Refactor Dockerfile for multi-stage build and runtime optimization
- Implemented a two-stage Dockerfile: build environment with Python dependencies and lean runtime stage with HAProxy. - Added custom entrypoint script for dynamic Docker group adjustment. - Improved HAProxy command generation by introducing a static method for binary resolution. - Updated tests and functional logic to dynamically resolve the `haproxy` binary path. - Adjusted file permissions in E2E key generation script for better security. - Streamlined `.gitignore` by removing unnecessary exclusions.
This commit is contained in:
Joao Gilberto Magalhaes
parent
bfd38adea5
commit
44cb3dd5e0
7 changed files with 65 additions and 77 deletions
|
|
@ -1,16 +1,39 @@
|
|||
FROM alpine:3.23
|
||||
# ==============================================================================
|
||||
# Stage 1: Build Python virtual environment and run tests
|
||||
# ==============================================================================
|
||||
FROM haproxy:3.3-alpine AS builder
|
||||
|
||||
USER root
|
||||
|
||||
RUN apk add --no-cache python3 bash curl build-base python3-dev musl-dev linux-headers \
|
||||
&& curl -LsSf https://astral.sh/uv/install.sh | sh \
|
||||
&& ln -s /root/.local/bin/uv /usr/local/bin/uv
|
||||
|
||||
WORKDIR /scripts
|
||||
|
||||
COPY pyproject.toml uv.lock LICENSE README.md ./
|
||||
COPY src/ ./src/
|
||||
COPY tests/ ./tests/
|
||||
|
||||
RUN uv sync --frozen
|
||||
RUN uv run pytest -s -vv tests/
|
||||
RUN uv sync --no-dev
|
||||
RUN rm -rf tests/
|
||||
|
||||
# ==============================================================================
|
||||
# Stage 2: Lean runtime image
|
||||
# ==============================================================================
|
||||
FROM haproxy:3.3-alpine
|
||||
|
||||
ARG RELEASE_VERSION_ARG
|
||||
|
||||
ENV RELEASE_VERSION=$RELEASE_VERSION_ARG
|
||||
ENV TZ="Etc/UTC"
|
||||
|
||||
RUN apk add --no-cache haproxy bash python3 certbot openssl curl \
|
||||
&& apk add --no-cache --virtual .build-deps build-base python3-dev musl-dev linux-headers \
|
||||
&& curl -LsSf https://astral.sh/uv/install.sh | sh \
|
||||
&& ln -s /root/.local/bin/uv /usr/local/bin/uv
|
||||
USER root
|
||||
|
||||
RUN mkdir -p /etc/easyhaproxy/haproxy \
|
||||
RUN apk add --no-cache certbot openssl bash curl su-exec \
|
||||
&& mkdir -p /etc/easyhaproxy/haproxy \
|
||||
&& openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam 2048 \
|
||||
&& openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam-1024 1024 \
|
||||
&& mkdir -p /etc/easyhaproxy/certs/certbot /etc/easyhaproxy/certs/haproxy \
|
||||
|
|
@ -22,18 +45,12 @@ RUN mkdir -p /etc/easyhaproxy/haproxy \
|
|||
&& cat /tmp/placeholder.crt /tmp/placeholder.key > /etc/easyhaproxy/certs/haproxy/placeholder.pem \
|
||||
&& rm /tmp/placeholder.key /tmp/placeholder.crt
|
||||
|
||||
WORKDIR /scripts
|
||||
|
||||
COPY build/assets /
|
||||
COPY build/entrypoint.sh /entrypoint.sh
|
||||
COPY --from=builder /scripts /scripts
|
||||
|
||||
COPY pyproject.toml uv.lock LICENSE README.md /scripts/
|
||||
COPY src/ /scripts/src/
|
||||
COPY tests/ /scripts/tests/
|
||||
RUN chmod +x /entrypoint.sh \
|
||||
&& chown -R haproxy:haproxy /etc/easyhaproxy /scripts
|
||||
|
||||
RUN cd /scripts && uv sync --frozen
|
||||
|
||||
RUN apk del .build-deps
|
||||
|
||||
RUN cd /scripts && uv run pytest -s -vv tests/ && uv sync --no-dev
|
||||
|
||||
CMD ["/scripts/.venv/bin/easy-haproxy"]
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
CMD ["--base-path", "/etc/easyhaproxy"]
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDyTCCArGgAwIBAgIUVpIokbXupa29drpQBmRlKTViM+UwDQYJKoZIhvcNAQEL
|
||||
BQAwdDELMAkGA1UEBhMCQVUxFTATBgNVBAgMDFBsYWNlIEhvbGRlcjEVMBMGA1UE
|
||||
BwwMUGxhY2UgSG9sZGVyMSEwHwYDVQQKDBhQbGFjZSBIb2xkZXIgQ2VydGlmaWNh
|
||||
dGUxFDASBgNVBAMMC2V4YW1wbGUub3JnMB4XDTIyMDgxNTA0NTEwMFoXDTMyMDgx
|
||||
MjA0NTEwMFowdDELMAkGA1UEBhMCQVUxFTATBgNVBAgMDFBsYWNlIEhvbGRlcjEV
|
||||
MBMGA1UEBwwMUGxhY2UgSG9sZGVyMSEwHwYDVQQKDBhQbGFjZSBIb2xkZXIgQ2Vy
|
||||
dGlmaWNhdGUxFDASBgNVBAMMC2V4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEF
|
||||
AAOCAQ8AMIIBCgKCAQEAqufw4FdqYcJep7mHHcYGUN79GNBLpvAIdg+1NbKx+cB/
|
||||
PtaDuozqVkkT8CmM0Mruay4vCbYkMytCeKgHj2+hLMy7oUQvx2pK/V0i0foPAC0m
|
||||
gAvgmaWZbQTENHX4A0Rwvim0yixgeBVhz4hTMOIunilSXbKRkFBUidCnYQe1Nzy1
|
||||
dbH/fh8++fzLCglDE2kydrE3Zq/54G2xFOxPt1DZRnQ3RBYaMIR/uPPjpVxRWl+p
|
||||
w4ucklAIZcu2htlOpGl7/3baMtnhpTo9LrkWzSNS7CJQvj6BvDULbcN3+hNPOoVE
|
||||
MM9MCaM9V+FS25kf+DfyaVUVDVIv0thpwa+f3tCXSwIDAQABo1MwUTAdBgNVHQ4E
|
||||
FgQUV831A1qfpV+Sy/J+lN6LKLgopsQwHwYDVR0jBBgwFoAUV831A1qfpV+Sy/J+
|
||||
lN6LKLgopsQwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAhnf7
|
||||
aW/jpr8JWC0l2lo0z1HpOaSNehhcfNyM6Y43lR3Lr1avibbIXkAOzCuSWanFNnex
|
||||
dOq8PbG9bmO1ncM6qzXRBzk4pLVJmzzDZs/fPVghSZumY2bzzJFtdCQ5FiLaaE/c
|
||||
cKtBPvoUjfvrBU9OwFSb9UaoQdxtateb/Kk6JfzWi6YZqxSXFNa0ZTWJaoRFQVj5
|
||||
bZZe+wgpGRz46p+2YMwsNolXxa+7yY9x6kOMqZP6++5LZGXm5iWxjWbN4WtqmNnN
|
||||
cK35fAdLlg4d3wn5tVuTkpKH0FcaRlgpBSjVKejgnFTCxKcOwOCqOfu+nuSSWpa7
|
||||
aRqdAbMTeVFQhyLXhQ==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCq5/DgV2phwl6n
|
||||
uYcdxgZQ3v0Y0Eum8Ah2D7U1srH5wH8+1oO6jOpWSRPwKYzQyu5rLi8JtiQzK0J4
|
||||
qAePb6EszLuhRC/Hakr9XSLR+g8ALSaAC+CZpZltBMQ0dfgDRHC+KbTKLGB4FWHP
|
||||
iFMw4i6eKVJdspGQUFSJ0KdhB7U3PLV1sf9+Hz75/MsKCUMTaTJ2sTdmr/ngbbEU
|
||||
7E+3UNlGdDdEFhowhH+48+OlXFFaX6nDi5ySUAhly7aG2U6kaXv/dtoy2eGlOj0u
|
||||
uRbNI1LsIlC+PoG8NQttw3f6E086hUQwz0wJoz1X4VLbmR/4N/JpVRUNUi/S2GnB
|
||||
r5/e0JdLAgMBAAECggEAI0nY9rmWAbF8ke1A9OjajQA+Ck2YEVQmqxn7NKc9EHCq
|
||||
1XK9qFtIV6CnOUObC9GbAQ58L+kn+FjKVNd9GCTYhsOPSnEl3GsaKM5+ThTv2/12
|
||||
oaHSMmd7EoOVb6+cEjCjhuBdsBERqjngBFYFt2Y8cfPeSfKBE+dCTWKD7QkGZe0Q
|
||||
tEII2NeE1AoQwG34TANxyn+HbZG809i+k21Pm0tPNyAFwhPvotpjSftMNgco8jcx
|
||||
39DCt7rG1etpc4VhIUUl8GqsNAHYg8/SfscE18PYeX7RJpKGS128E1mKCqWqn+Ie
|
||||
VCiMmWoQ4ZBlUFp3tS4+FWcQtDr8Z82QTZQn3ODwIQKBgQDV1NR+SxjBBnzpHDZC
|
||||
cTxCK0PU37VmPjyr6BAXlftCPLGLgKEVIDRuna6EoiZ0/K0RMDZRoaJgDQPoAXDV
|
||||
UwJOWYtlJBzUxwQbBJc3S7C3kEC+qeRT9lRwIrn7P6gT1DMcSRsV4ULwGRWAMa2Q
|
||||
6apbK/K+56Ds7LiStu3OcJSxDwKBgQDMnAvLm0uMo9ZceKG515ruqzQj2YPz2+Zc
|
||||
f38pD1hESDRj1bzgT09FAsejPnlN7KPp8TFgRUB9Rqb6DZCkx49zdtcDkuZIKfQH
|
||||
Ga7ITBXnTwe8M+nwq2Q2LJYPdB/p8mBqh4ujA2XIS7ZHCKqOFGsseP4H1uxZeORI
|
||||
pIPQp4C+BQKBgQDKHw9tAZc4feV8g4pWa6rF8ReBFKTnLFU1OXpckQybo7s/Xirl
|
||||
STfGh437GTq4wk7lPGlb6CkQGb1jhFkfjANWBBZbWDNYfXZIA6LcRdOY7+YDU5vc
|
||||
Ma/G/0xFTfqWI7LcPc44dGFNiqhkMJEbtYOuAnDGOzRGP8yIAhnvVUN3yQKBgQC1
|
||||
eaYglYGBoQMMi1Xt7iQVkbWyIkedr6l22wJe2aRRE7Wb4sQeM1m8fMWyrUOL8NpF
|
||||
MU6481NKibKp0AQ9kl5Sa9Iy8kTbNpKhBY93SbyXpwnWTDku4+UDA7KozDdOGVKY
|
||||
ydX45JeO+lAWWsJjOAsCq+Gr9F020jmvkHL1SsuuPQKBgQDHHCSOlUycLnzxEAks
|
||||
uiu5MseFzkmdWN1ShrjPkcJ4HLmSD5zRgCySpBB92WPU+yBANlY7WN6fJHVJk/d7
|
||||
sNAg78GuAxcWrNAQwu6DRjhnb8zTVICJX8HmDLmsoOHwLsShdckWMks5XEk3NzoV
|
||||
4ym6aG0tDX+rkBkP/VIjSXA+Cg==
|
||||
-----END PRIVATE KEY-----
|
||||
13
build/entrypoint.sh
Normal file
13
build/entrypoint.sh
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
## When docker.sock is mounted its GID comes from the host and is unknown at
|
||||
## build time. Detect it at startup and add the haproxy user to that group so
|
||||
## Docker/Swarm discovery works without running the whole process as root.
|
||||
#if [ -S /var/run/docker.sock ]; then
|
||||
# SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
|
||||
# getent group "$SOCK_GID" >/dev/null 2>&1 || addgroup -g "$SOCK_GID" dockersock
|
||||
# addgroup haproxy "$(getent group "$SOCK_GID" | cut -d: -f1)" 2>/dev/null || true
|
||||
#fi
|
||||
|
||||
exec /scripts/.venv/bin/easy-haproxy "$@"
|
||||
Loading…
Add table
Add a link
Reference in a new issue