From e9588ecac408e918bd153494107713bdd352d0c3 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Mon, 10 Jun 2024 16:12:17 -0400 Subject: [PATCH 1/8] init Signed-off-by: Karl Haworth --- .../docker/minimal-hardened-image/Dockerfile | 103 +++++++++++------- 1 file changed, 64 insertions(+), 39 deletions(-) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index 8ee6a3d206..987952387e 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -9,53 +9,78 @@ # # Once the commands have been run, you can build the image using `yarn docker-build` -FROM cgr.dev/chainguard/wolfi-base:latest +# syntax = docker/dockerfile:1.4 + +FROM cgr.dev/chainguard/python:latest-dev as python-builder + +RUN --mount=type=cache,target=/home/nonroot/.cache/pip,uid=65532,gid=65532 \ + python3 -m venv /home/nonroot/venv +ENV PATH=/venv/bin:$PATH + +RUN /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3 + +FROM cgr.dev/chainguard/wolfi-base:latest as node-builder -ENV NODE_VERSION 18=~18.19 ENV PYTHON_VERSION 3.12=~3.12 - -RUN apk add nodejs-$NODE_VERSION yarn - -# Install sqlite3 dependencies. You can skip this if you don't use sqlite3 in the image, -# in which case you should also move better-sqlite3 to "devDependencies" in package.json. -# Additionally, we install dependencies for `techdocs.generator.runIn: local`. -# https://backstage.io/docs/features/techdocs/getting-started#disabling-docker-in-docker-situation-optional -RUN --mount=type=cache,target=/var/cache/apk,sharing=locked \ - --mount=type=cache,target=/var/lib/apk,sharing=locked \ - apk update && \ - apk add sqlite-dev python-$PYTHON_VERSION py3-pip python-3-dev py3-setuptools build-base gcc libffi-dev glibc-dev openssl-dev brotli-dev c-ares-dev nghttp2-dev icu-dev zlib-dev gcc-12 libuv-dev && \ - yarn config set python /usr/bin/python3 - -# Set up a virtual environment for mkdocs-techdocs-core. -ENV VIRTUAL_ENV=/opt/venv -RUN python3 -m venv $VIRTUAL_ENV -ENV PATH="$VIRTUAL_ENV/bin:$PATH" - -RUN pip3 install mkdocs-techdocs-core==1.3.3 - -# From here on we use the least-privileged `node` user to run the backend. -WORKDIR /app -RUN chown nonroot:nonroot /app -USER nonroot - -# This switches many Node.js dependencies to production mode. +ENV NODE_VERSION 20=~20.11 ENV NODE_ENV production -# Copy over Yarn 3 configuration, release, and plugins -COPY --chown=nonroot:nonroot .yarn ./.yarn -COPY --chown=nonroot:nonroot .yarnrc.yml ./ +RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 \ + --mount=type=cache,target=/var/lib/apk,sharing=locked,uid=65532,gid=65532 \ + apk update && \ + apk add python-$PYTHON_VERSION nodejs-$NODE_VERSION yarn \ + # Install isolate-vm dependencies, these are needed by the @backstage/plugin-scaffolder-backend. + openssl-dev brotli-dev c-ares-dev nghttp2-dev icu-dev zlib-dev gcc-12 libuv-dev build-base -# Copy repo skeleton first, to avoid unnecessary docker cache invalidation. -# The skeleton contains the package.json of each package in the monorepo, -# and along with yarn.lock and the root package.json, that's enough to run yarn install. -COPY --chown=nonroot:nonroot yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ +WORKDIR /app +RUN chown -R nonroot:nonroot /app + +RUN mkdir -p /home/nonroot/.yarn/berry && chown -R 65532:65532 /home/nonroot/.yarn/berry + +USER nonroot + +COPY --chown=65532:65532 .yarn ./.yarn +COPY --chown=65532:65532 .yarnrc.yml ./ + +COPY --chown=65532:65532 yarn.lock package.json packages/backend/dist/skeleton.tar.gz ./ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz -RUN --mount=type=cache,target=/home/node/.yarn/berry/cache,sharing=locked,uid=1000,gid=1000 \ - yarn workspaces focus --all --production +RUN --mount=type=cache,target=/home/nonroot/.yarn/berry/cache,sharing=locked,uid=65532,gid=65532 \ + yarn workspaces focus --all --production && yarn cache clean --all -# Then copy the rest of the backend bundle, along with any other files we might want. -COPY --chown=nonroot:nonroot packages/backend/dist/bundle.tar.gz app-config*.yaml ./ +FROM cgr.dev/chainguard/wolfi-base:latest + +ENV PYTHON_VERSION 3.12=~3.12 +ENV NODE_VERSION 20=~20.14 +ENV NODE_ENV production + +RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 \ + --mount=type=cache,target=/var/lib/apk,sharing=locked,uid=65532,gid=65532 \ + apk update && \ + apk add \ + # add node for backstage + nodejs-$NODE_VERSION \ + # add python for backstage techdocs + python-$PYTHON_VERSION \ + # add tini for init process + tini + +WORKDIR /app +RUN chown -R 65532:65532 /app +USER nonroot + +COPY --chown=65532:65532 package.json packages/backend/dist/skeleton.tar.gz ./ +RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz + +COPY --chown=65532:65532 packages/backend/dist/bundle.tar.gz app-config*.yaml ./ RUN tar xzf bundle.tar.gz && rm bundle.tar.gz +COPY --from=node-builder --chown=65532:65532 /app/node_modules ./node_modules +COPY --from=python-builder --chown=65532:65532 /home/nonroot/venv /home/nonroot/venv +ENV PATH=/home/nonroot/venv/bin:$PATH + +ENV NODE_OPTIONS="--no-node-snapshot" +ENV GIT_PYTHON_REFRESH="quiet" + +ENTRYPOINT ["tini", "--"] CMD ["node", "packages/backend", "--config", "app-config.yaml"] From 3e670f508b806e13c7f0869097e98f4b6c2f7c76 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 2 Jul 2024 12:01:58 -0400 Subject: [PATCH 2/8] Add `steps taken` section Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/contrib/docker/minimal-hardened-image/README.md b/contrib/docker/minimal-hardened-image/README.md index 62045a4ded..191c77986c 100644 --- a/contrib/docker/minimal-hardened-image/README.md +++ b/contrib/docker/minimal-hardened-image/README.md @@ -4,6 +4,19 @@ DockerHub images in general did not seem ideal for Backstage as the number of vu The `Dockerfile` in this directory uses a [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners. +## Steps taken + +When converting, I utilized the upstream Dockerfile as a starting point. + +- Multi-stage build - The Dockerfile has been split up into a multistage build which reduces the files, packages, executables, and directories in the final image. + - Size savings = ~900mb + - Reduced attack surface +- Base Image - Swap to [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images + - Vulnerability Savings = ~239 at the time of updating this README +- Entrypoint - Swap from `node` to `tini` as entrypoint to ensure that the default signal handlers work and zombie processes are handled properly +- Use `ADD` instead of `COPY` in dockerfile to reduce copied compressed files + - When a `rm` is used to remove a compressed file it still makes its way into the final image. Using `ADD` is safe with local files. + ## Pinning Digest To reduce maintenance, the digest of the image has been removed from the `./Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest. From d00c679f004590210eb87dfad7208813b131dfb4 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 2 Jul 2024 12:03:30 -0400 Subject: [PATCH 3/8] change to `ADD` from `COPY` and adjust Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/Dockerfile | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index 987952387e..53eec1b55f 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -66,14 +66,13 @@ RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 tini WORKDIR /app + +COPY package.json app-config.yaml ./ +ADD packages/backend/dist/skeleton.tar.gz packages/backend/dist/bundle.tar.gz ./ + RUN chown -R 65532:65532 /app -USER nonroot - -COPY --chown=65532:65532 package.json packages/backend/dist/skeleton.tar.gz ./ -RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz - -COPY --chown=65532:65532 packages/backend/dist/bundle.tar.gz app-config*.yaml ./ -RUN tar xzf bundle.tar.gz && rm bundle.tar.gz +RUN chown -R 65532:65532 /tmp +USER 65532:65532 COPY --from=node-builder --chown=65532:65532 /app/node_modules ./node_modules COPY --from=python-builder --chown=65532:65532 /home/nonroot/venv /home/nonroot/venv From 7529219d6cf946c9fb76cea4dc8bc3d3d0fced64 Mon Sep 17 00:00:00 2001 From: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> Date: Wed, 14 Aug 2024 10:32:50 -0400 Subject: [PATCH 4/8] Update contrib/docker/minimal-hardened-image/Dockerfile Co-authored-by: Camila Belo Signed-off-by: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> --- contrib/docker/minimal-hardened-image/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index 53eec1b55f..e5985c3b9d 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -19,6 +19,7 @@ ENV PATH=/venv/bin:$PATH RUN /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3 +# Build Node environment in a separate builder stage FROM cgr.dev/chainguard/wolfi-base:latest as node-builder ENV PYTHON_VERSION 3.12=~3.12 From d7b06a60b0e9021954f6f005b16e5828bd1502a8 Mon Sep 17 00:00:00 2001 From: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> Date: Wed, 14 Aug 2024 10:32:59 -0400 Subject: [PATCH 5/8] Update contrib/docker/minimal-hardened-image/Dockerfile Co-authored-by: Camila Belo Signed-off-by: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> --- contrib/docker/minimal-hardened-image/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index e5985c3b9d..c8e53023d7 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -11,6 +11,7 @@ # syntax = docker/dockerfile:1.4 +# Build Python environment in a separate builder stage FROM cgr.dev/chainguard/python:latest-dev as python-builder RUN --mount=type=cache,target=/home/nonroot/.cache/pip,uid=65532,gid=65532 \ From fd7c45013b68d1bad25146523ec6b0d3fc77507f Mon Sep 17 00:00:00 2001 From: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> Date: Wed, 14 Aug 2024 10:33:33 -0400 Subject: [PATCH 6/8] Update contrib/docker/minimal-hardened-image/Dockerfile Co-authored-by: Camila Belo Signed-off-by: Karl Haworth <58607256+karlhaworth@users.noreply.github.com> --- contrib/docker/minimal-hardened-image/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index c8e53023d7..360024aaf5 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -50,6 +50,7 @@ RUN tar xzf skeleton.tar.gz && rm skeleton.tar.gz RUN --mount=type=cache,target=/home/nonroot/.yarn/berry/cache,sharing=locked,uid=65532,gid=65532 \ yarn workspaces focus --all --production && yarn cache clean --all +# Final stage to build the application image FROM cgr.dev/chainguard/wolfi-base:latest ENV PYTHON_VERSION 3.12=~3.12 From 905a114d9610ce7966e95d121391b6695d09ec1b Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Wed, 14 Aug 2024 10:52:28 -0400 Subject: [PATCH 7/8] remove python from node builder Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index 360024aaf5..3f4e41f5c1 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -23,14 +23,13 @@ RUN /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3 # Build Node environment in a separate builder stage FROM cgr.dev/chainguard/wolfi-base:latest as node-builder -ENV PYTHON_VERSION 3.12=~3.12 ENV NODE_VERSION 20=~20.11 ENV NODE_ENV production RUN --mount=type=cache,target=/var/cache/apk,sharing=locked,uid=65532,gid=65532 \ --mount=type=cache,target=/var/lib/apk,sharing=locked,uid=65532,gid=65532 \ apk update && \ - apk add python-$PYTHON_VERSION nodejs-$NODE_VERSION yarn \ + apk add nodejs-$NODE_VERSION yarn \ # Install isolate-vm dependencies, these are needed by the @backstage/plugin-scaffolder-backend. openssl-dev brotli-dev c-ares-dev nghttp2-dev icu-dev zlib-dev gcc-12 libuv-dev build-base From 393daf4467cd078e570f4a8b199c28be60779e01 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Wed, 14 Aug 2024 10:59:23 -0400 Subject: [PATCH 8/8] reduce RUN cmd Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/docker/minimal-hardened-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile index 3f4e41f5c1..a247e0dff1 100644 --- a/contrib/docker/minimal-hardened-image/Dockerfile +++ b/contrib/docker/minimal-hardened-image/Dockerfile @@ -14,11 +14,11 @@ # Build Python environment in a separate builder stage FROM cgr.dev/chainguard/python:latest-dev as python-builder -RUN --mount=type=cache,target=/home/nonroot/.cache/pip,uid=65532,gid=65532 \ - python3 -m venv /home/nonroot/venv ENV PATH=/venv/bin:$PATH -RUN /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3 +RUN --mount=type=cache,target=/home/nonroot/.cache/pip,uid=65532,gid=65532 \ + python3 -m venv /home/nonroot/venv && \ + /home/nonroot/venv/bin/pip install mkdocs-techdocs-core==1.3.3 # Build Node environment in a separate builder stage FROM cgr.dev/chainguard/wolfi-base:latest as node-builder