PromucFlow_constructor/Dockerfile

70 lines
2.1 KiB
Docker
Raw Normal View History

ARG BASE
FROM ${BASE}
chore: Disallow plugin requests to localhost (#34250) The microservices that run inside the Appsmith container, trust each other, and may expose sensitive API endpoints to other internal microservices. These sensitive APIs aren't accessible by outside the Appsmith container, protected by Caddy's routing. This means that the backend server's ability to make user-configured HTTP requests, can lead to SSRFs to such sensitive API calls, if it's allowed to call APIs on localhost. In other words, Caddy establishes a trust boundary that protects these internal APIs from outside the container. But we lack such a trust boundary for the backend's plugins (API plugin, Elasticsearch plugin, etc.). This PR solves that. In this PR, we block both IPv4 and IPv6 loopback addresses. No additional changes needed on EE, no conflicts, and all unit and Cypress tests pass. **/test all** <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/9590358198> > Commit: 5445c70aa873942c3edae9fbfcc57a6d2554b815 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=9590358198&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `` <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved handling of disallowed hosts by dynamically computing based on environment variables, offering more flexibility and control. - **Refactor** - Enhanced the `makeWebClient()` method to use a more efficient approach for creating WebClient objects with custom configurations. - **Chores** - Added an `ENV` declaration for `IN_DOCKER` in the Dockerfile to better manage Docker-specific configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2024-06-20 05:30:22 +00:00
ENV IN_DOCKER=1
ARG APPSMITH_CLOUD_SERVICES_BASE_URL
ENV APPSMITH_CLOUD_SERVICES_BASE_URL=${APPSMITH_CLOUD_SERVICES_BASE_URL}
ARG APPSMITH_SEGMENT_CE_KEY
ENV APPSMITH_SEGMENT_CE_KEY=${APPSMITH_SEGMENT_CE_KEY}
COPY deploy/docker/fs /
chore: ab test simple git reset in git status api (#39959) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Git" ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/14197451933> > Commit: a3833fe0e894bcb155455947856e7de93bbb0640 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=14197451933&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Tue, 01 Apr 2025 14:54:53 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Introduced an enhanced Git operation that enables reliable repository reset through a dedicated API endpoint. - Enabled advanced reset options controllable via a new feature flag, improving repository state management. - **Chores** - Upgraded Git-related dependencies and updated the container setup to include Git, ensuring a consistent and robust environment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-04-01 16:06:08 +00:00
RUN apt-get update && \
feat: add git route aspect for branch handling (#41097) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.All" ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/16343398654> > Commit: f8257de8135f4243309143396eca2a81bdb6f2a3 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=16343398654&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 17 Jul 2025 12:14:40 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a new annotation to streamline and secure Git-related operations in application APIs. * Added a robust workflow for handling Git operations with enhanced concurrency control and error handling. * Enabled in-memory Git storage mode for improved performance in certain environments. * Added support for executing Git operations via shell scripts, including branch merging and repository management. * **Improvements** * Enhanced configuration flexibility for Git storage and Redis integration. * Improved error reporting with new, descriptive Git-related error messages. * Broadened environment file ignore patterns for better environment management. * **Bug Fixes** * Improved handling of private key formats for Git authentication. * **Documentation** * Added detailed documentation and flow diagrams for new Git operation workflows. * **Chores** * Updated build and test configurations to align with new Git storage paths. * Deprecated and bypassed certain Redis operations when using in-memory Git storage. * **Tests** * Removed several outdated or redundant test cases related to auto-commit and Git serialization. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-21 08:41:34 +00:00
apt-get install -y software-properties-common && \
add-apt-repository -y ppa:git-core/ppa && \
apt-get update && \
apt-get install -y git tar zstd openssh-client && \
chore: ab test simple git reset in git status api (#39959) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Git" ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/14197451933> > Commit: a3833fe0e894bcb155455947856e7de93bbb0640 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=14197451933&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Tue, 01 Apr 2025 14:54:53 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Introduced an enhanced Git operation that enables reliable repository reset through a dedicated API endpoint. - Enabled advanced reset options controllable via a new feature flag, improving repository state management. - **Chores** - Upgraded Git-related dependencies and updated the container setup to include Git, ensuring a consistent and robust environment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-04-01 16:06:08 +00:00
apt-get clean && \
rm -rf /var/lib/apt/lists/*
RUN <<END
feat: Make images adaptable to support both Postgres and MongoDB uris (#36424) ## Description PR to make the release tag adaptable to work with both MongoDB and PostgreSQL uris. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Introduced a new script to automate the preparation of server artifacts, improving the build process. - Added SQL files to the indentation configuration for consistent code formatting. - **Improvements** - Enhanced error handling in the Docker build process to ensure essential files are present before execution. - Updated service configuration logic to prevent misconfiguration based on the environment. - Added a new job step in the build workflow to prepare server artifacts after the build process. - Implemented conditional logic in the run script to dynamically adapt to different database configurations. - **Bug Fixes** - Adjusted the initialization process to focus on MongoDB, improving reliability in various environments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> /test Sanity ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/10940528231> > Commit: 32731e8a93a25e5c9456eb89daca2d8bf327c012 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=10940528231&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 19 Sep 2024 12:21:54 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No
2024-09-19 16:15:46 +00:00
if ! [ -f info.json ]; then
echo "Missing info.json" >&2
exit 1
fi
chore: Fix condition syntax in Dockerfile (#37270) ## Description The `&&` syntax for `and`-ing conditions doesn't work with `[` **command**, it only works with `[[` **expressions**. But we can't use `[[` expressions, since this isn't bash, it's `/bin/sh`. We can't use bash, since doing so is throwing up a whole lot of other errors that I've parked for another day, several months ago. Instead of `&&`, we have to use `-a` when using the `[` command. Currently, when building the Docker image, we see the following error: ``` #8 [3/6] RUN <<END (if ! [ -f info.json ]; then...) #8 0.142 /bin/sh: 6: [: missing ] #8 0.142 /bin/sh: 6: -f: not found ``` It doesn't seem to have an impact, but it _is_ an error nonetheless. We're also refactoring to not add the executable permission twice, which is redundant. We're only doing it once now. ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11718707642> > Commit: 6c739439fa181f41245294a46321544edf61e878 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11718707642&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 07 Nov 2024 09:18:50 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No /test sanity <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - **Chores** - Updated the Dockerfile to enhance file existence checks and manage executable permissions for shell scripts. - Removed unnecessary directory creation commands for `./editor` and `./rts`. - Maintained existing structure, including exposed ports and health check commands. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Arpit Mohan <mohanarpit@users.noreply.github.com>
2024-11-07 10:06:30 +00:00
if ! [ -f server/mongo/server.jar -a -f server/pg/server.jar ]; then
feat: Make images adaptable to support both Postgres and MongoDB uris (#36424) ## Description PR to make the release tag adaptable to work with both MongoDB and PostgreSQL uris. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Introduced a new script to automate the preparation of server artifacts, improving the build process. - Added SQL files to the indentation configuration for consistent code formatting. - **Improvements** - Enhanced error handling in the Docker build process to ensure essential files are present before execution. - Updated service configuration logic to prevent misconfiguration based on the environment. - Added a new job step in the build workflow to prepare server artifacts after the build process. - Implemented conditional logic in the run script to dynamically adapt to different database configurations. - **Bug Fixes** - Adjusted the initialization process to focus on MongoDB, improving reliability in various environments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> /test Sanity ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/10940528231> > Commit: 32731e8a93a25e5c9456eb89daca2d8bf327c012 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=10940528231&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 19 Sep 2024 12:21:54 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No
2024-09-19 16:15:46 +00:00
echo "Missing one or both server.jar files in the right place. Are you using the build script?" >&2
exit 1
fi
END
# Add client UI - Application Layer
COPY ./app/client/build editor/
# Add RTS - Application Layer
COPY ./app/client/packages/rts/dist rts/
feat: add git route aspect for branch handling (#41097) ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.All" ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/16343398654> > Commit: f8257de8135f4243309143396eca2a81bdb6f2a3 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=16343398654&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 17 Jul 2025 12:14:40 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a new annotation to streamline and secure Git-related operations in application APIs. * Added a robust workflow for handling Git operations with enhanced concurrency control and error handling. * Enabled in-memory Git storage mode for improved performance in certain environments. * Added support for executing Git operations via shell scripts, including branch merging and repository management. * **Improvements** * Enhanced configuration flexibility for Git storage and Redis integration. * Improved error reporting with new, descriptive Git-related error messages. * Broadened environment file ignore patterns for better environment management. * **Bug Fixes** * Improved handling of private key formats for Git authentication. * **Documentation** * Added detailed documentation and flow diagrams for new Git operation workflows. * **Chores** * Updated build and test configurations to align with new Git storage paths. * Deprecated and bypassed certain Redis operations when using in-memory Git storage. * **Tests** * Removed several outdated or redundant test cases related to auto-commit and Git serialization. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-21 08:41:34 +00:00
# Create the git-storage directory with group writeable permissions so non-root users can write to it.
RUN mkdir --mode 775 "/dev/shm/git-storage"
chore: Move appsmithctl to RTS (#37531) Move the `appsmithctl` code to RTS. RTS' own build system will build `appsmithctl` as well. We're adding two command scripts, `ctl` and `appsmithctl` to `/opt/bin`, which will be the entrypoints for this. The `appsmithctl` is now just an alias to the much shorter and non-redundancy-inducing `ctl`. We aren't migrating to TypeScript in this PR so we're ignoring the new `ctl` folder in both `tsconfig.json` and `.eslintrc`. That's temporary, the next PR will fix that. ## Automation /test sanity ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11930931528> > Commit: 90b5f97b801ac8d4b4b0126d85edff3dccc050bd > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11930931528&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Wed, 20 Nov 2024 10:36:02 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes - **New Features** - Introduced the `appsmithctl` command for easier command execution. - Updated build process to include additional entry points. - **Bug Fixes** - Streamlined Docker build process, enhancing efficiency and reducing complexity. - **Documentation** - Added a new section in the README for `appsmithctl` command description. - **Chores** - Updated dependencies in `package.json`. - Removed obsolete files and workflows to simplify project structure. - **Style** - Added a new ESLint configuration for specific project needs. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2024-11-20 15:28:38 +00:00
ENV PATH /opt/bin:/opt/java/bin:/opt/node/bin:$PATH
fix: False positive report GHSA-2jcg-qqmg-46q6 (#37269) ## Description Some scanner tools like Syft and Grype are reporting a **scary** false positive at GHSA-2jcg-qqmg-46q6, on the following file in the Docker image: ``` /opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json ``` The advisory itself isn't applicable to Appsmith, and this above package is not used in the product at all. This PR deletes this `test` folder so this false positive is immediately taken out. Nevertheless, we shouldn't even have the `node_modules` folder in the Docker image, and we should be "building" `appsmithctl` instead. That's part of a larger effort to improve/fix `appsmithctl` and will be coming up in future PRs. <details><summary><b>The SBOM entry for the package in Syft’s proprietary format</b></summary> <pre> { "id": "8686a02f6819d5a1", "name": "monorepo-symlink-test", "version": "0.0.0", "type": "npm", "foundBy": "javascript-package-cataloger", "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ], "licenses": [ { "value": "MIT", "spdxExpression": "MIT", "type": "declared", "urls": [], "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ] } ], "language": "javascript", "cpes": [ { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:npm/monorepo-symlink-test@0.0.0", "metadataType": "javascript-npm-package", "metadata": { "name": "monorepo-symlink-test", "version": "0.0.0", "author": "", "homepage": "", "description": "", "url": "", "private": true } } </pre> </details> Reported by a user. ⚠️ There will be conflicts on sync. Please do not merge unless the author of PR is available. /test sanity ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11715737322> > Commit: 42aa69c3de26d105a4184164f2ac9d18adce9b88 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11715737322&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 07 Nov 2024 03:26:39 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Enhanced the Dockerfile for improved build process and error handling. - Streamlined npm package installation and organized script execution for better readability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2024-11-07 04:49:15 +00:00
RUN <<END
set -o errexit
chore: Fix condition syntax in Dockerfile (#37270) ## Description The `&&` syntax for `and`-ing conditions doesn't work with `[` **command**, it only works with `[[` **expressions**. But we can't use `[[` expressions, since this isn't bash, it's `/bin/sh`. We can't use bash, since doing so is throwing up a whole lot of other errors that I've parked for another day, several months ago. Instead of `&&`, we have to use `-a` when using the `[` command. Currently, when building the Docker image, we see the following error: ``` #8 [3/6] RUN <<END (if ! [ -f info.json ]; then...) #8 0.142 /bin/sh: 6: [: missing ] #8 0.142 /bin/sh: 6: -f: not found ``` It doesn't seem to have an impact, but it _is_ an error nonetheless. We're also refactoring to not add the executable permission twice, which is redundant. We're only doing it once now. ### :mag: Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11718707642> > Commit: 6c739439fa181f41245294a46321544edf61e878 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11718707642&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 07 Nov 2024 09:18:50 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No /test sanity <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - **Chores** - Updated the Dockerfile to enhance file existence checks and manage executable permissions for shell scripts. - Removed unnecessary directory creation commands for `./editor` and `./rts`. - Maintained existing structure, including exposed ports and health check commands. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Arpit Mohan <mohanarpit@users.noreply.github.com>
2024-11-07 10:06:30 +00:00
# Make all `*.sh` files executable, excluding `node_modules`.
find . \( -name node_modules -prune \) -o \( -type f -name '*.sh' \) -exec chmod +x '{}' +
# Ensure all custom command-scripts have executable permission
chmod +x /opt/bin/* /watchtower-hooks/*.sh
fix: False positive report GHSA-2jcg-qqmg-46q6 (#37269) ## Description Some scanner tools like Syft and Grype are reporting a **scary** false positive at GHSA-2jcg-qqmg-46q6, on the following file in the Docker image: ``` /opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json ``` The advisory itself isn't applicable to Appsmith, and this above package is not used in the product at all. This PR deletes this `test` folder so this false positive is immediately taken out. Nevertheless, we shouldn't even have the `node_modules` folder in the Docker image, and we should be "building" `appsmithctl` instead. That's part of a larger effort to improve/fix `appsmithctl` and will be coming up in future PRs. <details><summary><b>The SBOM entry for the package in Syft’s proprietary format</b></summary> <pre> { "id": "8686a02f6819d5a1", "name": "monorepo-symlink-test", "version": "0.0.0", "type": "npm", "foundBy": "javascript-package-cataloger", "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ], "licenses": [ { "value": "MIT", "spdxExpression": "MIT", "type": "declared", "urls": [], "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ] } ], "language": "javascript", "cpes": [ { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:npm/monorepo-symlink-test@0.0.0", "metadataType": "javascript-npm-package", "metadata": { "name": "monorepo-symlink-test", "version": "0.0.0", "author": "", "homepage": "", "description": "", "url": "", "private": true } } </pre> </details> Reported by a user. ⚠️ There will be conflicts on sync. Please do not merge unless the author of PR is available. /test sanity ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11715737322> > Commit: 42aa69c3de26d105a4184164f2ac9d18adce9b88 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11715737322&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 07 Nov 2024 03:26:39 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Enhanced the Dockerfile for improved build process and error handling. - Streamlined npm package installation and organized script execution for better readability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2024-11-07 04:49:15 +00:00
# Disable setuid/setgid bits for the files inside container.
fix: False positive report GHSA-2jcg-qqmg-46q6 (#37269) ## Description Some scanner tools like Syft and Grype are reporting a **scary** false positive at GHSA-2jcg-qqmg-46q6, on the following file in the Docker image: ``` /opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json ``` The advisory itself isn't applicable to Appsmith, and this above package is not used in the product at all. This PR deletes this `test` folder so this false positive is immediately taken out. Nevertheless, we shouldn't even have the `node_modules` folder in the Docker image, and we should be "building" `appsmithctl` instead. That's part of a larger effort to improve/fix `appsmithctl` and will be coming up in future PRs. <details><summary><b>The SBOM entry for the package in Syft’s proprietary format</b></summary> <pre> { "id": "8686a02f6819d5a1", "name": "monorepo-symlink-test", "version": "0.0.0", "type": "npm", "foundBy": "javascript-package-cataloger", "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ], "licenses": [ { "value": "MIT", "spdxExpression": "MIT", "type": "declared", "urls": [], "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ] } ], "language": "javascript", "cpes": [ { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:npm/monorepo-symlink-test@0.0.0", "metadataType": "javascript-npm-package", "metadata": { "name": "monorepo-symlink-test", "version": "0.0.0", "author": "", "homepage": "", "description": "", "url": "", "private": true } } </pre> </details> Reported by a user. ⚠️ There will be conflicts on sync. Please do not merge unless the author of PR is available. /test sanity ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/11715737322> > Commit: 42aa69c3de26d105a4184164f2ac9d18adce9b88 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=11715737322&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 07 Nov 2024 03:26:39 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Enhanced the Dockerfile for improved build process and error handling. - Streamlined npm package installation and organized script execution for better readability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2024-11-07 04:49:15 +00:00
find / \( -path /proc -prune \) -o \( \( -perm -2000 -o -perm -4000 \) -exec chmod -s '{}' + \) || true
mkdir -p /.mongodb/mongosh /appsmith-stacks
chmod ugo+w /etc /appsmith-stacks
chmod -R ugo+w /var/run /.mongodb /etc/ssl /usr/local/share
END
LABEL com.centurylinklabs.watchtower.lifecycle.pre-check=/watchtower-hooks/pre-check.sh
LABEL com.centurylinklabs.watchtower.lifecycle.pre-update=/watchtower-hooks/pre-update.sh
EXPOSE 80
EXPOSE 443
ENTRYPOINT [ "/opt/appsmith/entrypoint.sh" ]
2022-05-06 06:15:56 +00:00
HEALTHCHECK --interval=15s --timeout=15s --start-period=45s CMD "/opt/appsmith/healthcheck.sh"
CMD ["/usr/bin/supervisord", "-n"]