53bcdafe91
What are we solving here? 1. Installing Java in the `Dockerfile` by using Adoptium's package repositories is fragile since they've started blocking some IP addresses used by GitHub Actions runners. We see a message like this: ``` Failed to fetch https://packages.adoptium.net/artifactory/deb/pool/main/t/temurin-17/temurin-17-jdk_17.0.8.1.0+1_amd64.deb 403 Forbidden [IP: 146.75.107.42 443] ``` We're seeing more and more cases of these and PRs are getting blocked. 2. Installing Java via `apt` also installs other packages like X11 libraries, that aren't really relevant to our usage of Java. Yet, these packages are present in our Docker image, and are the source of several CVEs to be reported by scanners on our Docker image. 3. This will give us control over trusted CA certificates, which we can now perform under `$TMP`, which aligns with our move towards supporting readonly root filesystem. Which is essentially not write to anything in the Docker image at runtime, except for under `/tmp` and `/appsmith-stacks`. This will help us move in that direction.
105 lines
4.3 KiB
Docker
105 lines
4.3 KiB
Docker
FROM ubuntu:20.04
|
|
|
|
LABEL maintainer="tech@appsmith.com"
|
|
|
|
# Set workdir to /opt/appsmith
|
|
WORKDIR /opt/appsmith
|
|
|
|
# The env variables are needed for Appsmith server to correctly handle non-roman scripts like Arabic.
|
|
ENV LANG C.UTF-8
|
|
ENV LC_ALL C.UTF-8
|
|
|
|
# Update APT packages - Base Layer
|
|
RUN apt-get update \
|
|
&& apt-get upgrade --yes \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
|
|
supervisor curl cron nfs-common nginx nginx-extras gnupg wget netcat openssh-client \
|
|
gettext \
|
|
python3-pip python3-venv git ca-certificates \
|
|
&& pip install --no-cache-dir git+https://github.com/coderanger/supervisor-stdout@973ba19967cdaf46d9c1634d1675fc65b9574f6e \
|
|
&& python3 -m venv --prompt certbot /opt/certbot/venv \
|
|
&& /opt/certbot/venv/bin/pip install --upgrade certbot setuptools pip \
|
|
&& ln -s /opt/certbot/venv/bin/certbot /usr/local/bin \
|
|
&& apt-get remove --yes git python3-pip python3-venv \
|
|
&& apt-get autoremove --yes
|
|
|
|
# Install MongoDB v5.0.14, Redis, NodeJS - Service Layer, PostgreSQL v13
|
|
RUN curl --silent --show-error --location https://www.mongodb.org/static/pgp/server-5.0.asc | apt-key add - \
|
|
&& echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | tee /etc/apt/sources.list.d/mongodb-org-5.0.list \
|
|
&& curl --silent --show-error --location https://deb.nodesource.com/setup_18.x | bash - \
|
|
&& echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list \
|
|
&& curl --silent --show-error --location https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - \
|
|
&& apt update \
|
|
&& apt-get install --no-install-recommends --yes mongodb-org nodejs redis postgresql-13 \
|
|
&& apt-get clean \
|
|
# This is to get semver 7.5.2, for a CVE fix, might be able to remove it with later versions on NodeJS.
|
|
&& npm install -g npm@9.7.2
|
|
|
|
# Install Java
|
|
RUN set -o xtrace \
|
|
&& mkdir -p /opt/java \
|
|
# Assets from https://github.com/adoptium/temurin17-binaries/releases
|
|
&& version="$(curl --write-out '%{redirect_url}' 'https://github.com/adoptium/temurin17-binaries/releases/latest' | sed 's,.*jdk-,,')" \
|
|
&& curl --location --output /tmp/java.tar.gz "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-$version/OpenJDK17U-jdk_$(uname -m | sed s/x86_64/x64/)_linux_hotspot_$(echo $version | tr + _).tar.gz" \
|
|
&& tar -xzf /tmp/java.tar.gz -C /opt/java --strip-components 1
|
|
|
|
# Clean up cache file - Service layer
|
|
RUN rm -rf \
|
|
/root/.cache \
|
|
/root/.npm \
|
|
/root/.pip \
|
|
/usr/local/share/doc \
|
|
/usr/share/doc \
|
|
/usr/share/man \
|
|
/var/lib/apt/lists/* \
|
|
/tmp/*
|
|
|
|
# Define volumes - Service Layer
|
|
VOLUME [ "/appsmith-stacks" ]
|
|
|
|
# ------------------------------------------------------------------------
|
|
ENV TMP="/tmp/appsmith"
|
|
ENV NGINX_WWW_PATH="$TMP/www"
|
|
|
|
# Add backend server - Application Layer
|
|
ARG JAR_FILE=./app/server/dist/server-*.jar
|
|
ARG PLUGIN_JARS=./app/server/dist/plugins/*.jar
|
|
|
|
ARG APPSMITH_CLOUD_SERVICES_BASE_URL
|
|
ENV APPSMITH_CLOUD_SERVICES_BASE_URL=${APPSMITH_CLOUD_SERVICES_BASE_URL}
|
|
|
|
ARG APPSMITH_SEGMENT_CE_KEY
|
|
ENV APPSMITH_SEGMENT_CE_KEY=${APPSMITH_SEGMENT_CE_KEY}
|
|
#Create the plugins directory
|
|
RUN mkdir -p ./editor ./rts ./backend/plugins
|
|
|
|
COPY deploy/docker/fs /
|
|
|
|
#Add the jar to the container
|
|
COPY ${JAR_FILE} backend/server.jar
|
|
COPY ${PLUGIN_JARS} backend/plugins/
|
|
|
|
# Add client UI - Application Layer
|
|
COPY ./app/client/build editor/
|
|
|
|
# Add RTS - Application Layer
|
|
COPY ./app/client/packages/rts/dist rts/
|
|
|
|
RUN cd ./utils && npm install --only=prod && npm install --only=prod -g . && cd - \
|
|
&& chmod 0644 /etc/cron.d/* \
|
|
&& chmod +x entrypoint.sh renew-certificate.sh healthcheck.sh templates/nginx-app.conf.sh /watchtower-hooks/*.sh \
|
|
# Disable setuid/setgid bits for the files inside container.
|
|
&& find / \( -path /proc -prune \) -o \( \( -perm -2000 -o -perm -4000 \) -print -exec chmod -s '{}' + \) || true \
|
|
&& node prepare-image.mjs
|
|
|
|
ENV PATH /opt/appsmith/utils/node_modules/.bin:/opt/java/bin:$PATH
|
|
|
|
LABEL com.centurylinklabs.watchtower.lifecycle.pre-check=/watchtower-hooks/pre-check.sh
|
|
LABEL com.centurylinklabs.watchtower.lifecycle.pre-update=/watchtower-hooks/pre-update.sh
|
|
|
|
EXPOSE 80
|
|
EXPOSE 443
|
|
ENTRYPOINT [ "/opt/appsmith/entrypoint.sh" ]
|
|
HEALTHCHECK --interval=15s --timeout=15s --start-period=45s CMD "/opt/appsmith/healthcheck.sh"
|
|
CMD ["/usr/bin/supervisord", "-n"]
|