Skip to content

Commit 5de81d1

Browse files
pjbgfpjbgf
authored
Merge pull request #232 from pjbgf/scratch
Use scratch as base image
2 parents 87f29e5 + 6653991 commit 5de81d1

File tree

6 files changed

+69
-12
lines changed

6 files changed

+69
-12
lines changed

‎Dockerfile.dapper‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM registry.suse.com/bci/golang:1.19
1+
FROM registry.suse.com/bci/golang:1.21
22

33
# k3d and kubectl versions must be aligned with the Kubernetes versions
44
# set in tests/k3s-bench-test.yaml.

‎go.mod‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/rancher/cis-operator
22

3-
go 1.19
3+
go 1.21
44

55
require (
66
github.com/blang/semver v3.5.1+incompatible
@@ -69,6 +69,7 @@ require (
6969
github.com/spf13/pflag v1.0.5 // indirect
7070
github.com/spf13/viper v1.15.0 // indirect
7171
github.com/subosito/gotenv v1.4.2 // indirect
72+
golang.org/x/crypto/x509roots/fallback v0.0.0-20231030152948-74c2ba9521f1 // indirect
7273
golang.org/x/mod v0.9.0 // indirect
7374
golang.org/x/net v0.8.0 // indirect
7475
golang.org/x/oauth2 v0.5.0 // indirect

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,8 @@ golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPh
374374
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
375375
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
376376
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
377+
golang.org/x/crypto/x509roots/fallback v0.0.0-20231030152948-74c2ba9521f1 h1:wQ75dCmVn5ExryuIUzbi2MC1/10fUNIL1FP918r4jx8=
378+
golang.org/x/crypto/x509roots/fallback v0.0.0-20231030152948-74c2ba9521f1/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
377379
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
378380
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
379381
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=

‎main.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,16 @@ import (
2424

2525
cisoperatorapiv1 "github.com/rancher/cis-operator/pkg/apis/cis.cattle.io/v1"
2626
cisoperator "github.com/rancher/cis-operator/pkg/securityscan"
27+
28+
// Automatically sets fallback trusted x509 roots, in case they are
29+
// not available at runtime. This is required to establish trust
30+
// when deployed into a scratch container.
31+
_ "golang.org/x/crypto/x509roots/fallback"
32+
33+
// Embed a copy of the timezone database, so that it does not depend
34+
// on it being available at runtime.
35+
_ "time/tzdata"
36+
2737
corev1 "k8s.io/api/core/v1"
2838
)
2939

‎package/Dockerfile‎

Lines changed: 40 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,44 @@
1-
FROM registry.suse.com/bci/bci-busybox:15.5
1+
FROM registry.suse.com/bci/bci-busybox:15.5 as builder
22

3-
COPY bin/cis-operator /usr/bin/
3+
# There is no real need for containers to fully comply with the
4+
# Filesystem Hierarchy Standard (FHS). However, some applications
5+
# could malfunction if some specific basic dirs are not available.
6+
# Therefore, create top level structure.
7+
#
8+
# https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html
9+
RUN mkdir -p /final/boot && \
10+
mkdir -p /final/etc && \
11+
mkdir -p /final/home && \
12+
mkdir -p /final/lib && \
13+
mkdir -p /final/lib64 && \
14+
mkdir -p /final/media && \
15+
mkdir -p /final/mnt && \
16+
mkdir -p /final/opt && \
17+
mkdir -p /final/run && \
18+
mkdir -p /final/usr/sbin && \
19+
mkdir -p /final/var/lib/nobody
420

5-
USER 65535:65535
21+
# Some dirs require very specific permissions.
22+
RUN install -dv -m 0750 /final/root && \
23+
install -dv -m 1777 /final/tmp /final/var/tmp
24+
25+
# Keep name search configured in line with BCI.
26+
RUN cp /etc/nsswitch.conf /final/etc
27+
28+
# Differs from BCI, by removing /bin/sh from root:
29+
RUN echo "root:x:0:0:root:/root:/usr/bin/false\nnobody:x:65534:65534:nobody:/var/lib/nobody:/usr/bin/false" > /final/etc/passwd
30+
31+
RUN cp /etc/shadow /final/etc
32+
RUN cp /etc/group /final/etc
33+
34+
COPY bin/cis-operator /final/usr/bin/
35+
36+
FROM scratch as final
37+
38+
COPY --from=builder /final/ /
39+
40+
# Aligns nobody user ID with BCI.
41+
USER 65534:65534
42+
ENV PATH=/usr/bin
643

744
CMD ["cis-operator"]

‎scripts/build‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,20 @@ source $(dirname $0)/version
66
cd $(dirname $0)/..
77

88
mkdir -p bin
9+
10+
# Leans on Pure Go for the network stack and os/user. For more information:
11+
# - https://github.com/golang/go/blob/4cd201b14b6216e72ffa175747c20d1191e5eb57/src/net/net.go#L39-L81
12+
# - https://github.com/golang/go/blob/4cd201b14b6216e72ffa175747c20d1191e5eb57/src/os/user/user.go#L6-L17
13+
GO_TAGS="netgo osusergo"
14+
LINKFLAGS="-X github.com/rancher/cis-operator.Version=${VERSION}"
15+
LINKFLAGS="-X github.com/rancher/cis-operator.GitCommit=${COMMIT} ${LINKFLAGS}"
16+
917
if [ "$(uname)" = "Linux" ]; then
10-
OTHER_LINKFLAGS="-extldflags -static -s"
18+
LINKFLAGS="${LINKFLAGS} -extldflags -static -s -w"
1119
fi
12-
LINKFLAGS="-X github.com/rancher/cis-operator.Version=$VERSION"
13-
LINKFLAGS="-X github.com/rancher/cis-operator.GitCommit=$COMMIT $LINKFLAGS"
14-
CGO_ENABLED=0 go build -ldflags "$LINKFLAGS $OTHER_LINKFLAGS" -o bin/cis-operator
15-
if [ "$CROSS" = "true" ] && [ "$ARCH" = "amd64" ]; then
16-
GOOS=darwin go build -ldflags "$LINKFLAGS" -o bin/cis-operator-darwin
17-
GOOS=windows go build -ldflags "$LINKFLAGS" -o bin/cis-operator-windows
20+
21+
CGO_ENABLED=0 go build -trimpath -tags "${GO_TAGS}" -ldflags "${LINKFLAGS}" -o bin/cis-operator
22+
if [ "${CROSS}" = "true" ] && [ "${ARCH}" = "amd64" ]; then
23+
GOOS=darwin go build -trimpath -ldflags "${LINKFLAGS}" -o bin/cis-operator-darwin
24+
GOOS=windows go build -trimpath -ldflags "${LINKFLAGS}" -o bin/cis-operator-windows
1825
fi

0 commit comments

Comments
 (0)