etags/Dockerfile

85 lines
3.3 KiB
Docker
Raw Normal View History

FROM python:3.9-slim-buster AS builder
# staticx has two issues:
# 1. It does not seem to play well with alpine (at least for Python+pie).
# In that configuration, it seems to think it's a glibc executable
# 2. It does not play well with PIE executables, see
# https://github.com/JonathonReinhart/staticx/issues/71
2021-01-05 02:23:42 +00:00
RUN true \
&& apt-get update \
&& apt-get install --no-install-recommends -y \
build-essential=12.6 \
patchelf=0.9* \
2021-01-06 09:08:10 +00:00
zlib1g-dev=1:1.2.11* \
2021-01-06 08:42:56 +00:00
&& pip3 install scons==4.0.1 \
&& pip3 install pyinstaller==4.1 \
patchelf-wrapper==1.2.0 \
staticx==0.12.0 \
&& rm -rf /var/lib/apt/lists/*
2021-01-05 02:23:42 +00:00
ARG PYINSTALLER_TAG=v4.1
2021-01-05 02:23:42 +00:00
# HACK to get around https://github.com/JonathonReinhart/staticx/issues/71
RUN true \
&& apt-get update \
&& apt-get install --no-install-recommends -y \
git=1:2.20* \
&& git clone --depth 1 --single-branch --branch ${PYINSTALLER_TAG} \
https://github.com/pyinstaller/pyinstaller.git /tmp/pyinstaller \
&& cd /tmp/pyinstaller/bootloader \
&& CC="gcc -no-pie" python ./waf configure --no-lsb all \
&& cp -R /tmp/pyinstaller/PyInstaller/bootloader/* \
/usr/local/lib/python*/site-packages/PyInstaller/bootloader/ \
&& rm -rf /var/lib/apt/lists/*
# # ENTRYPOINT ["etags.py"]
#
COPY requirements.txt /src/
COPY etags.py /src/
WORKDIR /src
2021-01-06 18:22:41 +00:00
# We use find here because different architectures might be wildly different.
# The specific directory is named by the gcc toolchain, which doesn't really
# line up here with uname -m. As an example, 32 bit arm libraries can be the
# same across arm versions (arm7/arm8 32 bit)
# x86_64: /lib/x86_64-linux-gnu
# arm64: /lib/aarch64-linux-gnu
# arm7: /lib/arm-linux-gnueabihf
RUN true \
&& pip3 install -r requirements.txt \
&& pyinstaller -F etags.py \
&& staticx \
--strip \
--no-compress \
-l "$(find /lib -name libgcc_s.so.1 -print -quit)" \
dist/etags dist/app \
&& chmod 755 dist/app
FROM scratch
# Allow ssl comms
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
# So we can set the user
COPY --from=builder /etc/passwd /etc/passwd
COPY --from=builder /etc/group /etc/group
# This should need no privileges
USER nobody:nogroup
# Environment variables that should be set
ENV AWS_DEFAULT_REGION=us-west-2
ENV AWS_ACCESS_KEY_ID=AKIAEXAMPLE
ENV AWS_SECRET_ACCESS_KEY=dummy
# Set if you're not talking to real DDB
# ENV DDB_ENDPOINT
ENV ETAGS_TABLE=etags
# Setting this variable to nothing will turn off bus notification
ENV ETAGS_BUS_NAME=
ENTRYPOINT ["/app"]
ADD tmp.tar.gz /
COPY --from=builder /src/dist/app /app