git.iko.soy/typeable/oauth2-proxy
on master help sign in
Parameterise runtime image (#1478)

* Use distroless debian11 docker image * Add `Dockerfile` to `.dockerignore` * Replace `nonroot` with the matching UID/GID Alpine does not have that user, and it cause issues when trying to start the container * Use a build arg for setting the runtime image * Explain why `ARG RUNTIME_IMAGE` is at the top * Add entry to CHANGELOG * Move build-arg to `DOCKER_BUILDX_ARGS`

commit2e9c30ac12a2202e65212456f6ddba7f623456f2 authorOle-Martin Bratteng <1681525+omBratteng@users.noreply.github.com> dateThu 14 Apr 2022, 15:10 (5 years ago) parentf820deb
4 files changed+13−4
compare with master
unifiedsplit
.dockerignore+1 CHANGELOG.md+4 Dockerfile+6−3 Makefile+2−1
.dockerignore+1
@@ -1,4 +1,5 @@
11Dockerfile.dev
2+Dockerfile
23docs
34vendor
45.git
CHANGELOG.md+4
@@ -9,10 +9,14 @@
99
1010## Important Notes
1111
12+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Changes the UID and GID of the runtime user to `65532`.
13+ Which also is known as `nonroot` user in [distroless images](https://github.com/GoogleContainerTools/distroless).
14+
1215## Breaking Changes
1316
1417## Changes since v7.2.1
1518
19+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Parameterise the runtime image (@omBratteng)
1620- [#1583](https://github.com/oauth2-proxy/oauth2-proxy/pull/1583) Add groups to session too when creating session from bearer token (@adriananeci)
1721- [#1418](https://github.com/oauth2-proxy/oauth2-proxy/pull/1418) Support for passing arbitrary query parameters through from `/oauth2/start` to the identity provider's login URL. Configuration settings control which parameters are passed by default and precisely which values can be overridden per-request (@ianroberts)
1822- [#1559](https://github.com/oauth2-proxy/oauth2-proxy/pull/1559) Introduce ProviderVerifier to clean up OIDC discovery code (@JoelSpeed)
Dockerfile+6−3
@@ -1,3 +1,6 @@
1+# This ARG has to be at the top, otherwise the docker daemon does not known what to do with FROM ${RUNTIME_IMAGE}
2+ARG RUNTIME_IMAGE=alpine:3.15
3+
14# All builds should be done using the platform native to the build node to allow
25# cache sharing of the go mod download step.
36# Go cross compilation is also faster than emulation the go compilation across
@@ -38,12 +41,12 @@ RUN case ${TARGETPLATFORM} in \
3841 GOARCH=${GOARCH} VERSION=${VERSION} make build && touch jwt_signing_key.pem
3942
4043# Copy binary to alpine
41−FROM alpine:3.15
44+FROM ${RUNTIME_IMAGE}
4245COPY nsswitch.conf /etc/nsswitch.conf
43−COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
4446COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
4547COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
4648
47−USER 2000:2000
49+# UID/GID 65532 is also known as nonroot user in distroless image
50+USER 65532:65532
4851
4952ENTRYPOINT ["/bin/oauth2-proxy"]
Makefile+2−1
@@ -40,7 +40,8 @@ $(BINARY):
4040 CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7
4141
4242DOCKER_BUILD_PLATFORM ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6
43−DOCKER_BUILDX_ARGS ?=
43+DOCKER_BUILD_RUNTIME_IMAGE ?= alpine:3.15
44+DOCKER_BUILDX_ARGS ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE}
4445DOCKER_BUILDX := docker buildx build ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}
4546DOCKER_BUILDX_X_PLATFORM := $(DOCKER_BUILDX) --platform ${DOCKER_BUILD_PLATFORM}
4647DOCKER_BUILDX_PUSH := docker buildx build --push ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}