paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 47 Packages Projects Releases Wiki Activity

Merge pull request #13073 from backstage/rugvip/docker

Browse Source 
create-app/docker: hardening, usability, and doc updates
This commit is contained in:
Patrik Oldsberg
2022-08-17 10:22:00 +02:00
committed by GitHub
parent 856f748f7a 208d6780c9
commit b751518fac
8 changed files with 109 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/hot-files-begin.md
+71
View File
@@ -0,0 +1,71 @@
---
'@backstage/create-app': patch
---
The `packages/backend/Dockerfile` received a couple of updates, it now looks as follows:
```Dockerfile
FROM node:16-bullseye-slim
# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
RUN apt-get update && \
apt-get install -y --no-install-recommends libsqlite3-dev python3 build-essential && \
rm -rf /var/lib/apt/lists/* && \
yarn config set python /usr/bin/python3
# From here on we use the least-privileged `node` user to run the backend.
USER node
WORKDIR /app
# This switches many Node.js dependencies to production mode.
ENV NODE_ENV production
# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
# The skeleton contains the package.json of each package in the monorepo,
# and along with yarn.lock and the root package.json, that's enough to run yarn install.
COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
# Then copy the rest of the backend bundle, along with any other files we might want.
COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./
RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.production.yaml"]
```
The two notable changes are that a `USER node` instruction has been added and the ordering of instructions has been changed accordingly. This means that the app will now be running using the least-privileged `node` user. In order for this to work we now need to make sure that all app files are owned by the `node` user, which we do by adding the `--chown=node:node` option to the `COPY` instructions.
The second change is the addition of `ENV NODE_ENV production`, which ensured that all Node.js modules run in production mode. If you apply this change to an existing app, note that one of the more significant changes is that this switches the log formatting to use the default production format, JSON. Rather than your log lines looking like this:
```log
2022-08-10T11:36:05.478Z catalog info Performing database migration type=plugin
```
They will now look like this:
```log
{"level":"info","message":"Performing database migration","plugin":"catalog","service":"backstage","type":"plugin"}
```
If you wish to keep the existing format, you can override this change by applying the following change to `packages/backend/src/index.ts`:
```diff
getRootLogger,
+ setRootLogger,
+ createRootLogger,
+ coloredFormat,
useHotMemoize,
...
ServerTokenManager,
} from '@backstage/backend-common';
...
async function main() {
+ setRootLogger(createRootLogger({ format: coloredFormat }));
+
const config = await loadBackendConfig({
```
contrib/docker/cookiecutter-with-jinja2-extensions/Dockerfile
-11
View File
@@ -1,11 +0,0 @@
FROM alpine:3.16
RUN apk add --update \
git \
python \
python-dev \
py-pip \
g++ && \
pip install cookiecutter jinja2_custom_filters_extension && \
apk del g++ py-pip python-dev && \
rm -rf /var/cache/apk/*
contrib/docker/cookiecutter-with-jinja2-extensions/README.md
+1 -1
View File
@@ -51,7 +51,7 @@ steps:
imageName: 'foo/custom-built-cookiecutter-image-with-extensions'
```
See for example, the [`Dockerfile`](./Dockerfile) in this directory.
For example, you can `pip install jinja2_custom_filters_extension` as part of your cookiecutter Dockerfile.
### Instructing Cookiecutter to use the extension
contrib/docker/kubernetes-example-backend/Dockerfile
-33
View File
@@ -1,33 +0,0 @@
FROM node:14-buster
WORKDIR /usr/src/app
# (workaround) Install cookiecutter and mkdocs to avoid the need to run docker in docker
RUN cd /tmp && curl -O https://www.python.org/ftp/python/3.8.2/Python-3.8.2.tar.xz && \
tar -xvf Python-3.8.2.tar.xz && \
cd Python-3.8.2 && \
./configure --enable-optimizations && \
make -j 4 && \
make altinstall
RUN apt update
RUN apt install -y mkdocs
RUN pip3.8 install mkdocs-techdocs-core
RUN pip3.8 install cookiecutter && \
apt remove -y build-essential zlib1g-dev libncurses5-dev libgdbm-dev libnss3-dev libssl-dev libsqlite3-dev libreadline-dev libffi-dev libbz2-dev g++ python-pip python-dev && \
rm -rf /var/cache/apt/* /tmp/Python-3.8.2
# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
# The skeleton contains the package.json of each package in the monorepo,
# and along with yarn.lock and the root package.json, that's enough to run yarn install.
ADD yarn.lock package.json skeleton.tar ./
RUN yarn install --frozen-lockfile --production
# This will copy the contents of the dist-workspace when running the build-image command.
# Do not use this Dockerfile outside of that command, as it will copy in the source code instead.
COPY . .
CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.development.yaml"]
contrib/docker/kubernetes-example-backend/README.md
-13
View File
@@ -1,13 +0,0 @@
# Example backend Dockerfile
This Dockerfile will build the example backend with certain additional binaries needed to workaround
the docker requirement in the scaffolder and techdocs.
# Usage
```bash
yarn docker-build -f <absolute_path_to_the_dockerfile> --tag <your_tag>
```
> The absolute path is necessary as this directory is not copied to the build workspace when building
> the docker image.
docs/deployment/docker.md
+19 -9
View File
@@ -58,8 +58,6 @@ Once the host build is complete, we are ready to build our image. The following
```Dockerfile
FROM node:16-bullseye-slim
WORKDIR /app
# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
RUN apt-get update && \
@@ -67,16 +65,23 @@ RUN apt-get update && \
rm -rf /var/lib/apt/lists/* && \
yarn config set python /usr/bin/python3
# From here on we use the least-privileged `node` user to run the backend.
USER node
WORKDIR /app
# This switches many Node.js dependencies to production mode.
ENV NODE_ENV production
# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
# The skeleton contains the package.json of each package in the monorepo,
# and along with yarn.lock and the root package.json, that's enough to run yarn install.
COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
# Then copy the rest of the backend bundle, along with any other files we might want.
COPY packages/backend/dist/bundle.tar.gz app-config.yaml ./
COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./
RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
CMD ["node", "packages/backend", "--config", "app-config.yaml"]
@@ -177,8 +182,6 @@ RUN yarn --cwd packages/backend build
# Stage 3 - Build the actual backend image and install production dependencies
FROM node:16-bullseye-slim
WORKDIR /app
# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
RUN apt-get update && \
@@ -186,18 +189,25 @@ RUN apt-get update && \
rm -rf /var/lib/apt/lists/* && \
yarn config set python /usr/bin/python3
# From here on we use the least-privileged `node` user to run the backend.
USER node
WORKDIR /app
# This switches many Node.js dependencies to production mode.
ENV NODE_ENV production
# Copy the install dependencies from the build stage and context
COPY --from=build /app/yarn.lock /app/package.json /app/packages/backend/dist/skeleton.tar.gz ./
COPY --from=build --chown=node:node /app/yarn.lock /app/package.json /app/packages/backend/dist/skeleton.tar.gz ./
RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
RUN yarn install --frozen-lockfile --production --network-timeout 600000 && rm -rf "$(yarn cache dir)"
# Copy the built packages from the build stage
COPY --from=build /app/packages/backend/dist/bundle.tar.gz .
COPY --from=build --chown=node:node /app/packages/backend/dist/bundle.tar.gz .
RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
# Copy any other files that we need at runtime
COPY app-config.yaml ./
COPY --chown=node:node app-config.yaml ./
CMD ["node", "packages/backend", "--config", "app-config.yaml"]
```
packages/backend/Dockerfile
+9 -4
View File
@@ -11,8 +11,6 @@
FROM node:16-bullseye-slim
WORKDIR /app
# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
RUN apt-get update && \
@@ -20,16 +18,23 @@ RUN apt-get update && \
rm -rf /var/lib/apt/lists/* && \
yarn config set python /usr/bin/python3
# From here on we use the least-privileged `node` user to run the backend.
USER node
WORKDIR /app
# This switches many Node.js dependencies to production mode.
ENV NODE_ENV production
# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
# The skeleton contains the package.json of each package in the monorepo,
# and along with yarn.lock and the root package.json, that's enough to run yarn install.
COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
# Then copy the rest of the backend bundle, along with any other files we might want.
COPY packages/backend/dist/bundle.tar.gz app-config.yaml ./
COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./
RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
CMD ["node", "packages/backend", "--config", "app-config.yaml"]
packages/create-app/templates/default-app/packages/backend/Dockerfile
+9 -4
View File
@@ -11,8 +11,6 @@
FROM node:16-bullseye-slim
WORKDIR /app
# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image,
# in which case you should also move better-sqlite3 to "devDependencies" in package.json.
RUN apt-get update && \
@@ -20,16 +18,23 @@ RUN apt-get update && \
rm -rf /var/lib/apt/lists/* && \
yarn config set python /usr/bin/python3
# From here on we use the least-privileged `node` user to run the backend.
USER node
WORKDIR /app
# This switches many Node.js dependencies to production mode.
ENV NODE_ENV production
# Copy repo skeleton first, to avoid unnecessary docker cache invalidation.
# The skeleton contains the package.json of each package in the monorepo,
# and along with yarn.lock and the root package.json, that's enough to run yarn install.
COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./
RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz
RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
# Then copy the rest of the backend bundle, along with any other files we might want.
COPY packages/backend/dist/bundle.tar.gz app-config*.yaml ./
COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./
RUN tar xzf bundle.tar.gz && rm bundle.tar.gz
CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.production.yaml"]