From 009cffb4ee9c8201011f962bc4a42867e6ab4128 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 10 Aug 2022 13:15:35 +0200 Subject: [PATCH 1/5] contrib: remove kubernetes example as its all documented elsewhere Signed-off-by: Patrik Oldsberg --- .../kubernetes-example-backend/Dockerfile | 33 ------------------- .../kubernetes-example-backend/README.md | 13 -------- 2 files changed, 46 deletions(-) delete mode 100644 contrib/docker/kubernetes-example-backend/Dockerfile delete mode 100644 contrib/docker/kubernetes-example-backend/README.md diff --git a/contrib/docker/kubernetes-example-backend/Dockerfile b/contrib/docker/kubernetes-example-backend/Dockerfile deleted file mode 100644 index 4f4105838d..0000000000 --- a/contrib/docker/kubernetes-example-backend/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -FROM node:14-buster - -WORKDIR /usr/src/app - -# (workaround) Install cookiecutter and mkdocs to avoid the need to run docker in docker -RUN cd /tmp && curl -O https://www.python.org/ftp/python/3.8.2/Python-3.8.2.tar.xz && \ - tar -xvf Python-3.8.2.tar.xz && \ - cd Python-3.8.2 && \ - ./configure --enable-optimizations && \ - make -j 4 && \ - make altinstall - -RUN apt update -RUN apt install -y mkdocs - -RUN pip3.8 install mkdocs-techdocs-core - -RUN pip3.8 install cookiecutter && \ - apt remove -y build-essential zlib1g-dev libncurses5-dev libgdbm-dev libnss3-dev libssl-dev libsqlite3-dev libreadline-dev libffi-dev libbz2-dev g++ python-pip python-dev && \ - rm -rf /var/cache/apt/* /tmp/Python-3.8.2 - -# Copy repo skeleton first, to avoid unnecessary docker cache invalidation. -# The skeleton contains the package.json of each package in the monorepo, -# and along with yarn.lock and the root package.json, that's enough to run yarn install. -ADD yarn.lock package.json skeleton.tar ./ - -RUN yarn install --frozen-lockfile --production - -# This will copy the contents of the dist-workspace when running the build-image command. -# Do not use this Dockerfile outside of that command, as it will copy in the source code instead. -COPY . . - -CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.development.yaml"] diff --git a/contrib/docker/kubernetes-example-backend/README.md b/contrib/docker/kubernetes-example-backend/README.md deleted file mode 100644 index d0f9d57022..0000000000 --- a/contrib/docker/kubernetes-example-backend/README.md +++ /dev/null @@ -1,13 +0,0 @@ -# Example backend Dockerfile - -This Dockerfile will build the example backend with certain additional binaries needed to workaround -the docker requirement in the scaffolder and techdocs. - -# Usage - -```bash -yarn docker-build -f --tag -``` - -> The absolute path is necessary as this directory is not copied to the build workspace when building -> the docker image. From afb14027c2d1f02339fa54fbf47ee9708386689f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 10 Aug 2022 13:21:18 +0200 Subject: [PATCH 2/5] contrib: remove jinja2 extension Dockerfile example, inline in README instead Signed-off-by: Patrik Oldsberg --- .../cookiecutter-with-jinja2-extensions/Dockerfile | 11 ----------- .../cookiecutter-with-jinja2-extensions/README.md | 2 +- 2 files changed, 1 insertion(+), 12 deletions(-) delete mode 100644 contrib/docker/cookiecutter-with-jinja2-extensions/Dockerfile diff --git a/contrib/docker/cookiecutter-with-jinja2-extensions/Dockerfile b/contrib/docker/cookiecutter-with-jinja2-extensions/Dockerfile deleted file mode 100644 index e41d324730..0000000000 --- a/contrib/docker/cookiecutter-with-jinja2-extensions/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM alpine:3.16 - -RUN apk add --update \ - git \ - python \ - python-dev \ - py-pip \ - g++ && \ - pip install cookiecutter jinja2_custom_filters_extension && \ - apk del g++ py-pip python-dev && \ - rm -rf /var/cache/apk/* diff --git a/contrib/docker/cookiecutter-with-jinja2-extensions/README.md b/contrib/docker/cookiecutter-with-jinja2-extensions/README.md index 470694513a..0b754fa4ce 100644 --- a/contrib/docker/cookiecutter-with-jinja2-extensions/README.md +++ b/contrib/docker/cookiecutter-with-jinja2-extensions/README.md @@ -51,7 +51,7 @@ steps: imageName: 'foo/custom-built-cookiecutter-image-with-extensions' ``` -See for example, the [`Dockerfile`](./Dockerfile) in this directory. +For example, you can `pip install jinja2_custom_filters_extension` as part of your cookiecutter Dockerfile. ### Instructing Cookiecutter to use the extension From 8a0f1459708b6d2abd0e548f034b18d817eeedf9 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 10 Aug 2022 13:25:39 +0200 Subject: [PATCH 3/5] create-app: update Dockerfile to run app with node user Signed-off-by: Patrik Oldsberg --- docs/deployment/docker.md | 22 +++++++++++-------- packages/backend/Dockerfile | 10 +++++---- .../default-app/packages/backend/Dockerfile | 10 +++++---- 3 files changed, 25 insertions(+), 17 deletions(-) diff --git a/docs/deployment/docker.md b/docs/deployment/docker.md index 6e0ff77228..ff31a6a81f 100644 --- a/docs/deployment/docker.md +++ b/docs/deployment/docker.md @@ -58,8 +58,6 @@ Once the host build is complete, we are ready to build our image. The following ```Dockerfile FROM node:16-bullseye-slim -WORKDIR /app - # Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, # in which case you should also move better-sqlite3 to "devDependencies" in package.json. RUN apt-get update && \ @@ -67,16 +65,20 @@ RUN apt-get update && \ rm -rf /var/lib/apt/lists/* && \ yarn config set python /usr/bin/python3 +# From here on we use the least-privileged `node` user to run the backend. +USER node +WORKDIR /app + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. -COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ +COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)" # Then copy the rest of the backend bundle, along with any other files we might want. -COPY packages/backend/dist/bundle.tar.gz app-config.yaml ./ +COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./ RUN tar xzf bundle.tar.gz && rm bundle.tar.gz CMD ["node", "packages/backend", "--config", "app-config.yaml"] @@ -177,8 +179,6 @@ RUN yarn --cwd packages/backend build # Stage 3 - Build the actual backend image and install production dependencies FROM node:16-bullseye-slim -WORKDIR /app - # Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, # in which case you should also move better-sqlite3 to "devDependencies" in package.json. RUN apt-get update && \ @@ -186,18 +186,22 @@ RUN apt-get update && \ rm -rf /var/lib/apt/lists/* && \ yarn config set python /usr/bin/python3 +# From here on we use the least-privileged `node` user to run the backend. +USER node +WORKDIR /app + # Copy the install dependencies from the build stage and context -COPY --from=build /app/yarn.lock /app/package.json /app/packages/backend/dist/skeleton.tar.gz ./ +COPY --from=build --chown=node:node /app/yarn.lock /app/package.json /app/packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz RUN yarn install --frozen-lockfile --production --network-timeout 600000 && rm -rf "$(yarn cache dir)" # Copy the built packages from the build stage -COPY --from=build /app/packages/backend/dist/bundle.tar.gz . +COPY --from=build --chown=node:node /app/packages/backend/dist/bundle.tar.gz . RUN tar xzf bundle.tar.gz && rm bundle.tar.gz # Copy any other files that we need at runtime -COPY app-config.yaml ./ +COPY --chown=node:node app-config.yaml ./ CMD ["node", "packages/backend", "--config", "app-config.yaml"] ``` diff --git a/packages/backend/Dockerfile b/packages/backend/Dockerfile index fb60b8a669..bda34fa045 100644 --- a/packages/backend/Dockerfile +++ b/packages/backend/Dockerfile @@ -11,8 +11,6 @@ FROM node:16-bullseye-slim -WORKDIR /app - # Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, # in which case you should also move better-sqlite3 to "devDependencies" in package.json. RUN apt-get update && \ @@ -20,16 +18,20 @@ RUN apt-get update && \ rm -rf /var/lib/apt/lists/* && \ yarn config set python /usr/bin/python3 +# From here on we use the least-privileged `node` user to run the backend. +USER node +WORKDIR /app + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. -COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ +COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)" # Then copy the rest of the backend bundle, along with any other files we might want. -COPY packages/backend/dist/bundle.tar.gz app-config.yaml ./ +COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./ RUN tar xzf bundle.tar.gz && rm bundle.tar.gz CMD ["node", "packages/backend", "--config", "app-config.yaml"] diff --git a/packages/create-app/templates/default-app/packages/backend/Dockerfile b/packages/create-app/templates/default-app/packages/backend/Dockerfile index 8836ac7898..c926ba350b 100644 --- a/packages/create-app/templates/default-app/packages/backend/Dockerfile +++ b/packages/create-app/templates/default-app/packages/backend/Dockerfile @@ -11,8 +11,6 @@ FROM node:16-bullseye-slim -WORKDIR /app - # Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, # in which case you should also move better-sqlite3 to "devDependencies" in package.json. RUN apt-get update && \ @@ -20,16 +18,20 @@ RUN apt-get update && \ rm -rf /var/lib/apt/lists/* && \ yarn config set python /usr/bin/python3 +# From here on we use the least-privileged `node` user to run the backend. +USER node +WORKDIR /app + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. -COPY yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ +COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)" # Then copy the rest of the backend bundle, along with any other files we might want. -COPY packages/backend/dist/bundle.tar.gz app-config*.yaml ./ +COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./ RUN tar xzf bundle.tar.gz && rm bundle.tar.gz CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.production.yaml"] From 1725b2a3aa0bec1048b405ffe1653267c8e77a19 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 10 Aug 2022 13:26:02 +0200 Subject: [PATCH 4/5] create-app: update Dockerfile to set NODE_ENV=production Signed-off-by: Patrik Oldsberg --- docs/deployment/docker.md | 6 ++++++ packages/backend/Dockerfile | 3 +++ .../templates/default-app/packages/backend/Dockerfile | 3 +++ 3 files changed, 12 insertions(+) diff --git a/docs/deployment/docker.md b/docs/deployment/docker.md index ff31a6a81f..d46aff1b06 100644 --- a/docs/deployment/docker.md +++ b/docs/deployment/docker.md @@ -69,6 +69,9 @@ RUN apt-get update && \ USER node WORKDIR /app +# This switches many Node.js dependencies to production mode. +ENV NODE_ENV production + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. @@ -190,6 +193,9 @@ RUN apt-get update && \ USER node WORKDIR /app +# This switches many Node.js dependencies to production mode. +ENV NODE_ENV production + # Copy the install dependencies from the build stage and context COPY --from=build --chown=node:node /app/yarn.lock /app/package.json /app/packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz diff --git a/packages/backend/Dockerfile b/packages/backend/Dockerfile index bda34fa045..ed18da530b 100644 --- a/packages/backend/Dockerfile +++ b/packages/backend/Dockerfile @@ -22,6 +22,9 @@ RUN apt-get update && \ USER node WORKDIR /app +# This switches many Node.js dependencies to production mode. +ENV NODE_ENV production + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. diff --git a/packages/create-app/templates/default-app/packages/backend/Dockerfile b/packages/create-app/templates/default-app/packages/backend/Dockerfile index c926ba350b..682798b826 100644 --- a/packages/create-app/templates/default-app/packages/backend/Dockerfile +++ b/packages/create-app/templates/default-app/packages/backend/Dockerfile @@ -22,6 +22,9 @@ RUN apt-get update && \ USER node WORKDIR /app +# This switches many Node.js dependencies to production mode. +ENV NODE_ENV production + # Copy repo skeleton first, to avoid unnecessary docker cache invalidation. # The skeleton contains the package.json of each package in the monorepo, # and along with yarn.lock and the root package.json, that's enough to run yarn install. From 208d6780c99f2383f45d3bdf73bd62a7264bcd4d Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Wed, 10 Aug 2022 13:51:19 +0200 Subject: [PATCH 5/5] changesets: added changeset for create-app prod changes Signed-off-by: Patrik Oldsberg --- .changeset/hot-files-begin.md | 71 +++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .changeset/hot-files-begin.md diff --git a/.changeset/hot-files-begin.md b/.changeset/hot-files-begin.md new file mode 100644 index 0000000000..e9b9076986 --- /dev/null +++ b/.changeset/hot-files-begin.md @@ -0,0 +1,71 @@ +--- +'@backstage/create-app': patch +--- + +The `packages/backend/Dockerfile` received a couple of updates, it now looks as follows: + +```Dockerfile +FROM node:16-bullseye-slim + +# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, +# in which case you should also move better-sqlite3 to "devDependencies" in package.json. +RUN apt-get update && \ + apt-get install -y --no-install-recommends libsqlite3-dev python3 build-essential && \ + rm -rf /var/lib/apt/lists/* && \ + yarn config set python /usr/bin/python3 + +# From here on we use the least-privileged `node` user to run the backend. +USER node +WORKDIR /app + +# This switches many Node.js dependencies to production mode. +ENV NODE_ENV production + +# Copy repo skeleton first, to avoid unnecessary docker cache invalidation. +# The skeleton contains the package.json of each package in the monorepo, +# and along with yarn.lock and the root package.json, that's enough to run yarn install. +COPY --chown=node:node yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ +RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz + +RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)" + +# Then copy the rest of the backend bundle, along with any other files we might want. +COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./ +RUN tar xzf bundle.tar.gz && rm bundle.tar.gz + +CMD ["node", "packages/backend", "--config", "app-config.yaml", "--config", "app-config.production.yaml"] +``` + +The two notable changes are that a `USER node` instruction has been added and the ordering of instructions has been changed accordingly. This means that the app will now be running using the least-privileged `node` user. In order for this to work we now need to make sure that all app files are owned by the `node` user, which we do by adding the `--chown=node:node` option to the `COPY` instructions. + +The second change is the addition of `ENV NODE_ENV production`, which ensured that all Node.js modules run in production mode. If you apply this change to an existing app, note that one of the more significant changes is that this switches the log formatting to use the default production format, JSON. Rather than your log lines looking like this: + +```log +2022-08-10T11:36:05.478Z catalog info Performing database migration type=plugin +``` + +They will now look like this: + +```log +{"level":"info","message":"Performing database migration","plugin":"catalog","service":"backstage","type":"plugin"} +``` + +If you wish to keep the existing format, you can override this change by applying the following change to `packages/backend/src/index.ts`: + +```diff + getRootLogger, ++ setRootLogger, ++ createRootLogger, ++ coloredFormat, + useHotMemoize, + ... + ServerTokenManager, + } from '@backstage/backend-common'; + + ... + + async function main() { ++ setRootLogger(createRootLogger({ format: coloredFormat })); ++ + const config = await loadBackendConfig({ +```