Dockerfile-auth

   1 # our chosen base image
   2 FROM debian:11-slim AS builder
   3
   4 ENV NO_LUA_JIT="s390x arm64"
   5
   6 # TODO: make sure /source looks roughly the same from git or tar
   7
   8 # Reusable layer for base update
   9 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  10
  11 # devscripts gives us mk-build-deps (and a lot of other stuff)
  12 RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y  --no-install-recommends devscripts dpkg-dev equivs git python3-venv && apt-get clean
  13
  14 # import everything - this could be pdns.git OR an auth tarball!
  15 COPY builder-support /source/builder-support
  16
  17 # TODO: control file is not in tarballs at all right now
  18 RUN mk-build-deps -i -t 'apt-get -y -o Debug::pkgProblemResolver=yes --no-install-recommends' /source/builder-support/debian/authoritative/debian-buster/control && \
  19     apt-get clean
  20
  21 # build and install (TODO: before we hit this line, rearrange /source structure if we are coming from a tarball)
  22 WORKDIR /source/
  23
  24 COPY pdns /source/pdns
  25 COPY modules /source/modules
  26 COPY codedocs /source/codedocs
  27 COPY docs /source/docs
  28 COPY build-aux /source/build-aux
  29 COPY m4 /source/m4
  30 COPY ext /source/ext
  31 COPY .git /source/.git
  32 ADD configure.ac Makefile.am /source/
  33 COPY builder/helpers/set-configure-ac-version.sh /usr/local/bin
  34
  35 ARG MAKEFLAGS=
  36 ENV MAKEFLAGS ${MAKEFLAGS:--j2}
  37
  38 ARG DOCKER_FAKE_RELEASE=NO
  39 ENV DOCKER_FAKE_RELEASE ${DOCKER_FAKE_RELEASE}
  40
  41 RUN if [ "${DOCKER_FAKE_RELEASE}" = "YES" ]; then \
  42       BUILDER_VERSION="$(IS_RELEASE=YES BUILDER_MODULES=authoritative ./builder-support/gen-version | sed 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(\(alpha|beta|rc\)\d\+\)\)?.*/\1/')" set-configure-ac-version.sh;\
  43     fi && \
  44     BUILDER_MODULES=authoritative autoreconf -vfi
  45
  46 # simplify repeated -C calls with SUBDIRS?
  47 RUN mkdir /build && \
  48     LUAVER=$([ -z "${NO_LUA_JIT##*$(dpkg --print-architecture)*}" ] && echo 'lua5.3' || echo 'luajit') && \
  49     ./configure \
  50       --with-lua=${LUAVER} \
  51       --sysconfdir=/etc/powerdns \
  52       --enable-option-checking=fatal \
  53       --with-dynmodules='bind geoip gmysql godbc gpgsql gsqlite3 ldap lmdb lua2 pipe remote tinydns' \
  54       --enable-tools \
  55       --enable-ixfrdist \
  56       --with-unixodbc-lib=/usr/lib/$(dpkg-architecture -q DEB_BUILD_GNU_TYPE) && \
  57     make clean && \
  58     make $MAKEFLAGS -C ext && make $MAKEFLAGS -C modules && make $MAKEFLAGS -C pdns && \
  59     make -C pdns install DESTDIR=/build && make -C modules install DESTDIR=/build && make clean && \
  60     strip /build/usr/local/bin/* /build/usr/local/sbin/* /build/usr/local/lib/pdns/*.so
  61 RUN cd /tmp && mkdir /build/tmp/ && mkdir debian && \
  62     echo 'Source: docker-deps-for-pdns' > debian/control && \
  63     dpkg-shlibdeps /build/usr/local/bin/* /build/usr/local/sbin/* /build/usr/local/lib/pdns/*.so && \
  64     sed 's/^shlibs:Depends=/Depends: /' debian/substvars >> debian/control && \
  65     equivs-build debian/control && \
  66     dpkg-deb -I equivs-dummy_1.0_all.deb && cp equivs-dummy_1.0_all.deb /build/tmp/
  67
  68 # Runtime
  69 FROM debian:11-slim
  70
  71 # Reusable layer for base update - Should be cached from builder
  72 RUN apt-get update && apt-get -y dist-upgrade && apt-get clean
  73
  74 # Ensure python3 and jinja2 is present (for startup script), and sqlite3 (for db schema), and tini (for signal management),
  75 #   and vim (for pdnsutil edit-zone) , and supervisor (for special use cases requiring advanced process management)
  76 RUN apt-get install -y python3 python3-jinja2 sqlite3 tini libcap2-bin vim-tiny supervisor && apt-get clean
  77
  78 # Output from builder
  79 COPY --from=builder /build /
  80 RUN chmod 1777 /tmp # FIXME: better not use /build/tmp for equivs at all
  81
  82 # Ensure dependencies are present
  83 RUN apt-get install -y /tmp/equivs-dummy_1.0_all.deb && apt-get clean
  84
  85 # Start script
  86 COPY dockerdata/startup.py /usr/local/sbin/pdns_server-startup
  87
  88 COPY dockerdata/pdns.conf /etc/powerdns/
  89 RUN mkdir -p /etc/powerdns/pdns.d /var/run/pdns /var/lib/powerdns /etc/powerdns/templates.d
  90
  91 # Work with pdns user - not root
  92 RUN adduser --system --disabled-password --disabled-login --no-create-home --group pdns --uid 953
  93 RUN chown pdns:pdns /var/run/pdns /var/lib/powerdns /etc/powerdns/pdns.d /etc/powerdns/templates.d
  94 USER pdns
  95
  96 # Set up database - this needs to be smarter
  97 RUN sqlite3 /var/lib/powerdns/pdns.sqlite3 < /usr/local/share/doc/pdns/schema.sqlite3.sql
  98
  99 # Default DNS ports
 100 EXPOSE 53/udp
 101 EXPOSE 53/tcp
 102 # Default webserver port
 103 EXPOSE 8081/tcp
 104
 105 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/sbin/pdns_server-startup"]