Skip to content

Commit 49233f0

Browse files
lemeurhervelemeurherve
committed
move WAR and GPG verification to the intermediate image
1 parent 535081e commit 49233f0

File tree

4 files changed

+67
-74
lines changed

4 files changed

+67
-74
lines changed

‎alpine/hotspot/Dockerfile‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG ALPINE_TAG=3.23.2
22

3-
FROM alpine:"${ALPINE_TAG}" AS jre-build
3+
FROM alpine:"${ALPINE_TAG}" AS jre-and-war
44

55
ARG JAVA_VERSION=17.0.17_10
66

@@ -11,6 +11,7 @@ COPY jdk-download.sh /usr/bin/jdk-download.sh
1111

1212
RUN apk add --no-cache \
1313
ca-certificates \
14+
gnupg \
1415
jq \
1516
curl \
1617
&& rm -fr /var/cache/apk/* \
@@ -40,6 +41,20 @@ RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \
4041
--output /javaruntime; \
4142
fi
4243

44+
# Jenkins version being bundled in this docker image
45+
ARG JENKINS_VERSION=2.547
46+
# Can be used to customize where jenkins.war get downloaded from
47+
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
48+
49+
COPY jenkins.io-2026.key /war/jenkins-key.pub
50+
51+
# Not using ADD as it does not check Last-Modified header
52+
# see https://github.com/docker/docker/issues/8331
53+
RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
54+
&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
55+
&& gpg --import /war/jenkins-key.pub \
56+
&& gpg --verify --trust-model direct /war/jenkins.war.asc /war/jenkins.war
57+
4358
FROM alpine:"${ALPINE_TAG}" AS controller
4459

4560
RUN apk add --no-cache \
@@ -48,7 +63,6 @@ RUN apk add --no-cache \
4863
curl \
4964
git \
5065
git-lfs \
51-
gnupg \
5266
musl-locales \
5367
musl-locales-lang \
5468
openssh-client \
@@ -93,22 +107,6 @@ VOLUME $JENKINS_HOME
93107
# or config file with your custom jenkins Docker image.
94108
RUN mkdir -p ${REF}/init.groovy.d
95109

96-
# jenkins version being bundled in this docker image
97-
ARG JENKINS_VERSION
98-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
99-
100-
# Can be used to customize where jenkins.war get downloaded from
101-
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
102-
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
103-
104-
# could use ADD but this one does not check Last-Modified header
105-
# see https://github.com/docker/docker/issues/8331
106-
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
107-
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
108-
&& gpg --import /tmp/jenkins-key.pub \
109-
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
110-
&& rm -f /tmp/*
111-
112110
ENV JENKINS_UC=https://updates.jenkins.io
113111
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
114112
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
@@ -131,14 +129,17 @@ ENV COPY_REFERENCE_FILE_LOG=$JENKINS_HOME/copy_reference_file.log
131129

132130
ENV JAVA_HOME=/opt/java/openjdk
133131
ENV PATH="${JAVA_HOME}/bin:${PATH}"
134-
COPY --from=jre-build /javaruntime $JAVA_HOME
132+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
133+
COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war
135134

136135
USER ${user}
137136

138137
COPY jenkins-support /usr/local/bin/jenkins-support
139138
COPY jenkins.sh /usr/local/bin/jenkins.sh
140139
COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli
141140

141+
ARG JENKINS_VERSION=2.547
142+
142143
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins.sh"]
143144

144145
# metadata labels

‎debian/Dockerfile‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG TRIXIE_TAG=20251103
33
ARG DEBIAN_RELEASE_LINE=trixie
44
ARG DEBIAN_VERSION=20251117
55
ARG DEBIAN_VARIANT="-slim"
6-
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS jre-build
6+
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS jre-and-war
77

88
ARG JAVA_VERSION=17.0.17_10
99

@@ -16,6 +16,7 @@ RUN apt-get update \
1616
&& apt-get install --no-install-recommends -y \
1717
ca-certificates \
1818
curl \
19+
gnupg \
1920
jq \
2021
&& rm -rf /var/lib/apt/lists/* \
2122
&& /usr/bin/jdk-download.sh
@@ -44,15 +45,27 @@ RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \
4445
--output /javaruntime; \
4546
fi
4647

48+
# Jenkins version being bundled in this docker image
49+
ARG JENKINS_VERSION=2.547
50+
# Can be used to customize where jenkins.war get downloaded from
51+
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
52+
53+
COPY jenkins.io-2026.key /war/jenkins-key.pub
54+
55+
# Not using ADD as it does not check Last-Modified header
56+
# see https://github.com/docker/docker/issues/8331
57+
RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
58+
&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
59+
&& gpg --import /war/jenkins-key.pub \
60+
&& gpg --verify --trust-model direct /war/jenkins.war.asc /war/jenkins.war
61+
4762
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS controller
4863

4964
RUN apt-get update \
5065
&& apt-get install -y --no-install-recommends \
5166
ca-certificates \
5267
curl \
5368
git \
54-
gnupg \
55-
gpg \
5669
libfontconfig1 \
5770
libfreetype6 \
5871
procps \
@@ -107,22 +120,6 @@ VOLUME $JENKINS_HOME
107120
# or config file with your custom jenkins Docker image.
108121
RUN mkdir -p ${REF}/init.groovy.d
109122

110-
# jenkins version being bundled in this docker image
111-
ARG JENKINS_VERSION
112-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
113-
114-
# Can be used to customize where jenkins.war get downloaded from
115-
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
116-
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
117-
118-
# could use ADD but this one does not check Last-Modified header
119-
# see https://github.com/docker/docker/issues/8331
120-
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
121-
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
122-
&& gpg --import /tmp/jenkins-key.pub \
123-
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
124-
&& rm -f /tmp/*
125-
126123
ENV JENKINS_UC=https://updates.jenkins.io
127124
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
128125
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
@@ -145,14 +142,17 @@ ENV COPY_REFERENCE_FILE_LOG=$JENKINS_HOME/copy_reference_file.log
145142

146143
ENV JAVA_HOME=/opt/java/openjdk
147144
ENV PATH="${JAVA_HOME}/bin:${PATH}"
148-
COPY --from=jre-build /javaruntime $JAVA_HOME
145+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
146+
COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war
149147

150148
USER ${user}
151149

152150
COPY jenkins-support /usr/local/bin/jenkins-support
153151
COPY jenkins.sh /usr/local/bin/jenkins.sh
154152
COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli
155153

154+
ARG JENKINS_VERSION=2.547
155+
156156
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/jenkins.sh"]
157157

158158
# metadata labels

‎rhel/Dockerfile‎

Lines changed: 19 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG RHEL_TAG=9.7-1768785530
22
ARG RHEL_RELEASE_LINE=ubi9
3-
FROM registry.access.redhat.com/${RHEL_RELEASE_LINE}/ubi:${RHEL_TAG} AS jre-build
3+
FROM registry.access.redhat.com/${RHEL_RELEASE_LINE}/ubi:${RHEL_TAG} AS jre-and-war
44

55
ARG JAVA_VERSION=17.0.17_10
66

@@ -40,6 +40,20 @@ RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \
4040
--output /javaruntime; \
4141
fi
4242

43+
# Jenkins version being bundled in this docker image
44+
ARG JENKINS_VERSION=2.547
45+
# Can be used to customize where jenkins.war get downloaded from
46+
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
47+
48+
COPY jenkins.io-2026.key /war/jenkins-key.pub
49+
50+
# Not using ADD as it does not check Last-Modified header
51+
# see https://github.com/docker/docker/issues/8331
52+
RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
53+
&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
54+
&& gpg --import /war/jenkins-key.pub \
55+
&& gpg --verify --trust-model direct /war/jenkins.war.asc /war/jenkins.war
56+
4357
FROM registry.access.redhat.com/${RHEL_RELEASE_LINE}/ubi:${RHEL_TAG} AS controller
4458

4559
ENV LANG=C.UTF-8
@@ -97,27 +111,6 @@ RUN curl -fsSL "https://github.com/krallin/tini/releases/download/${TINI_VERSION
97111
&& rm -rf /sbin/tini.asc /root/.gnupg \
98112
&& chmod +x /sbin/tini
99113

100-
# jenkins version being bundled in this docker image
101-
ARG JENKINS_VERSION
102-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
103-
104-
# Can be used to customize where jenkins.war get downloaded from
105-
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
106-
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
107-
108-
# could use ADD but this one does not check Last-Modified header
109-
# see https://github.com/docker/docker/issues/8331
110-
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
111-
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
112-
&& gpg --import /tmp/jenkins-key.pub \
113-
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
114-
&& rm -f /tmp/*
115-
116-
ENV JENKINS_UC=https://updates.jenkins.io
117-
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
118-
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
119-
RUN chown -R ${user} "$JENKINS_HOME" "$REF"
120-
121114
ARG PLUGIN_CLI_VERSION=2.13.2
122115
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
123116
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
@@ -135,14 +128,17 @@ ENV COPY_REFERENCE_FILE_LOG=$JENKINS_HOME/copy_reference_file.log
135128

136129
ENV JAVA_HOME=/opt/java/openjdk
137130
ENV PATH="${JAVA_HOME}/bin:${PATH}"
138-
COPY --from=jre-build /javaruntime $JAVA_HOME
131+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
132+
COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war
139133

140134
USER ${user}
141135

142136
COPY jenkins-support /usr/local/bin/jenkins-support
143137
COPY jenkins.sh /usr/local/bin/jenkins.sh
144138
COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli
145139

140+
ARG JENKINS_VERSION=2.547
141+
146142
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins.sh"]
147143

148144
# metadata labels

‎windows/windowsservercore/hotspot/Dockerfile‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
ARG JAVA_VERSION=17.0.17_10
55
ARG WINDOWS_VERSION=ltsc2022
66

7-
FROM mcr.microsoft.com/windows/servercore:"${WINDOWS_VERSION}" AS jre-build
7+
FROM mcr.microsoft.com/windows/servercore:"${WINDOWS_VERSION}" AS jre-and-war
88

99
# $ProgressPreference: https://github.com/PowerShell/PowerShell/issues/2138#issuecomment-251261324
1010
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
@@ -53,16 +53,14 @@ RUN New-Item -ItemType Directory -Path C:/temp | Out-Null ; `
5353
Start-Process -FilePath C:/temp/gnupg.exe -ArgumentList '/S' -Wait ; `
5454
Remove-Item -Path C:\temp -Recurse | Out-Null
5555

56-
# jenkins version being bundled in this docker image
57-
ARG JENKINS_VERSION
58-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
59-
56+
# Jenkins version being bundled in this docker image
57+
ARG JENKINS_VERSION=2.547
6058
# Can be used to customize where jenkins.war get downloaded from
6159
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
6260
ENV WAR_URL=${WAR_URL}
6361
ENV WAR_ASC_URL=${WAR_URL}.asc
6462

65-
# could use ADD but this one does not check Last-Modified header
63+
# Not using ADD as it does not check Last-Modified header
6664
# # see https://github.com/docker/docker/issues/8331
6765
RUN New-Item -ItemType Directory -Path C:/war | Out-Null ; `
6866
Write-Host $env:WAR_URL; Invoke-WebRequest -Uri "$env:WAR_URL" -OutFile C:/war/jenkins.war ; `
@@ -79,8 +77,8 @@ FROM mcr.microsoft.com/windows/servercore:"${WINDOWS_VERSION}" AS controller
7977
ARG JAVA_HOME="C:/openjdk-17"
8078
ENV JAVA_HOME=${JAVA_HOME}
8179

82-
COPY --from=jre-build /javaruntime $JAVA_HOME
83-
COPY --from=jre-build /war/jenkins.war C:/ProgramData/Jenkins/jenkins.war
80+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
81+
COPY --from=jre-and-war /war/jenkins.war C:/ProgramData/Jenkins/jenkins.war
8482

8583
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
8684

@@ -125,10 +123,6 @@ USER ${user}
125123
# hadolint ignore=DL4006
126124
RUN New-Item -ItemType Directory -Force -Path C:/ProgramData/Jenkins/Reference/init.groovy.d | Out-Null
127125

128-
# jenkins version being bundled in this docker image
129-
ARG JENKINS_VERSION
130-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
131-
132126
ENV JENKINS_UC=https://updates.jenkins.io
133127
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
134128
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
@@ -152,6 +146,8 @@ COPY jenkins.ps1 C:/ProgramData/Jenkins
152146
# See https://github.com/jenkinsci/plugin-installation-manager-tool#cli-options for information on parameters for jenkins-plugin-cli.ps1 for installing plugins into the docker image
153147
COPY jenkins-plugin-cli.ps1 C:/ProgramData/Jenkins
154148

149+
ARG JENKINS_VERSION=2.547
150+
155151
ENTRYPOINT ["powershell.exe", "-f", "C:/ProgramData/Jenkins/jenkins.ps1"]
156152

157153
# metadata labels

0 commit comments

Comments
 (0)