forked from ausaccessfed/reporting-service
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile
265 lines (218 loc) · 8.25 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
ARG BASE_IMAGE=""
# Version is pinned via .ruby-version
# hadolint ignore=DL3006
FROM ${BASE_IMAGE} AS base
WORKDIR $APP_DIR
COPY .FORCE_NEW_DOCKER_BUILD .FORCE_NEW_DOCKER_BUILD
ENV TORBA_HOME_PATH=/app/.torba
ENV LC_ALL="C.UTF-8"
ENV LANG="C.UTF-8"
ENV APP_NAME="AAF Reporting Service"
USER app
RUN mkdir -p ./public/assets \
sockets \
tmp/pids
USER root
RUN yum -y update \
&& yum install -y \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
jq-1.6-15.el9 \
&& yum -y clean all \
&& rm -rf /var/cache/yum
EXPOSE 3000
ENTRYPOINT ["/app/bin/boot.sh"]
CMD ["bundle exec puma"]
USER app
FROM base AS js-dependencies
USER root
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN yum -y update \
&& update-crypto-policies --set DEFAULT:SHA1 \
&& curl -fsSL https://rpm.nodesource.com/setup_21.x | bash - \
&& yum install -y \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64/nodejs:21
nodejs-21.1.0 \
# renovate: datasource=yum repo=rocky-9-extras-x86_64
epel-release-9-7.el9 \
&& update-crypto-policies --set DEFAULT \
&& yum install -y \
# renovate: datasource=yum repo=epel-9-everything-x86_64
yarnpkg-1.22.19-5.el9 \
&& yum -y clean all \
&& rm -rf /var/cache/yum
# use ldd to get required libs
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN ldd \
/usr/bin/node \
| tr -s "[:blank:]" "\n" | grep "^/" | sed "/\/usr\/bin\//d" | \
xargs -I % sh -c "mkdir -p /\$(dirname deps%); cp % /deps%;"
USER app
COPY --chown=app ./package.json ./yarn.lock ./
RUN yarn install
FROM base AS imagick-dependencies
USER root
RUN yum -y update \
&& yum -y install \
# renovate: datasource=yum repo=rocky-9-extras-x86_64
epel-release-9-7.el9 \
&& yum -y install \
--enablerepo=devel \
# renovate: datasource=yum repo=epel-9-everything-x86_64
ImageMagick-devel-6.9.13.14-1.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
advancecomp-2.5-1.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
gifsicle-1.95-1.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
jhead-3.06.0.1-5.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
jpegoptim-1.5.5-1.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
pngcrush-1.8.13-9.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
optipng-0.7.8-1.el9 \
# renovate: datasource=yum repo=epel-9-everything-x86_64
pngquant-2.17.0-2.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
libjpeg-turbo-utils-2.0.90-7.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
libjpeg-turbo-2.0.90-7.el9 \
&& yum -y clean all \
&& rm -rf /var/cache/yum
# uses ldd to get all deps of imagick, remove anything thats /usr/bin
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN ldd \
/usr/bin/mogrify \
/usr/bin/convert \
/usr/bin/pngcrush \
/usr/bin/jpegoptim \
/usr/lib64/libMagickCore-6.Q16.so.7 \
/usr/lib64/libmagic.so.1 \
# /usr/bin/libjpeg-turbo \
# /usr/bin/libjpeg-turbo-utils \
| tr -s "[:blank:]" "\n" | grep "^/" | sed "/\/usr\/bin\//d" | sed "/:/d" | \
xargs -I % sh -c "mkdir -p /\$(dirname deps%); cp % /deps%;"
USER app
FROM base AS dependencies
USER root
RUN yum -y update \
&& yum -y install \
# renovate: datasource=yum repo=rocky-9-extras-x86_64
epel-release-9-7.el9 \
&& yum install -y \
--enablerepo=devel \
# renovate: datasource=yum repo=epel-9-everything-x86_64
chromium-130.0.6723.58-1.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
libtool-2.4.6-45.el9 \
# renovate: datasource=yum repo=rocky-9-baseos-x86_64
make-4.3-8.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
automake-1.16.2-8.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
gcc-11.4.1-3.el9 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
gcc-c++-11.4.1-3.el9 \
# renovate: datasource=yum repo=rocky-9-baseos-x86_64
xz-5.2.5-8.el9_0 \
# renovate: datasource=yum repo=rocky-9-appstream-x86_64
kernel-devel-5.14.0-427.40.1.el9_4 \
# renovate: datasource=yum repo=rocky-9-crb-x86_64
mysql-devel-8.0.36-1.el9_3 \
# renovate: datasource=yum repo=rocky-9-baseos-x86_64
procps-ng-3.3.17-14.el9 \
&& yum -y clean all \
&& rm -rf /var/cache/yum
## Copy yarn, node for linting
COPY --from=js-dependencies /usr/bin/node /usr/lib/node_modules/npm/bin/npm /usr/bin/
COPY --from=js-dependencies /usr/lib/node_modules /usr/bin/node_modules
RUN ln -s /usr/bin/node_modules/yarn/bin/yarn /usr/bin/yarn
# TODO: we could save some space by being selective here
COPY --from=js-dependencies /app/node_modules/ ./node_modules/
COPY --from=js-dependencies /deps/lib64 /usr/lib64/
## Copy imagick deps
COPY --from=imagick-dependencies /usr/bin/convert \
/usr/bin/mogrify \
/usr/bin/
COPY --from=imagick-dependencies \
/usr/lib64/libMagickCore-6.Q16.so \
/usr/lib64/libMagickWand-6.Q16.so \
/usr/lib64/
COPY --from=imagick-dependencies /usr/lib64/pkgconfig /usr/lib64/pkgconfig
COPY --from=imagick-dependencies /usr/include/ImageMagick-6 /usr/include/ImageMagick-6
COPY --from=imagick-dependencies /usr/lib64/ImageMagick-6.9.13 /usr/lib64/ImageMagick-6.9.13
COPY --from=imagick-dependencies /etc/ImageMagick-6 /etc/ImageMagick-6
COPY --from=imagick-dependencies /deps/lib64 /usr/lib64/
USER app
COPY --chown=app ./Gemfile ./Gemfile.lock ./Torbafile ./
## is installing production gems
RUN bundle install \
&& rbenv rehash
RUN secret_key_base=1 bundle exec torba pack
## needed for precompile to run with prebuilt assets
COPY --chown=app ./config ./config
COPY --chown=app ./Rakefile ./Rakefile
COPY --chown=app ./app/assets ./app/assets
COPY --chown=app ./lib ./lib
COPY --chown=app ./app/helpers ./app/helpers
COPY --chown=app ./app/controllers/application_controller.rb ./app/controllers/application_controller.rb
RUN BUILD=true SECRET_KEY_BASE=TempSecretKey bundle exec rake assets:precompile
FROM dependencies AS development
ENV RAILS_ENV=development
ARG LOCAL_BUILD=false
USER root
RUN bundle config set --local without "non_docker"
RUN [ "${LOCAL_BUILD}" = "true" ] && bundle config set --local force_ruby_platform true || echo "not local"
USER app
RUN bundle install \
&& rbenv rehash
COPY --chown=app . .
ARG RELEASE_VERSION="VERSION_PROVIDED_ON_BUILD"
ENV RELEASE_VERSION=$RELEASE_VERSION
FROM base AS production
USER app
COPY --from=dependencies /opt/.rbenv /opt/.rbenv
COPY --from=dependencies ${APP_DIR}/public ${APP_DIR}/public
COPY --from=dependencies /usr/bin/node /usr/bin/
## Copy imagick deps
COPY --from=imagick-dependencies /usr/bin/convert \
/usr/bin/mogrify \
/usr/bin/
## Copy imagick deps
COPY --from=imagick-dependencies /usr/bin/convert \
/usr/bin/mogrify \
/usr/bin/
COPY --from=imagick-dependencies \
/usr/lib64/libMagickCore-6.Q16.so \
/usr/lib64/libMagickWand-6.Q16.so \
/usr/lib64/
COPY --from=imagick-dependencies /usr/lib64/pkgconfig /usr/lib64/pkgconfig
COPY --from=imagick-dependencies /usr/include/ImageMagick-6 /usr/include/ImageMagick-6
COPY --from=imagick-dependencies /usr/lib64/ImageMagick-6.9.13 /usr/lib64/ImageMagick-6.9.13
COPY --from=imagick-dependencies /etc/ImageMagick-6 /etc/ImageMagick-6
COPY --from=imagick-dependencies /deps/lib64 /usr/lib64/
COPY --from=dependencies \
/usr/lib64/mysql \
/usr/lib64/libprocps.so.8 \
/usr/lib64/
COPY --from=dependencies /usr/local/bundle /usr/local/bundle
COPY --from=dependencies /usr/sbin/pidof /usr/sbin/pidof
COPY --from=dependencies ${APP_DIR}/.torba ${APP_DIR}/.torba
COPY --chown=app . .
USER root
RUN rm -rf spec \
node_modules \
docs \
.yarn \
.cache \
/usr/local/bundle/cache/*.gem \
tmp/cache \
vendor/assets \
lib/assets \
&& find /opt/.rbenv/ -type f -regextype egrep -regex ".*(Dockerfile|docker-compose\.yml|\.vimrc)" -exec rm -f {} + \
&& find /opt/.rbenv/ -type d -regextype egrep -regex ".*(\.git|spec|dummy_rails|test\/rails_app)" -exec rm -rf {} + \
# Fix for https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#cis-di-0008
&& find / -path /proc -prune -o -perm /u=s,g=s -type f -print -exec rm {} \;
USER app
ARG RELEASE_VERSION="VERSION_PROVIDED_ON_BUILD"
ENV RELEASE_VERSION=$RELEASE_VERSION