Skip to content

Commit dee837c

Browse files
jc21jc21
committed
Use debian bookworm for base
- Updated node to v20 - Updated go to 1.21 and deps - Updated python, certbot and deps - Removed nancy from go image
1 parent ee96832 commit dee837c

File tree

9 files changed

+163
-60
lines changed

9 files changed

+163
-60
lines changed

‎.jenkins/Jenkinsfile‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,12 @@ pipeline {
2929
}
3030
steps {
3131
script {
32-
env.BASE_TAG = 'latest'
33-
env.BUILDX_PUSH_TAGS = "-t docker.io/jc21/${IMAGE}:${BASE_TAG}"
34-
env.BUILDX_PUSH_TAGS_ACMESH = "-t docker.io/jc21/${IMAGE}:acmesh"
35-
env.BUILDX_PUSH_TAGS_CERTBOT = "-t docker.io/jc21/${IMAGE}:certbot"
36-
env.BUILDX_PUSH_TAGS_ACMESH_GOLANG = "-t docker.io/jc21/${IMAGE}:acmesh-golang"
37-
env.BUILDX_PUSH_TAGS_CERTBOT_NODE = "-t docker.io/jc21/${IMAGE}:certbot-node"
32+
env.BASE_IMAGE = "jc21/${IMAGE}:latest"
33+
env.BUILDX_PUSH_TAGS = "-t ${BASE_IMAGE}"
34+
env.BUILDX_PUSH_TAGS_ACMESH = "-t jc21/${IMAGE}:acmesh"
35+
env.BUILDX_PUSH_TAGS_CERTBOT = "-t jc21/${IMAGE}:certbot"
36+
env.BUILDX_PUSH_TAGS_ACMESH_GOLANG = "-t jc21/${IMAGE}:acmesh-golang"
37+
env.BUILDX_PUSH_TAGS_CERTBOT_NODE = "-t jc21/${IMAGE}:certbot-node"
3838
}
3939
}
4040
}
@@ -47,10 +47,10 @@ pipeline {
4747
steps {
4848
script {
4949
// Defaults to the Branch name, which is applies to all branches AND pr's
50-
env.BASE_TAG = "github-${BRANCH_LOWER}"
51-
env.ACMESH_BASE_TAG = "github-${BRANCH_LOWER}-acmesh"
52-
env.CERTBOT_BASE_TAG = "github-${BRANCH_LOWER}-certbot"
53-
env.BUILDX_PUSH_TAGS = "-t docker.io/jc21/${IMAGE}:${BASE_TAG}"
50+
env.BASE_IMAGE = "jc21/${IMAGE}:github-${BRANCH_LOWER}"
51+
env.ACMESH_IMAGE = "${BASE_IMAGE}-acmesh"
52+
env.CERTBOT_IMAGE = "${BASE_IMAGE}-certbot"
53+
env.BUILDX_PUSH_TAGS = "-t ${BASE_IMAGE}"
5454
env.BUILDX_PUSH_TAGS_ACMESH = "${BUILDX_PUSH_TAGS}-acmesh"
5555
env.BUILDX_PUSH_TAGS_CERTBOT = "${BUILDX_PUSH_TAGS}-certbot"
5656
env.BUILDX_PUSH_TAGS_ACMESH_GOLANG = "${BUILDX_PUSH_TAGS}-acmesh-golang"

‎docker/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Nginx Builder
33
#############
44

5-
FROM debian:buster-slim as nginxbuilder
5+
FROM debian:bookworm-slim as nginxbuilder
66

77
ARG OPENRESTY_VERSION
88
ARG LUA_VERSION
@@ -33,13 +33,13 @@ RUN /tmp/build-openresty
3333
# Final Image
3434
#############
3535

36-
FROM debian:buster-slim
36+
FROM debian:bookworm-slim as final
3737
LABEL maintainer="Jamie Curnow <jc@jc21.com>"
3838

3939
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
4040

4141
ARG TARGETPLATFORM
42-
RUN echo "Base: debian:buster-slim, ${TARGETPLATFORM:-linux/amd64}" > /built-for-arch
42+
RUN echo "Base: debian:bookworm-slim, ${TARGETPLATFORM:-linux/amd64}" > /built-for-arch
4343

4444
# OpenResty uses LuaJIT which has a dependency on GCC
4545
RUN apt-get update \
@@ -51,7 +51,7 @@ RUN apt-get update \
5151
jq \
5252
libncurses6 \
5353
libpcre3 \
54-
libreadline7 \
54+
libreadline8 \
5555
openssl \
5656
perl \
5757
tzdata \

‎docker/Dockerfile.acmesh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
1-
FROM jc21/nginx-full:${BASE_TAG:-latest}
1+
ARG BASE_IMAGE=jc21/nginx-full:latest
2+
FROM $BASE_IMAGE as final
3+
ARG BASE_IMAGE
4+
ARG TARGETPLATFORM
5+
26
LABEL maintainer="Jamie Curnow <jc@jc21.com>"
37

4-
ARG TARGETPLATFORM
5-
RUN echo "Acme.sh: jc21/nginx-full:${BASE_TAG:-latest}, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
8+
RUN echo "Acme.sh: $BASE_IMAGE, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
69

710
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
811

‎docker/Dockerfile.acmesh-golang‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
1-
FROM golang:1.20 as go
2-
FROM jc21/nginx-full:${ACMESH_BASE_TAG:-acmesh}
1+
ARG ACMESH_IMAGE=jc21/nginx-full:acmesh
2+
FROM golang:1.21 as go
3+
FROM $ACMESH_IMAGE as final
4+
ARG ACMESH_IMAGE
5+
ARG TARGETPLATFORM
6+
37
LABEL maintainer="Jamie Curnow <jc@jc21.com>"
48

5-
ARG TARGETPLATFORM
6-
RUN echo "Golang: jc21/nginx-full:${BASE_TAG:-acmesh}, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
9+
RUN echo "Golang: $ACMESH_IMAGE, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
710

811
RUN apt-get update \
912
&& apt-get install -y wget gcc g++ make git sqlite3 jq \
@@ -30,9 +33,8 @@ WORKDIR /root
3033
COPY ./files/.bashrc.acmesh-golang /root/.bashrc
3134

3235
# Gotools
33-
RUN cd /usr && wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.52.2
36+
RUN cd /usr && wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.55.2
3437
RUN go install github.com/kyoh86/richgo@latest \
35-
&& go install github.com/sonatype-nexus-community/nancy@latest \
3638
&& go install github.com/mfridman/tparse@latest \
3739
&& go install golang.org/x/vuln/cmd/govulncheck@latest \
3840
&& rm -rf /root/.cache/go-build

‎docker/Dockerfile.certbot‎

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,26 @@
1+
ARG BASE_IMAGE=jc21/nginx-full:latest
2+
13
#############
24
# Certbot Builder
35
#############
46

5-
FROM debian:buster-slim as certbotbuilder
7+
FROM debian:bookworm-slim as certbotbuilder
68

79
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
810

911
RUN apt-get update
1012
RUN apt-get install -y \
1113
build-essential \
14+
ca-certificates \
1215
curl \
1316
libaugeas0 \
14-
python3 \
15-
python3-dev \
1617
libffi-dev \
1718
libssl-dev \
18-
python3-venv \
19-
ca-certificates
19+
openssl \
20+
pkg-config \
21+
python3 \
22+
python3-dev \
23+
python3-venv
2024

2125
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
2226

@@ -30,26 +34,20 @@ ENV PATH="/opt/certbot/bin:$PATH"
3034

3135
RUN curl -L 'https://bootstrap.pypa.io/get-pip.py' | python3
3236

33-
# Handle an extremely specific issue when building the cryptography package for
34-
# 32-bit architectures within QEMU running on a 64-bit host
35-
# Special thanks to https://github.com/JonasAlfredsson/docker-nginx-certbot
36-
RUN if [ "$(getconf LONG_BIT)" = "32" ]; then \
37-
pip3 install --no-cache-dir -U cryptography==3.3.2; \
38-
fi
39-
40-
RUN pip install cryptography==2.8 \
41-
pip install --no-cache-dir cffi certbot \
37+
RUN pip install --no-cache-dir --upgrade pyopenssl \
38+
&& pip install --no-cache-dir cffi certbot cryptography \
4239
&& pip install tldextract
4340

4441
#############
4542
# Final Image
4643
#############
44+
FROM $BASE_IMAGE as final
45+
ARG BASE_IMAGE
46+
ARG TARGETPLATFORM
4747

48-
FROM jc21/nginx-full:${BASE_TAG:-latest}
4948
LABEL maintainer="Jamie Curnow <jc@jc21.com>"
5049

51-
ARG TARGETPLATFORM
52-
RUN echo "Certbot: jc21/nginx-full:${BASE_TAG:-latest}, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
50+
RUN echo "Certbot: $BASE_IMAGE, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
5351

5452
COPY scripts/install-cert-prune /tmp/install-cert-prune
5553
RUN /tmp/install-cert-prune "${TARGETPLATFORM:-linux/amd64}" && rm -f /tmp/install-cert-prune
@@ -67,8 +65,11 @@ COPY ./files/.bashrc.certbot /root/.bashrc
6765

6866
# Copy certbot
6967
COPY --from=certbotbuilder /opt/certbot /opt/certbot
70-
RUN curl -L 'https://bootstrap.pypa.io/get-pip.py' | python3 \
71-
&& python3 -m venv /opt/certbot/ \
68+
69+
ENV PATH="/opt/certbot/bin:$PATH"
70+
71+
RUN python3 -m venv /opt/certbot/ \
72+
&& curl -L 'https://bootstrap.pypa.io/get-pip.py' | /opt/certbot/bin/python3 \
7273
&& sed -i 's/include-system-site-packages = false/include-system-site-packages = true/g' -i /opt/certbot/pyvenv.cfg \
7374
&& ln -s /opt/certbot/bin/certbot /usr/bin/certbot
7475

‎docker/Dockerfile.certbot-node‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1-
FROM jc21/nginx-full:${CERTBOT_BASE_TAG:-certbot}
1+
ARG CERTBOT_IMAGE=jc21/nginx-full:certbot
2+
FROM $CERTBOT_IMAGE as final
3+
ARG CERTBOT_IMAGE
4+
ARG TARGETPLATFORM
5+
26
LABEL maintainer="Jamie Curnow <jc@jc21.com>"
37

4-
ARG TARGETPLATFORM
5-
RUN echo "Node: jc21/nginx-full:${BASE_TAG:-certbot}, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
8+
RUN echo "Node: $CERTBOT_IMAGE, ${TARGETPLATFORM:-linux/amd64}" >> /built-for-arch
69

710
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
811

9-
RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash - \
12+
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
1013
&& apt-get update \
1114
&& apt-get install -y gcc make g++ git nodejs \
1215
&& apt-get clean \
@@ -22,4 +25,3 @@ RUN node /tmp/test.js \
2225
&& rm -f /tmp/test.js
2326

2427
LABEL org.label-schema.cmd="docker run --rm -ti jc21/nginx-full:certbot-node"
25-

‎local-build.sh‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,20 @@ YELLOW='\E[1;33m'
66
GREEN='\E[1;32m'
77
RESET='\E[0m'
88

9-
DOCKER_IMAGE=jc21/nginx-full
9+
REGISTRY=${REGISTRY:-}
10+
DOCKER_IMAGE="${REGISTRY}jc21/nginx-full"
1011

1112
export OPENRESTY_VERSION=1.21.4.3
1213
export CROWDSEC_OPENRESTY_BOUNCER_VERSION=0.1.7
1314
export LUA_VERSION=5.1.5
1415
export LUAROCKS_VERSION=3.3.1
1516

17+
export BASE_IMAGE="${DOCKER_IMAGE}:latest"
18+
export ACMESH_IMAGE="${DOCKER_IMAGE}:acmesh"
19+
export CERTBOT_IMAGE="${DOCKER_IMAGE}:certbot"
20+
export CERTBOT_NODE_IMAGE="${DOCKER_IMAGE}:certbot-node"
21+
export ACMESH_GOLANG_IMAGE="${DOCKER_IMAGE}:acmesh-golang"
22+
1623
# Builds
1724

1825
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}latest ${CYAN}...${RESET}"
@@ -22,35 +29,35 @@ docker build \
2229
--build-arg CROWDSEC_OPENRESTY_BOUNCER_VERSION \
2330
--build-arg LUA_VERSION \
2431
--build-arg LUAROCKS_VERSION \
25-
-t ${DOCKER_IMAGE}:latest \
32+
-t "$BASE_IMAGE" \
2633
-f docker/Dockerfile \
2734
.
2835

2936
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh ${CYAN}...${RESET}"
3037
docker build \
31-
--build-arg BASE_TAG=latest \
32-
-t ${DOCKER_IMAGE}:acmesh \
38+
--build-arg BASE_IMAGE \
39+
-t "$ACMESH_IMAGE" \
3340
-f docker/Dockerfile.acmesh \
3441
.
3542

3643
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot ${CYAN}...${RESET}"
3744
docker build \
38-
--build-arg BASE_TAG=latest \
39-
-t ${DOCKER_IMAGE}:certbot \
45+
--build-arg BASE_IMAGE \
46+
-t "$CERTBOT_IMAGE" \
4047
-f docker/Dockerfile.certbot \
4148
.
4249

4350
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh-golang ${CYAN}...${RESET}"
4451
docker build \
45-
--build-arg BASE_TAG=acmesh \
46-
-t ${DOCKER_IMAGE}:acmesh-golang \
52+
--build-arg ACMESH_IMAGE \
53+
-t "$ACMESH_GOLANG_IMAGE" \
4754
-f docker/Dockerfile.acmesh-golang \
4855
.
4956

5057
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot-node ${CYAN}...${RESET}"
5158
docker build \
52-
--build-arg BASE_TAG=certbot \
53-
-t ${DOCKER_IMAGE}:certbot-node \
59+
--build-arg CERTBOT_IMAGE \
60+
-t "$CERTBOT_NODE_IMAGE" \
5461
-f docker/Dockerfile.certbot-node \
5562
.
5663

‎local-buildx.sh‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash -e
2+
3+
BLUE='\E[1;34m'
4+
CYAN='\E[1;36m'
5+
YELLOW='\E[1;33m'
6+
GREEN='\E[1;32m'
7+
RESET='\E[0m'
8+
9+
REGISTRY=${REGISTRY:-docker.jc21.com/}
10+
DOCKER_IMAGE="${REGISTRY}jc21/nginx-full"
11+
PLATFORMS=linux/amd64,linux/arm64,linux/arm/7
12+
13+
export OPENRESTY_VERSION=1.21.4.3
14+
export CROWDSEC_OPENRESTY_BOUNCER_VERSION=0.1.7
15+
export LUA_VERSION=5.1.5
16+
export LUAROCKS_VERSION=3.3.1
17+
18+
export BASE_IMAGE="${DOCKER_IMAGE}:latest"
19+
export ACMESH_IMAGE="${DOCKER_IMAGE}:acmesh"
20+
export CERTBOT_IMAGE="${DOCKER_IMAGE}:certbot"
21+
export CERTBOT_NODE_IMAGE="${DOCKER_IMAGE}:certbot-node"
22+
export ACMESH_GOLANG_IMAGE="${DOCKER_IMAGE}:acmesh-golang"
23+
24+
# Setup
25+
26+
docker buildx rm "${BUILDX_NAME:-nginx-full}" || echo
27+
docker buildx create --name "${BUILDX_NAME:-nginx-full}" || echo
28+
docker buildx use "${BUILDX_NAME:-nginx-full}"
29+
30+
# Builds
31+
32+
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}latest ${CYAN}...${RESET}"
33+
docker buildx build \
34+
--platform "$PLATFORMS" \
35+
--progress plain \
36+
--pull \
37+
--push \
38+
--build-arg OPENRESTY_VERSION \
39+
--build-arg CROWDSEC_OPENRESTY_BOUNCER_VERSION \
40+
--build-arg LUA_VERSION \
41+
--build-arg LUAROCKS_VERSION \
42+
-t "$BASE_IMAGE" \
43+
-f docker/Dockerfile \
44+
.
45+
46+
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh ${CYAN}...${RESET}"
47+
docker buildx build \
48+
--platform "$PLATFORMS" \
49+
--progress plain \
50+
--push \
51+
--build-arg BASE_IMAGE \
52+
-t "$ACMESH_IMAGE" \
53+
-f docker/Dockerfile.acmesh \
54+
.
55+
56+
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot ${CYAN}...${RESET}"
57+
docker buildx build \
58+
--platform "$PLATFORMS" \
59+
--progress plain \
60+
--push \
61+
--build-arg BASE_IMAGE \
62+
-t "$CERTBOT_IMAGE" \
63+
-f docker/Dockerfile.certbot \
64+
.
65+
66+
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}acmesh-golang ${CYAN}...${RESET}"
67+
docker buildx build \
68+
--platform "$PLATFORMS" \
69+
--progress plain \
70+
--push \
71+
--build-arg ACMESH_IMAGE \
72+
-t "$ACMESH_GOLANG_IMAGE" \
73+
-f docker/Dockerfile.acmesh-golang \
74+
.
75+
76+
echo -e "${BLUE}❯ ${CYAN}Building ${YELLOW}certbot-node ${CYAN}...${RESET}"
77+
docker buildx build \
78+
--platform "$PLATFORMS" \
79+
--progress plain \
80+
--push \
81+
--build-arg CERTBOT_IMAGE \
82+
-t "$CERTBOT_NODE_IMAGE" \
83+
-f docker/Dockerfile.certbot-node \
84+
.
85+
86+
docker buildx rm "${BUILDX_NAME:-nginx-full}"
87+
88+
echo -e "${BLUE}❯ ${GREEN}All done!${RESET}"

‎scripts/buildx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ docker buildx build \
1919
--platform linux/amd64,linux/arm64,linux/arm/7 \
2020
--progress plain \
2121
--pull \
22-
--build-arg BASE_TAG \
23-
--build-arg ACMESH_BASE_TAG \
24-
--build-arg CERTBOT_BASE_TAG \
22+
--build-arg BASE_IMAGE \
23+
--build-arg ACMESH_IMAGE \
24+
--build-arg CERTBOT_IMAGE \
2525
--build-arg OPENRESTY_VERSION \
2626
--build-arg LUA_VERSION \
2727
--build-arg LUAROCKS_VERSION \

0 commit comments

Comments
 (0)