-
Notifications
You must be signed in to change notification settings - Fork 6
/
Dockerfile.zyp
64 lines (61 loc) · 3.25 KB
/
Dockerfile.zyp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
ARG DISTRO_NAME
ARG DISTRO_VERSION
FROM $DISTRO_NAME:$DISTRO_VERSION
LABEL maintainer="[email protected]"
# Both args before the `FROM` are repeated here so that they can be used below, as required
# https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
ARG DISTRO_NAME
ARG DISTRO_VERSION
ARG SALT_INSTALL_METHOD
ARG SALT_VERSION
ARG PYTHON_VERSION
ARG EXTRA_PACKAGES=""
# Provide packages used by `kitchen-docker` to speed up testing
# These are now expected by the `ssf` customised `kitchen-docker` being used:
# - https://gitlab.com/saltstack-formulas/infrastructure/kitchen-docker/-/compare/master...ssf
ARG KITCHEN_DOCKER_PACKAGES="curl openssh sudo which"
ARG PKGS="${KITCHEN_DOCKER_PACKAGES} git glibc-locale net-tools net-tools-deprecated systemd udev ${EXTRA_PACKAGES}"
ARG SALT_REPO_URL=""
SHELL ["/bin/bash", "-x", "-o", "pipefail", "-c"]
# hadolint ignore=DL3037
RUN zypper refresh \
&& zypper install --no-recommends -y ${PKGS} \
&& zypper clean \
&& systemctl enable sshd \
# https://github.com/inspec/train/issues/377
# https://github.com/inspec/train/pull/505
&& if [ ! -e /etc/SuSE-release ]; then \
ln -s /etc/os-release /etc/SuSE-release; \
fi
ARG CACHEBUST=1
# Install Salt using the bootstrap script (removing the 10 seconds delay to cancel the bootstrap)
RUN curl -L https://raw.githubusercontent.com/saltstack/salt-bootstrap/develop/bootstrap-salt.sh | \
sed -e '/^\s\+echowarn "You have 10 seconds to cancel and stop the bootstrap process..."/,+2d' | \
sh -s -- ${SALT_REPO_URL} -XUdfPD -x python$PYTHON_VERSION $SALT_INSTALL_METHOD $SALT_VERSION \
# NOTE: This needs to be done after running the bootstrap, in case `openSUSE-release` is updated during that process,
# which results in `/etc/os-release` being updated again; this is a particular problem if the Tumbleweed
# Docker Hub image hasn't been updated for a few days
# Uncomment all lines in both files, to fix `nil` Tumbleweed `platform[:release]` in InSpec
# TODO: Add InSpec bug report link when it is available
&& sed -i -e "s/^# //" /etc/os-release \
&& sed -i -e "s/^# //" /etc/SuSE-release \
# Disable Salt's service as we don't need it running
&& systemctl disable salt-minion.service > /dev/null 2>&1 \
# Similar to Fedora and Arch Linux, enable the `ssh-rsa` keypair type since Kitchen
# testing currently relies on this (only required on Tumbleweed so far)
&& if [ "${DISTRO_NAME}" = "opensuse/tumbleweed" ]; then \
echo "PubkeyAcceptedAlgorithms +ssh-rsa" | tee -a /etc/ssh/sshd_config; \
fi \
# Remove unnecessary getty and udev targets that result in high CPU usage when using
# multiple containers with Molecule or Kitchen (https://github.com/ansible/molecule/issues/1104)
&& rm -rf /var/cache/{salt,zyp} \
/usr/lib/systemd/system/systemd*udev* \
/usr/lib/systemd/system/getty.target \
/tmp/* \
&& (find / ! -path "/{proc,sys,dev}" -name "*.pyc"; \
find / ! -path "/{proc,sys,dev}" -name "__pycache__"; \
find /var/log -type f) \
| grep -v ^/proc | xargs rm -rf \
# Also obscure any `getty` binaries (https://github.com/moby/moby/issues/4040#issuecomment-339022455)
&& cp /bin/true /usr/sbin/agetty \
&& cp /bin/true /usr/sbin/smart_agetty