Skip to content

Commit a6a12ad

Browse files
ericpaulsendeansheather
ericpaulsen
and
deansheather
committed
feat: add iron bank Dockerfile & manifest
Co-authored-by: Dean Sheather <dean@deansheather.com>
1 parent ac4adab commit a6a12ad

File tree

3 files changed

+160
-0
lines changed

3 files changed

+160
-0
lines changed

‎ironbank/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
coder.tar.gz
2+
terraform.zip
3+
terraform-provider-coder.zip

‎ironbank/Dockerfile

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
ARG BASE_REGISTRY=registry1.dso.mil
2+
ARG BASE_IMAGE=ironbank/redhat/ubi/ubi8-minimal
3+
ARG BASE_TAG=8.7
4+
5+
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
6+
7+
SHELL ["/bin/bash", "-c"]
8+
9+
ENV LANG=en_US.UTF-8
10+
11+
RUN microdnf update --assumeyes && \
12+
microdnf install --assumeyes \
13+
ca-certificates \
14+
git \
15+
gzip \
16+
shadow-utils \
17+
tar \
18+
unzip && \
19+
microdnf clean all
20+
21+
# Configure the cryptography policy manually. These policies likely
22+
# have no impact, since Go doesn't link against these libraries.
23+
#
24+
# Normally, one uses the update-crypto-policies script to create these
25+
# links, which is included in the crypto-policies-scripts package, but
26+
# that pulls in Python, so we create the links manually here. This
27+
# list of links comes from running strace on the update-crypto-policies
28+
# script (strace update-crypto-policies --set FIPS) in Fedora, since
29+
# RHEL and UBI do not provide an strace package by default.
30+
RUN echo "FIPS" >/etc/crypto-policies/config && \
31+
cp --force /usr/share/crypto-policies/policies/FIPS.pol /etc/crypto-policies/state/CURRENT.pol && \
32+
echo "FIPS" >/etc/crypto-policies/state/current && \
33+
ln --symbolic --force /usr/share/crypto-policies/FIPS/bind.txt /etc/crypto-policies/back-ends/bind.config && \
34+
ln --symbolic --force /usr/share/crypto-policies/FIPS/gnutls.txt /etc/crypto-policies/back-ends/gnutls.config && \
35+
ln --symbolic --force /usr/share/crypto-policies/FIPS/java.txt /etc/crypto-policies/back-ends/java.config && \
36+
ln --symbolic --force /usr/share/crypto-policies/FIPS/krb5.txt /etc/crypto-policies/back-ends/krb5.config && \
37+
ln --symbolic --force /usr/share/crypto-policies/FIPS/libreswan.txt /etc/crypto-policies/back-ends/libreswan.config && \
38+
ln --symbolic --force /usr/share/crypto-policies/FIPS/libssh.txt /etc/crypto-policies/back-ends/libssh.config && \
39+
ln --symbolic --force /usr/share/crypto-policies/FIPS/nss.txt /etc/crypto-policies/back-ends/nss.config && \
40+
ln --symbolic --force /usr/share/crypto-policies/FIPS/openssh.txt /etc/crypto-policies/back-ends/openssh.config && \
41+
ln --symbolic --force /usr/share/crypto-policies/FIPS/opensshserver.txt /etc/crypto-policies/back-ends/opensshserver.config && \
42+
ln --symbolic --force /usr/share/crypto-policies/FIPS/openssl.txt /etc/crypto-policies/back-ends/openssl.config && \
43+
ln --symbolic --force /usr/share/crypto-policies/FIPS/opensslcnf.txt /etc/crypto-policies/back-ends/opensslcnf.config
44+
45+
# Copy and extract Coder binary from tar file.
46+
ARG CODER_BIN=/opt/coder
47+
RUN mkdir -p /opt
48+
ARG CODER_BIN_TAR_GZ=coder.tar.gz
49+
COPY "$CODER_BIN_TAR_GZ" /tmp/coder.tar.gz
50+
RUN tar -xzvf /tmp/coder.tar.gz --directory /opt --strip-components=1 ./coder && \
51+
rm /tmp/coder.tar.gz
52+
53+
# Copy and extract Terraform binary from zip file.
54+
ARG TERRAFORM_BIN_DIR=/opt/terraform
55+
RUN mkdir -p "$TERRAFORM_BIN_DIR"
56+
ARG TERRAFORM_BIN_ZIP=terraform.zip
57+
COPY "$TERRAFORM_BIN_ZIP" /tmp/terraform.zip
58+
RUN unzip /tmp/terraform.zip -d "$CODER_BIN_DIR" && \
59+
rm /tmp/terraform.zip
60+
ENV PATH="${TERRAFORM_BIN_DIR}:${PATH}"
61+
62+
# Install the Coder Terraform provider to a well-known location.
63+
ARG TERRAFORM_PLUGINS_DIR=/opt/terraform/plugins
64+
ARG TERRAFORM_CODER_PROVIDER_VERSION
65+
ARG TERRAFORM_CODER_PROVIDER_ZIP=terraform-provider-coder.zip
66+
COPY "$TERRAFORM_CODER_PROVIDER_ZIP" "${TERRAFORM_PLUGINS_DIR}/registry.terraform.io/coder/coder/terraform-provider-coder_${TERRAFORM_CODER_PROVIDER_VERSION}_linux_amd64.zip"
67+
68+
# Configure Terraform to use plugins from this dir.
69+
COPY terraform-filesystem-mirror.tfrc /opt/terraform/config.tfrc
70+
ENV TF_CLI_CONFIG_FILE=/opt/terraform/config.tfrc
71+
72+
# Uninstall the build dependencies.
73+
RUN microdnf remove --assumeyes \
74+
tar \
75+
unzip && \
76+
microdnf clean all
77+
78+
# Transfer ownership of the binaries to the 'coder' user.
79+
RUN useradd coder \
80+
--create-home \
81+
--shell=/bin/bash \
82+
--uid=1000 \
83+
--user-group && \
84+
chown --recursive --quiet coder:coder "$CODER_BIN" && \
85+
chown --recursive --quiet coder:coder "$TERRAFORM_BIN_DIR" && \
86+
chown --recursive --quiet coder:coder "$TERRAFORM_PLUGINS_DIR" && \
87+
chmod 0755 /home/coder
88+
89+
USER 1000
90+
ENV HOME /home/coder
91+
ENV USER=coder
92+
93+
ENTRYPOINT [ "/opt/coder", "server" ]

‎ironbank/hardening_manifest.yaml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
apiVersion: v1
2+
3+
# The repository name in registry1, excluding /ironbank/
4+
name: "coder/coder-enterprise/coder-service-2"
5+
6+
# List of tags to push for the repository in registry1
7+
# The most specific version should be the first tag and will be shown
8+
# on ironbank.dso.mil
9+
tags:
10+
- "0.15.3"
11+
- "latest"
12+
13+
# Build args passed to Dockerfile ARGs
14+
args:
15+
BASE_IMAGE: "redhat/ubi/ubi8"
16+
BASE_TAG: "8.7"
17+
# Needs to be kept in sync with the resource below.
18+
TERRAFORM_CODER_PROVIDER_VERSION: "0.6.9"
19+
20+
# Docker image labels
21+
labels:
22+
org.opencontainers.image.title: "coder-service-v2"
23+
# Human-readable description of the software packaged in the image
24+
org.opencontainers.image.description: "Coder server binary, includes REST API, Terraform, and dashboard"
25+
# License(s) under which contained software is distributed
26+
org.opencontainers.image.licenses: "APGL"
27+
# URL to find more information on the image
28+
org.opencontainers.image.url: "https://coder.com/docs"
29+
# Name of the distributing entity, organization or individual
30+
org.opencontainers.image.vendor: "Coder Technologies"
31+
org.opencontainers.image.version: "0.15.3"
32+
# Keywords to help with search (ex. "cicd,gitops,golang")
33+
mil.dso.ironbank.image.keywords: "remote, workspaces"
34+
35+
# List of resources to make available to the offline build context
36+
resources:
37+
# Coder binary
38+
- url: "https://github.com/coder/coder/releases/download/v0.15.3/coder_0.15.3_linux_amd64.tar.gz"
39+
filename: "coder.tar.gz"
40+
validation:
41+
type: sha256
42+
value: 2c88555777f1d9cc77a8f049093f4002472dc43d52b026e6784ef477bdced4a2
43+
# Terraform binary, bundled inside of Coder to support air-gapped installs.
44+
- url: https://releases.hashicorp.com/terraform/1.3.7/terraform_1.3.7_linux_amd64.zip
45+
filename: "terraform.zip"
46+
validation:
47+
type: sha256
48+
value: b8cf184dee15dfa89713fe56085313ab23db22e17284a9a27c0999c67ce3021e
49+
# Coder Terraform provider, bundled inside of Coder to support air-gapped
50+
# installs.
51+
- url: https://github.com/coder/terraform-provider-coder/releases/download/v0.6.9/terraform-provider-coder_0.6.9_linux_amd64.zip
52+
filename: "terraform-provider-coder.zip"
53+
validation:
54+
type: sha256
55+
value: de6db7814d4995938dcfa46a6d5b28bf9efb095fecf737285f52cfd4c85948c5
56+
57+
# List of project maintainers
58+
maintainers:
59+
- email: "eric@coder.com"
60+
name: "Eric Paulsen"
61+
username: "ericpaulsen"
62+
- email: "dean@coder.com"
63+
name: "Dean Sheather"
64+
username: "cdrdean"

0 commit comments

Comments
 (0)