apt/keyrings
20+
curl -fsSL "https://download.docker.com/linux/$ID/gpg" | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
21+
22+
local version=$(echo "$VERSION_CODENAME" | sed 's/trixie\|n\/a/bookworm/g')
23+
local DPKG_ARCH="$(dpkg --print-architecture)"
24+
echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$ID ${version} stable" \
25+
| tee /etc/apt/sources.list.d/docker.list > /dev/null
26+
}
27+
28+
function configure_container_tools() {
29+
source /etc/os-release
30+
31+
( [[ "${VERSION_CODENAME}" == "focal" ]] \
32+
&& ( echo "available in 20.10 and higher" \
33+
&& echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" \
34+
| tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list \
35+
&& curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" \
36+
| apt-key add - ) || : )
37+
}
38+
39+
function configure_sources() {
40+
configure_git
41+
configure_docker
42+
configure_container_tools
43+
}
44+
45+
function remove_sources() {
46+
rm -f /etc/apt/sources.list.d/git-core.list
47+
rm -f /etc/apt/sources.list.d/docker.list
48+
rm -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
49+
}

‎build/tools.sh

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
function install_git() {
5+
( apt-get install -y --no-install-recommends git \
6+
|| apt-get install -t stable -y --no-install-recommends git )
7+
}
8+
9+
function install_liblttng_ust() {
10+
( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] \
11+
&& apt-get install -y --no-install-recommends liblttng-ust0 || : )
12+
13+
( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] \
14+
&& apt-get install -y --no-install-recommends liblttng-ust1 || : )
15+
}
16+
17+
function install_awscli() {
18+
( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
19+
&& unzip -q awscliv2.zip -d /tmp/ \
20+
&& /tmp/aws/install \
21+
&& rm awscliv2.zip \
22+
) \
23+
|| pip3 install --no-cache-dir awscli
24+
}
25+
26+
function install_gitlfs() {
27+
local DPKG_ARCH="$(dpkg --print-architecture)"
28+
29+
curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz
30+
tar -xzf /tmp/lfs.tar.gz -C /tmp
31+
/tmp/git-lfs-${GIT_LFS_VERSION}/install.sh
32+
rm -rf /tmp/lfs.tar.gz /tmp/git-lfs-${GIT_LFS_VERSION}
33+
}
34+
35+
function install_docker() {
36+
apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated
37+
38+
echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose
39+
chmod +x /usr/local/bin/docker-compose
40+
41+
sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
42+
}
43+
44+
function install_container_tools() {
45+
( apt-get install -y --no-install-recommends podman buildah skopeo || : )
46+
}
47+
48+
function install_githubcli() {
49+
local DPKG_ARCH="$(dpkg --print-architecture)"
50+
51+
GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
52+
https://api.github.com/repos/cli/cli/releases/latest \
53+
| jq -r '.tag_name' | sed 's/^v//g')
54+
55+
GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
56+
https://api.github.com/repos/cli/cli/releases/latest \
57+
| jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" \
58+
| jq -r '.browser_download_url')
59+
60+
curl -sSLo /tmp/ghcli.deb "${GH_CLI_DOWNLOAD_URL}"
61+
apt-get -y install /tmp/ghcli.deb
62+
rm /tmp/ghcli.deb
63+
}
64+
65+
function install_yq() {
66+
local DPKG_ARCH="$(dpkg --print-architecture)"
67+
68+
local YQ_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
69+
https://api.github.com/repos/mikefarah/yq/releases/latest \
70+
| jq -r '.tag_name' \
71+
| sed 's/^v//g')
72+
73+
local YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
74+
https://api.github.com/repos/mikefarah/yq/releases/latest \
75+
| jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" \
76+
| jq -r '.browser_download_url')
77+
78+
curl -s "${YQ_DOWNLOAD_URL}" -L -o /tmp/yq.tar.gz
79+
tar -xzf /tmp/yq.tar.gz -C /tmp
80+
mv /tmp/yq_linux_${DPKG_ARCH} /usr/local/bin/yq
81+
}
82+
83+
function install_powershell() {
84+
local DPKG_ARCH="$(dpkg --print-architecture)"
85+
86+
local PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
87+
https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
88+
| jq -r '.tag_name' \
89+
| sed 's/^v//g')
90+
91+
local PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
92+
https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
93+
| jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url")
94+
95+
curl -L -o /tmp/powershell.tar.gz "$PWSH_DOWNLOAD_URL"
96+
mkdir -p /opt/powershell
97+
tar zxf /tmp/powershell.tar.gz -C /opt/powershell
98+
chmod +x /opt/powershell/pwsh
99+
ln -s /opt/powershell/pwsh /usr/bin/pwsh
100+
}
101+
102+
function install_tools() {
103+
install_git
104+
install_liblttng_ust
105+
install_awscli
106+
install_gitlfs
107+
install_docker
108+
install_container_tools
109+
install_githubcli
110+
install_yq
111+
install_powershell
112+
}

0 commit comments

Comments
 (0)