go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2024-11-24 08:52:25 +02:00
Code Issues Releases Activity
733b3fe642
oauth2-proxy/Dockerfile

33 lines
1.1 KiB
Docker
Raw Normal View History

Update go version to 1.16 This includes a fix for our samesite cookie parsing. The behaviour changed in 1.16 so that the default value now leaves it empty, so it's equivalent to not setting it (as per spec)
2021-02-17 22:59:46 +02:00
FROM golang:1.16-buster AS builder
Docker build optimization Update Dockefile to get a much smaller footprint with alpine image. Optimize ordering of build steps to avoid needless downloads. Include CA certificates needed for practical use.
2019-01-21 19:50:50 +02:00
# Copy sources
Migrate to oauth2-proxy/oauth2-proxy
2020-03-29 15:54:36 +02:00
WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
Add Dockerfile
2018-12-20 13:06:26 +02:00
# Fetch dependencies
Merge branch 'master' into go-mod * master: Move docker dep commands to earlier in the build
2019-07-15 22:38:55 +02:00
COPY go.mod go.sum ./
Ensure gomodules are used when downloading
2019-07-15 22:49:38 +02:00
RUN GO111MODULE=on go mod download
Add Dockerfile
2018-12-20 13:06:26 +02:00
Move docker dep commands to earlier in the build This will let Docker cache the results of the vendor dependencies. Making re-builds during testing faster. Also clean-up spurious test & rm in ./configure
2019-07-12 00:18:07 +02:00
# Now pull in our code
COPY . .
Minor change to the Dockerfile to improve build speed (#1139) "go mod download" does not depend on the VERSION env var, so moving the ARG directive after the RUN will allow better use of the Docker build cache - subsequent builds on the same machine need only re-run the "go mod download" if go.mod or go.sum has changed, rather than re-running it any time the VERSION value passed from the Makefile has changed Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
2021-03-29 20:08:40 +02:00
ARG VERSION
added jwt-key-file option, update docs
2019-03-21 00:15:47 +02:00
# Build binary and make sure there is at least an empty key file.
# This is useful for GCP App Engine custom runtime builds, because
# you cannot use multiline variables in their app.yaml, so you have to
# build the key into the container and then tell it where it is
# by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
# in app.yaml instead.
Reduce docker context to improve build times
2020-07-07 10:53:32 +02:00
RUN VERSION=${VERSION} make build && touch jwt_signing_key.pem
Add Dockerfile
2018-12-20 13:06:26 +02:00
Docker build optimization Update Dockefile to get a much smaller footprint with alpine image. Optimize ordering of build steps to avoid needless downloads. Include CA certificates needed for practical use.
2019-01-21 19:50:50 +02:00
# Copy binary to alpine
Update Alpine image version to 3.14 (#1244) * Update Alpine image version to 3.14. * Update changelog.
2021-06-18 14:12:11 +02:00
FROM alpine:3.14
Add nsswitch.conf to Docker image (#400) * Add nsswitch.conf to Docker image Created nsswitch.conf to use locally defined translations before DNS. Copied to /etc/nsswitch.conf in the image. * Add new line * Updated Changelog Co-authored-by: Dan Bond <danbond@protonmail.com>
2020-02-23 20:16:18 +02:00
COPY nsswitch.conf /etc/nsswitch.conf
fix(docker): simplify build by copying ca-certificates.crt
2019-02-02 03:20:20 +02:00
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
Migrate to oauth2-proxy/oauth2-proxy
2020-03-29 15:54:36 +02:00
COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
Add Dockerfile
2018-12-20 13:06:26 +02:00
fix Docker user on arm Use simple USER directive. Using `addgroup` in final `arm` image when building on amd64 doesn't work. I must have made a mistake during cross build verification. Alternative is to use qemu-static but it's not worth it for this.
2019-05-03 08:38:03 +02:00
USER 2000:2000
Potentially breaking change: docker user & group Run as non-root user and group In the unlikely event that you are currently persisting data to disk then this change may break file read/write access due to a change in the UID/GID that the oauth2_proxy process runs as. Run as non-root system user and group `oauth2proxy` with UID/GID `2000` to avoid clashing with typical local users. An alternative to creating a separate user is to ~~chown binary and~~ run as `USER nobody`, which also works, can amend this PR if required. Least access privileges. Close: https://github.com/pusher/oauth2_proxy/issues/78 Locally with Docker (`-version`): ``` $ ps aux | grep oauth2 2000 25192 6.0 0.0 0 0 ? Ds 15:53 0:00 [oauth2_proxy] ``` Running in Kubernetes 1.13 with the following also specified: ``` securityContext: readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 10001 ``` ``` $ kubectl exec -it -n oauth2-proxy oauth2-proxy-85c9f58ffc-dz9lr sh /opt $ whoami whoami: unknown uid 10001 /opt $ ps aux PID USER TIME COMMAND 1 10001 0:00 /opt/oauth2_proxy --whitelist-domain=.example.com --cookie-domain=example.com --email-domain=example.com --upstream=file:///dev/null --http-address=0.0.0.0:4180 11 10001 0:00 sh 17 10001 0:00 ps aux ``` <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> - [x] My change requires a change to the documentation or CHANGELOG. - [x] I have updated the documentation/CHANGELOG accordingly. - [x] I have created a feature (non-master) branch for my PR.
2019-03-05 10:26:49 +02:00
Migrate to oauth2-proxy/oauth2-proxy
2020-03-29 15:54:36 +02:00
ENTRYPOINT ["/bin/oauth2-proxy"]
Reference in New Issue Copy Permalink