Oraclelinux docker build

deployments/docker/Makefile

@@ -34,21 +34,31 @@ ifneq ($(DEBUG_PORT),)
 DEBUG_PORT_FLAG := -p $(DEBUG_PORT):$(DEBUG_PORT)
 endif
 
+# Determine OS distribution
+DISTRO := $(shell cat /etc/os-release | grep -w ID | cut -d '=' -f2 | cut -d '"' -f2)
+
+# Fallback to Ubuntu build
+ifneq ($(DISTRO), ol)
+DISTRO = ubuntu
+endif
+
+DISTRO_DIR := $(THIS_DIR)$(DISTRO)/
+
 .PHONY: all
 all: builder build deploy deployment prune
 
 .PHONY: builder
 builder: .built/builder
 
-.built/builder: $(SRC_DIR)builder.docker $(SRC_DIR)builder-dispatcher $(SRC_DIR)builder-bashrc \
+.built/builder: $(DISTRO_DIR)builder.docker $(SRC_DIR)builder-dispatcher $(SRC_DIR)builder-bashrc \
 	        $(SRC_DIR)certs/rootCA.crt $(THIS_DIR)../../go.mod
 	mkdir -p $(BUILDER_CONTEXT)
 	cp $(SRC_DIR)builder-dispatcher $(BUILDER_CONTEXT)/
 	cp $(SRC_DIR)builder-bashrc $(BUILDER_CONTEXT)/
 	cp $(SRC_DIR)certs/rootCA.crt $(BUILDER_CONTEXT)/
 	cp $(THIS_DIR)../../go.{mod,sum} $(BUILDER_CONTEXT)/
 	docker build $(DOCKER_BUILD_FLAGS) \
-		-t veraison/builder $(BUILDER_CONTEXT) -f $(SRC_DIR)builder.docker \
+		-t veraison/builder $(BUILDER_CONTEXT) -f $(DISTRO_DIR)builder.docker \
 		--build-arg BUILDER_UID=$(shell id -u) --build-arg BUILDER_GID=$(shell id -g)
 	@mkdir -p .built && touch .built/builder
 
@@ -57,6 +67,7 @@ build: .built/build
 
 .built/build: .built/builder
 	docker container run --rm \
+		--security-opt label=disable \
 		-v $(THIS_DIR)../..:/veraison/build veraison/builder build
 	@mkdir -p .built && touch .built/build
 
@@ -69,13 +80,15 @@ deploy: .built/deploy
 		mkdir -p $(DEPLOY_DEST); \
 	fi
 	docker container run --rm \
+		--security-opt label=disable \
 		-v $(THIS_DIR)../..:/veraison/build -v $(DEPLOY_DEST):/veraison/deploy \
 		veraison/builder deploy
 	@mkdir -p .built && touch .built/deploy
 
 .PHONY: debug
 debug: .built/builder .built/network
 	docker container run --rm \
+		--security-opt label=disable \
 		--network $(VERAISON_NETWORK) \
 		-v $(STORES_VOLUME):/veraison/stores -v $(LOGS_VOLUME):/veraison/logs \
 		-v $(THIS_DIR)../..:/veraison/build -v $(DEPLOY_DEST):/veraison/deploy \
@@ -126,14 +139,14 @@ keycloak-image: deploy .built/keycloak-image
 .PHONY: network
 network: .built/network
 
-.built/%-image: $(SRC_DIR)%.docker $(DEPLOY_DEST)/*
+.built/%-image: $(DISTRO_DIR)%.docker $(DEPLOY_DEST)/*
 	@# Before rebuilding the image, remove any containers that were based
 	@# on the previous version.
 	@# The "nil" ensures the command doesn't fail due to an empty argument list.
 	docker rm -f $(shell docker ps -a -q --filter "ancestor=veraison/$*") nil 2>/dev/null
 	@
 	DOCKER_BUILDKIT=1 docker build $(DOCKER_BUILD_FLAGS) \
-		-t veraison/$* $(DEPLOY_DEST) -f $(SRC_DIR)$*.docker
+		-t veraison/$* $(DEPLOY_DEST) -f $(DISTRO_DIR)$*.docker
 	@mkdir -p .built && touch .built/$*-image
 
 .built/%-container: .built/%-image .built/network
@@ -150,11 +163,11 @@ network: .built/network
 .PHONY: manager
 manager: .built/manager
 
-.built/manager: $(SRC_DIR)manager.docker $(SRC_DIR)manager-dispatcher
+.built/manager: $(DISTRO_DIR)manager.docker $(SRC_DIR)manager-dispatcher
 	mkdir -p $(BUILDER_CONTEXT)
 	cp $(SRC_DIR)manager-dispatcher $(DEPLOY_DEST)/
 	docker build $(DOCKER_BUILD_FLAGS) \
-		-t veraison/manager $(DEPLOY_DEST) -f $(SRC_DIR)manager.docker \
+		-t veraison/manager $(DEPLOY_DEST) -f $(DISTRO_DIR)manager.docker \
 		 --build-arg MANAGER_UID=$(shell id -u) --build-arg MANAGER_GID=$(shell id -g)
 	@mkdir -p .built && touch .built/manager
 
@@ -172,6 +185,7 @@ prune:
 clean:
 	if [[ "x$(shell docker image ls | grep veraison/builder)" != "x" ]]; then \
 	docker container run --rm \
+		--security-opt label=disable \
 		-v $(THIS_DIR)../..:/veraison/build veraison/builder clean; \
 		rm -f .built/build; \
 	fi

deployments/docker/ol/builder.docker

@@ -0,0 +1,76 @@
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-builder
+
+# User identity that will be used to build the project. This should be
+# overriden at build time to match the host user running the builder, who owns
+# the git checkout of the source.
+ARG BUILDER_UID=1000
+ARG BUILDER_GID=1000
+
+RUN cat /etc/redhat-release
+RUN dnf config-manager --set-enabled ol9_codeready_builder
+RUN dnf install -y git
+RUN dnf install -y make
+
+RUN dnf update -y \
+    && dnf install -y \
+        protobuf* \
+        sqlite \
+	uuid \
+	gettext \
+        vim \
+        jq \
+        iputils \
+        nmap \
+        wget \
+        sudo \
+        ca-certificates \
+        gcc \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+
+SHELL ["/bin/bash", "-c"]
+
+# Builder password is "builder" (sans quotes).
+RUN groupadd -g ${BUILDER_GID} builder && \
+    groupadd -g 616 veraison && \
+    useradd -m -u ${BUILDER_UID} -g builder -G root,veraison,wheel -p paxyJoB0NZsNU -s /bin/bash builder
+
+RUN groupadd -g 1001 opc
+RUN useradd -m -u 1001 -g opc -G root,veraison,wheel -p paxyJoB0NZsNU -s /bin/bash opc
+
+ADD --chown=root:root rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+RUN wget https://go.dev/dl/go1.23.1.linux-amd64.tar.gz
+RUN rm -rf /usr/local/go
+RUN tar -C /usr/local -xzf go1.23.1.linux-amd64.tar.gz
+ENV PATH=$PATH:/usr/local/go/bin
+
+WORKDIR /veraison
+
+RUN chown -R builder:builder /veraison
+
+#USER builder
+
+RUN mkdir --mode=775 logs stores
+ADD --chown=builder:builder go.mod go.sum ./
+
+# Download Go modules
+RUN go mod download &&\
+    go install golang.org/x/tools/gopls@latest &&\
+    go install golang.org/x/tools/cmd/guru@latest &&\
+    go install github.com/golang/mock/[email protected] &&\
+    go install google.golang.org/protobuf/cmd/protoc-gen-go@latest &&\
+    go install google.golang.org/grpc/cmd/[email protected] &&\
+    go install github.com/mitchellh/[email protected] &&\
+    go install github.com/veraison/corim/cocli@latest &&\
+    go install github.com/veraison/evcli/v2@latest &&\
+    go install github.com/veraison/pocli@latest &&\
+    go install github.com/go-delve/delve/cmd/dlv@latest
+
+ADD --chown=builder:builder builder-dispatcher .
+ADD --chown=builder:builder builder-bashrc /home/builder/.bashrc
+
+ENTRYPOINT ["/veraison/builder-dispatcher"]
+CMD ["help"]

deployments/docker/ol/keycloak.docker

@@ -0,0 +1,20 @@
+FROM quay.io/keycloak/keycloak:22.0.1 as keycloak-builder
+
+WORKDIR /opt/keycloak
+# note: for development set up early; use proper certification in production.
+RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 \
+	-dname "CN=server" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" \
+	-keystore conf/server.keystore
+
+RUN /opt/keycloak/bin/kc.sh build
+
+FROM quay.io/keycloak/keycloak:22.0.1
+COPY --from=keycloak-builder /opt/keycloak/ /opt/keycloak/
+COPY keycloak.conf /opt/keycloak/conf/keycloak.conf
+COPY veraison-realm.json /opt/keycloak/data/import/veraison-realm.json
+COPY --chown=keycloak certs/keycloak.crt certs/keycloak.key /opt/keycloak/
+
+ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
+CMD ["start", "--optimized", "--import-realm", "--verbose", \
+     "--https-certificate-file", "/opt/keycloak/keycloak.crt", \
+     "--https-certificate-key-file", "/opt/keycloak/keycloak.key"]

deployments/docker/ol/management.docker

@@ -0,0 +1,31 @@
+# Management service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-management
+
+RUN dnf update -y \
+    && dnf install -y \
+	uuid \
+	ca-certificates \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+RUN groupadd -g 616 veraison && \
+    useradd -m  -g veraison  --system veraison
+
+ADD --chown=root:root certs/rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+USER veraison
+
+WORKDIR /opt/veraison
+
+RUN mkdir -p --mode=0775 logs/logs
+
+ADD --chown=veraison:nobody plugins plugins
+ADD --chown=veraison:nobody config.yaml management-service service-entrypoint \
+    certs/management.crt certs/management.key ./
+
+ENTRYPOINT ["/opt/veraison/service-entrypoint"]
+CMD ["/opt/veraison/management-service"]
+

deployments/docker/ol/manager.docker

@@ -0,0 +1,43 @@
+# VTS service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-verification
+
+# User identity that will be used to build the project. This should be
+# overriden at build time to match the host user running the builder, who owns
+# the git checkout of the source.
+ARG MANAGER_UID=1000
+ARG MANAGER_GID=1000
+ARG VERAISON_GID=616
+
+RUN dnf update -y \
+    && dnf install -y \
+        sqlite \
+        jq \
+	uuid \
+	ca-certificates \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+RUN groupadd -g ${MANAGER_GID} manager && \
+    groupadd -g ${VERAISON_GID} veraison && \
+    useradd -m -u ${MANAGER_UID} -g manager -G veraison -s /bin/bash manager
+
+ADD --chown=root:root certs/rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+USER manager
+
+WORKDIR /opt/veraison
+
+RUN mkdir -p --mode=0775 logs/logs
+
+RUN mkdir -p /home/manager/.config/pocli && \
+    echo "host: management-service" > /home/manager/.config/pocli/config.yaml
+
+ADD --chown=manager:nobody utils/evcli utils/cocli utils/pocli ./utils/
+ADD --chown=manager:nobody manager-dispatcher ./
+
+ENTRYPOINT ["/opt/veraison/manager-dispatcher"]
+CMD ["help"]
+

deployments/docker/ol/provisioning.docker

@@ -0,0 +1,31 @@
+# Provisioning service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-provisioning
+
+RUN dnf update -y \
+    && dnf install -y \
+	uuid \
+	ca-certificates \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+RUN groupadd -g 616 veraison && \
+    useradd -m  -g veraison  --system veraison
+
+ADD --chown=root:root certs/rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+USER veraison
+
+WORKDIR /opt/veraison
+
+RUN mkdir -p --mode=0775 logs/logs
+
+ADD --chown=veraison:nobody plugins plugins
+ADD --chown=veraison:nobody config.yaml provisioning-service service-entrypoint \
+    certs/provisioning.crt certs/provisioning.key ./
+
+ENTRYPOINT ["/opt/veraison/service-entrypoint"]
+CMD ["/opt/veraison/provisioning-service"]
+

deployments/docker/ol/verification.docker

@@ -0,0 +1,30 @@
+# Verification service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-verification
+
+RUN dnf update -y \
+    && dnf install -y \
+	uuid \
+	ca-certificates \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+RUN groupadd -g 616 veraison && \
+    useradd -m  -g veraison  --system veraison
+
+ADD --chown=root:root certs/rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+USER veraison
+
+WORKDIR /opt/veraison
+
+RUN mkdir -p --mode=0775 logs/logs
+
+ADD --chown=veraison:nobody config.yaml verification-service service-entrypoint \
+    certs/verification.crt certs/verification.key ./
+
+ENTRYPOINT ["/opt/veraison/service-entrypoint"]
+CMD ["/opt/veraison/verification-service"]
+

deployments/docker/ol/vts.docker

@@ -0,0 +1,45 @@
+# VTS service container.
+# The context for building this image is assumed to be the Veraison deployment
+# directory (/tmp/veraison is the default for make build).
+FROM container-registry.oracle.com/os/oraclelinux:9 as veraison-vts
+
+RUN dnf update -y \
+    && dnf install -y \
+	uuid \
+	ca-certificates \
+    && uuidgen | tr -d - > /etc/machine-id \
+    && rm -rf /var/tmp/* /tmp/*
+
+RUN groupadd -g 616 veraison && \
+    useradd -m  -g veraison  --system veraison
+
+ADD --chown=root:root certs/rootCA.crt /etc/pki/ca-trust/source/anchors/veraison-ca.crt
+RUN update-ca-trust
+
+USER veraison
+
+WORKDIR /opt/veraison
+
+# The stores should be modifiable by any member of group veraison (GID 616).
+# This is to allow both the vts services' veraison user, and the manger's
+# manager user to modify them. We can't simply match UID's of the users in the
+# two containers because the manager has to UID-match the host's user. In order
+# for a database to be modifiable, sqlite3 requires that not only the file is
+# writable, but that the directory containing the file is also writable. When
+# docker creates a mount point, the mode bits are set based on umask, and there
+# does not appear to be a way to override that on case-by-case basis. To get
+# around that, we need to create a subdirectory under the mount point, that we
+# _can_ set mode bits on. Hence the stores are deployed into vts/ subdir inside
+# the volume.
+RUN mkdir -p --mode=0775 stores/vts
+
+RUN mkdir -p --mode=0775 logs/logs
+
+ADD --chown=veraison:nobody plugins plugins
+ADD --chown=veraison:veraison --chmod=0660 stores/* stores/vts
+ADD --chown=veraison:nobody config.yaml skey.jwk vts-service service-entrypoint \
+	certs/vts.crt certs/vts.key ./
+
+ENTRYPOINT ["/opt/veraison/service-entrypoint"]
+CMD ["/opt/veraison/vts-service"]
+

deployments/docker/src/config.yaml.template

@@ -2,7 +2,7 @@ logging:
   level: info  # valid levels: error, warning, info, debug
   output-paths:
     - stdout
-    - logs/{{ .service }}-stdout.log
+    - logs/logs/{{ .service }}-stdout.log
 provisioning:
   listen-addr: 0.0.0.0:${PROVISIONING_PORT}
   protocol: https

deployments/docker/src/manager-dispatcher

@@ -39,7 +39,7 @@ function logs() {
     fi
 
     mkdir -p "$dest"
-    cp $_logs_dir/* "$dest/"
+    cp -r $_logs_dir/* "$dest/"
 }
 
 function clear_logs() {