2e9c30a · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Parameterise runtime image (#1478)

2e9c30aOle-Martin Bratteng5 years ago

.dockerignore+1

compare with master

unifiedsplit

@@ -1,4 +1,5 @@

1Dockerfile.dev

2+Dockerfile

2docs

3docs

3vendor

4vendor

4.git

5.git

CHANGELOG.md+4

@@ -9,10 +9,14 @@

10## Important Notes

12+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Changes the UID and GID of the runtime user to `65532`.

13+ Which also is known as `nonroot` user in [distroless images](https://github.com/GoogleContainerTools/distroless).

14+

12## Breaking Changes

15## Breaking Changes

14## Changes since v7.2.1

17## Changes since v7.2.1

19+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Parameterise the runtime image (@omBratteng)

16- [#1583](https://github.com/oauth2-proxy/oauth2-proxy/pull/1583) Add groups to session too when creating session from bearer token (@adriananeci)

20- [#1583](https://github.com/oauth2-proxy/oauth2-proxy/pull/1583) Add groups to session too when creating session from bearer token (@adriananeci)

17- [#1418](https://github.com/oauth2-proxy/oauth2-proxy/pull/1418) Support for passing arbitrary query parameters through from `/oauth2/start` to the identity provider's login URL. Configuration settings control which parameters are passed by default and precisely which values can be overridden per-request (@ianroberts)

21- [#1418](https://github.com/oauth2-proxy/oauth2-proxy/pull/1418) Support for passing arbitrary query parameters through from `/oauth2/start` to the identity provider's login URL. Configuration settings control which parameters are passed by default and precisely which values can be overridden per-request (@ianroberts)

18- [#1559](https://github.com/oauth2-proxy/oauth2-proxy/pull/1559) Introduce ProviderVerifier to clean up OIDC discovery code (@JoelSpeed)

22- [#1559](https://github.com/oauth2-proxy/oauth2-proxy/pull/1559) Introduce ProviderVerifier to clean up OIDC discovery code (@JoelSpeed)

Dockerfile+6−3

@@ -1,3 +1,6 @@

1+# This ARG has to be at the top, otherwise the docker daemon does not known what to do with FROM ${RUNTIME_IMAGE}

2+ARG RUNTIME_IMAGE=alpine:3.15

1# All builds should be done using the platform native to the build node to allow

4# All builds should be done using the platform native to the build node to allow

2# cache sharing of the go mod download step.

5# cache sharing of the go mod download step.

3# Go cross compilation is also faster than emulation the go compilation across

6# Go cross compilation is also faster than emulation the go compilation across

@@ -38,12 +41,12 @@ RUN case ${TARGETPLATFORM} in \

38 GOARCH=${GOARCH} VERSION=${VERSION} make build && touch jwt_signing_key.pem

41 GOARCH=${GOARCH} VERSION=${VERSION} make build && touch jwt_signing_key.pem

40# Copy binary to alpine

43# Copy binary to alpine

41−FROM alpine:3.15

44+FROM ${RUNTIME_IMAGE}

42COPY nsswitch.conf /etc/nsswitch.conf

45COPY nsswitch.conf /etc/nsswitch.conf

43−COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

44COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy

46COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy

45COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

47COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

47−USER 2000:2000

49+# UID/GID 65532 is also known as nonroot user in distroless image

50+USER 65532:65532

49ENTRYPOINT ["/bin/oauth2-proxy"]

52ENTRYPOINT ["/bin/oauth2-proxy"]

Makefile+2−1

@@ -40,7 +40,8 @@ $(BINARY):

40 CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7

42DOCKER_BUILD_PLATFORM ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6

43+DOCKER_BUILD_RUNTIME_IMAGE ?= alpine:3.15

43−DOCKER_BUILDX_ARGS ?=

44+DOCKER_BUILDX_ARGS ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE}

44DOCKER_BUILDX := docker buildx build ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}

45DOCKER_BUILDX := docker buildx build ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}

45DOCKER_BUILDX_X_PLATFORM := $(DOCKER_BUILDX) --platform ${DOCKER_BUILD_PLATFORM}

46DOCKER_BUILDX_X_PLATFORM := $(DOCKER_BUILDX) --platform ${DOCKER_BUILD_PLATFORM}

46DOCKER_BUILDX_PUSH := docker buildx build --push ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}

47DOCKER_BUILDX_PUSH := docker buildx build --push ${DOCKER_BUILDX_ARGS} --build-arg VERSION=${VERSION}