164d2e6b65
This fixes RTS build to use `esbuild`. 1. This means the whole `node_modules` won't need to be copied over to the Docker image. There's unused insignifant _test_ files in there, that don't add any value, but are causing irrelevant CVEs to be reported on our Docker image. See example at https://github.com/appsmithorg/appsmith-ee/pull/2349. 2. Much faster. Not that RTS build is our slow point, but still. Perhaps we can move client to `esbuild` too. 🙂 ## Why are we doing this? The current method of loading RTS into the Docker image means that _all_ contents of _all_ dependencies are copied over. The whole `node_modules`. But several of these packages include _test_ files too, that aren't needed at runtime at all. One of such test files is creating a false alert for a CVE on our Docker image. Has absolutely no relevance and impact, but it's there. To fix that, I [had to `rm -rf /opt/appsmith/rts/node_modules/*/test` in the Docker image](https://github.com/appsmithorg/appsmith-ee/pull/2349/files). This felt very hacky, and very dirty. It felt like we're introducing more debt and more duct tape around the current build process. So, `esbuild`. ## Where is `esbuild` coming from? We're using `esbuild` v0.18.20 only, while the latest is v0.19.3. We need to update `design-system`'s storybook dependency, I think, to get a more recent version of `esbuild`. I'm yet to figure this out and can use some help. 🙂
100 lines
4.2 KiB
Docker
100 lines
4.2 KiB
Docker
FROM ubuntu:20.04
|
|
|
|
LABEL maintainer="tech@appsmith.com"
|
|
|
|
# Set workdir to /opt/appsmith
|
|
WORKDIR /opt/appsmith
|
|
|
|
# The env variables are needed for Appsmith server to correctly handle non-roman scripts like Arabic.
|
|
ENV LANG C.UTF-8
|
|
ENV LC_ALL C.UTF-8
|
|
|
|
# Update APT packages - Base Layer
|
|
RUN apt-get update \
|
|
&& apt-get upgrade --yes \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
|
|
supervisor curl cron nfs-common nginx nginx-extras gnupg wget netcat openssh-client \
|
|
gettext \
|
|
python3-pip python3-venv git ca-certificates-java \
|
|
&& wget -O - https://packages.adoptium.net/artifactory/api/gpg/key/public | apt-key add - \
|
|
&& echo "deb https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | tee /etc/apt/sources.list.d/adoptium.list \
|
|
&& apt-get update && apt-get install --no-install-recommends --yes temurin-17-jdk \
|
|
&& pip install --no-cache-dir git+https://github.com/coderanger/supervisor-stdout@973ba19967cdaf46d9c1634d1675fc65b9574f6e \
|
|
&& python3 -m venv --prompt certbot /opt/certbot/venv \
|
|
&& /opt/certbot/venv/bin/pip install --upgrade certbot setuptools pip \
|
|
&& ln -s /opt/certbot/venv/bin/certbot /usr/local/bin \
|
|
&& apt-get remove --yes git python3-pip python3-venv \
|
|
&& apt-get autoremove --yes
|
|
|
|
# Install MongoDB v5.0.14, Redis, NodeJS - Service Layer, PostgreSQL v13
|
|
RUN curl --silent --show-error --location https://www.mongodb.org/static/pgp/server-5.0.asc | apt-key add - \
|
|
&& echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-5.0.list \
|
|
&& curl --silent --show-error --location https://deb.nodesource.com/setup_18.x | bash - \
|
|
&& echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list \
|
|
&& curl --silent --show-error --location https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - \
|
|
&& apt update \
|
|
&& apt-get install --no-install-recommends --yes mongodb-org nodejs redis build-essential postgresql-13 \
|
|
&& apt-get clean \
|
|
# This is to get semver 7.5.2, for a CVE fix, might be able to remove it with later versions on NodeJS.
|
|
&& npm install -g npm@9.7.2
|
|
|
|
# Clean up cache file - Service layer
|
|
RUN rm -rf \
|
|
/root/.cache \
|
|
/root/.npm \
|
|
/root/.pip \
|
|
/usr/local/share/doc \
|
|
/usr/share/doc \
|
|
/usr/share/man \
|
|
/var/lib/apt/lists/* \
|
|
/tmp/*
|
|
|
|
# Define volumes - Service Layer
|
|
VOLUME [ "/appsmith-stacks" ]
|
|
|
|
# ------------------------------------------------------------------------
|
|
ENV TMP="/tmp/appsmith"
|
|
ENV NGINX_WWW_PATH="$TMP/www"
|
|
|
|
# Add backend server - Application Layer
|
|
ARG JAR_FILE=./app/server/dist/server-*.jar
|
|
ARG PLUGIN_JARS=./app/server/dist/plugins/*.jar
|
|
|
|
ARG APPSMITH_CLOUD_SERVICES_BASE_URL
|
|
ENV APPSMITH_CLOUD_SERVICES_BASE_URL=${APPSMITH_CLOUD_SERVICES_BASE_URL}
|
|
|
|
ARG APPSMITH_SEGMENT_CE_KEY
|
|
ENV APPSMITH_SEGMENT_CE_KEY=${APPSMITH_SEGMENT_CE_KEY}
|
|
#Create the plugins directory
|
|
RUN mkdir -p ./editor ./rts ./backend/plugins
|
|
|
|
COPY deploy/docker/fs /
|
|
|
|
#Add the jar to the container
|
|
COPY ${JAR_FILE} backend/server.jar
|
|
COPY ${PLUGIN_JARS} backend/plugins/
|
|
|
|
# Add client UI - Application Layer
|
|
COPY ./app/client/build editor/
|
|
|
|
# Add RTS - Application Layer
|
|
COPY ./app/client/packages/rts/dist rts/
|
|
|
|
RUN cd ./utils && npm install --only=prod && npm install --only=prod -g . && cd - \
|
|
&& chmod 0644 /etc/cron.d/* \
|
|
&& chmod +x entrypoint.sh renew-certificate.sh healthcheck.sh templates/nginx-app.conf.sh /watchtower-hooks/*.sh \
|
|
# Disable setuid/setgid bits for the files inside container.
|
|
&& find / \( -path /proc -prune \) -o \( \( -perm -2000 -o -perm -4000 \) -print -exec chmod -s '{}' + \) || true \
|
|
&& node prepare-image.mjs
|
|
|
|
# Update path to load appsmith utils tool as default
|
|
ENV PATH /opt/appsmith/utils/node_modules/.bin:$PATH
|
|
LABEL com.centurylinklabs.watchtower.lifecycle.pre-check=/watchtower-hooks/pre-check.sh
|
|
LABEL com.centurylinklabs.watchtower.lifecycle.pre-update=/watchtower-hooks/pre-update.sh
|
|
|
|
EXPOSE 80
|
|
EXPOSE 443
|
|
ENTRYPOINT [ "/opt/appsmith/entrypoint.sh" ]
|
|
HEALTHCHECK --interval=15s --timeout=15s --start-period=45s CMD "/opt/appsmith/healthcheck.sh"
|
|
CMD ["/usr/bin/supervisord", "-n"]
|