Skip to content

Commit 61937bb

Browse files
chore: update webapp base image to use airbyte nginx image (#14687)
Co-authored-by: Alex Buchanan <[email protected]>
1 parent d89d8f4 commit 61937bb

File tree

15 files changed

+589
-26
lines changed

15 files changed

+589
-26
lines changed

airbyte-webapp/Dockerfile

+4-6
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,18 @@
1-
ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:alpine3.20
1+
ARG NGINX_IMAGE=airbyte/nginx-unprivileged:alpine3.20-2
22
FROM ${NGINX_IMAGE}
33

44
ARG BUILD_DIR=bin/build
55
ARG NGINX_CONFIG=bin/nginx/default.conf.template
66

77
EXPOSE 8080
88

9-
USER root
9+
COPY --chown=nginx:nginx ${BUILD_DIR} /usr/share/nginx/html
10+
COPY --chown=nginx:nginx ${NGINX_CONFIG} /etc/nginx/templates/default.conf.template
1011

11-
COPY ${BUILD_DIR} /usr/share/nginx/html
12+
USER root
1213

1314
RUN <<EOF
1415
find /usr/share/nginx/html -type d -exec chmod 755 '{}' \; -o -type f -exec chmod 644 '{}' \;
15-
chown -R nginx:nginx /usr/share/nginx/html
1616
EOF
1717

18-
COPY ${NGINX_CONFIG} /etc/nginx/templates/default.conf.template
19-
2018
USER nginx:nginx

charts/airbyte/values.yaml

+3-6
Original file line numberDiff line numberDiff line change
@@ -237,16 +237,13 @@ webapp:
237237

238238
# -- Security context for the container
239239
podSecurityContext:
240-
# gid=101(nginx)
241-
fsGroup: 101
240+
fsGroup: 1000
242241

243242
containerSecurityContext:
244243
allowPrivilegeEscalation: false
245244
runAsNonRoot: true
246-
# uid=101(nginx)
247-
runAsUser: 101
248-
# gid=101(nginx)
249-
runAsGroup: 101
245+
runAsUser: 1000
246+
runAsGroup: 1000
250247
readOnlyRootFilesystem: false
251248
capabilities:
252249
drop: ["ALL"]

charts/helm-tests/go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ module github.com/airbytehq/airbyte-platform-internal/oss/charts/helm-tests
33
go 1.23.1
44

55
require (
6-
github.com/gruntwork-io/terratest v0.46.14
7-
github.com/stretchr/testify v1.8.4
6+
github.com/gruntwork-io/terratest v0.47.2
7+
github.com/stretchr/testify v1.9.0
88
gopkg.in/yaml.v3 v3.0.1
99
k8s.io/api v0.30.0
1010
k8s.io/apimachinery v0.30.0

charts/helm-tests/go.sum

+4
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ github.com/gruntwork-io/go-commons v0.8.0 h1:k/yypwrPqSeYHevLlEDmvmgQzcyTwrlZGRa
8383
github.com/gruntwork-io/go-commons v0.8.0/go.mod h1:gtp0yTtIBExIZp7vyIV9I0XQkVwiQZze678hvDXof78=
8484
github.com/gruntwork-io/terratest v0.46.14 h1:nVT2JpOPLr7KbwOSNDP0GJffljH+Yu5833cwLorxRjs=
8585
github.com/gruntwork-io/terratest v0.46.14/go.mod h1:L/IHbj195wnjfIFpZYWUhjwA3jm4O6ehO//xz7NxN8o=
86+
github.com/gruntwork-io/terratest v0.47.2 h1:t6iWwsqJH7Gx0RwXleU/vjc+2c0JXRMdj3DxYXTBssQ=
87+
github.com/gruntwork-io/terratest v0.47.2/go.mod h1:LnYX8BN5WxUMpDr8rtD39oToSL4CBERWSCusbJ0d/64=
8688
github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
8789
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
8890
github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
@@ -190,6 +192,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
190192
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
191193
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
192194
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
195+
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
196+
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
193197
github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
194198
github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
195199
github.com/urfave/cli v1.22.2 h1:gsqYFH8bb9ekPA12kRo0hfjngWQjkJPlN9R0N78BoUo=

charts/v2/airbyte/values.yaml

+3-6
Original file line numberDiff line numberDiff line change
@@ -472,16 +472,13 @@ webapp:
472472

473473
# -- Security context for the container
474474
podSecurityContext:
475-
# gid=101(nginx)
476-
fsGroup: 101
475+
fsGroup: 1000
477476

478477
containerSecurityContext:
479478
allowPrivilegeEscalation: false
480479
runAsNonRoot: true
481-
# uid=101(nginx)
482-
runAsUser: 101
483-
# gid=101(nginx)
484-
runAsGroup: 101
480+
runAsUser: 1000
481+
runAsGroup: 1000
485482
readOnlyRootFilesystem: false
486483
capabilities:
487484
drop: ["ALL"]

docker/Makefile

+22-4
Original file line numberDiff line numberDiff line change
@@ -84,18 +84,36 @@ image.airbyte-mc: buildx.start
8484
-f $(IMAGES_DIR)/airbyte-mc/Dockerfile . ; \
8585
fi
8686

87-
image.airbyte-nginx: ## Build the airbyte/nginx image
88-
image.airbyte-nginx: buildx.start
87+
image.airbyte-nginx-slim: ## Build the airbyte/nginx-unprivileged image
88+
image.airbyte-nginx-slim: buildx.start
89+
@if [ "$(PUBLISH)" = "true" ]; then \
90+
docker buildx build -t airbyte/nginx-alpine-slim:$(VERSION) \
91+
--build-arg UID="1000" \
92+
--build-arg GID="1000" \
93+
--platform linux/amd64,linux/arm64 \
94+
--push \
95+
-f $(IMAGES_DIR)/airbyte-nginx/alpine-slim/Dockerfile $(IMAGES_DIR)/airbyte-nginx/alpine-slim/. ; \
96+
else \
97+
docker build -t airbyte/nginx-alpine-slim:$(VERSION) \
98+
--build-arg UID="1000" \
99+
--build-arg GID="1000" \
100+
-f $(IMAGES_DIR)/airbyte-nginx/alpine-slim/Dockerfile $(IMAGES_DIR)/airbyte-nginx/alpine-slim/. ; \
101+
fi
102+
103+
image.airbyte-nginx-unprivileged: ## Build the airbyte/nginx-unprivileged image
104+
image.airbyte-nginx-unprivileged: buildx.start
89105
@if [ "$(PUBLISH)" = "true" ]; then \
90106
docker buildx build -t airbyte/nginx-unprivileged:$(VERSION) \
107+
--build-arg IMAGE="airbyte/nginx-alpine-slim:1.27.2-alpine-slim-2" \
91108
--build-arg UID="1000" \
92109
--build-arg GID="1000" \
93110
--platform linux/amd64,linux/arm64 \
94111
--push \
95-
-f $(IMAGES_DIR)/airbyte-nginx/Dockerfile . ; \
112+
-f $(IMAGES_DIR)/airbyte-nginx/unprivileged/Dockerfile $(IMAGES_DIR)/airbyte-nginx/unprivileged/. ; \
96113
else \
97114
docker build -t airbyte/nginx-unprivileged:$(VERSION) \
115+
--build-arg IMAGE="airbyte/nginx-alpine-slim:1.27.2-alpine-slim-2" \
98116
--build-arg UID="1000" \
99117
--build-arg GID="1000" \
100-
-f $(IMAGES_DIR)/airbyte-nginx/Dockerfile . ; \
118+
-f $(IMAGES_DIR)/airbyte-nginx/unprivileged/Dockerfile $(IMAGES_DIR)/airbyte-nginx/unprivileged/. ; \
101119
fi
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/bin/sh
2+
# vim:sw=4:ts=4:et
3+
4+
set -e
5+
6+
entrypoint_log() {
7+
if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
8+
echo "$@"
9+
fi
10+
}
11+
12+
ME=$(basename "$0")
13+
DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
14+
15+
# check if we have ipv6 available
16+
if [ ! -f "/proc/net/if_inet6" ]; then
17+
entrypoint_log "$ME: info: ipv6 not available"
18+
exit 0
19+
fi
20+
21+
if [ ! -f "/$DEFAULT_CONF_FILE" ]; then
22+
entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE is not a file or does not exist"
23+
exit 0
24+
fi
25+
26+
# check if the file can be modified, e.g. not on a r/o filesystem
27+
touch /$DEFAULT_CONF_FILE 2>/dev/null || { entrypoint_log "$ME: info: can not modify /$DEFAULT_CONF_FILE (read-only file system?)"; exit 0; }
28+
29+
# check if the file is already modified, e.g. on a container restart
30+
grep -q "listen \[::]\:8080;" /$DEFAULT_CONF_FILE && { entrypoint_log "$ME: info: IPv6 listen already enabled"; exit 0; }
31+
32+
if [ -f "/etc/os-release" ]; then
33+
. /etc/os-release
34+
else
35+
entrypoint_log "$ME: info: can not guess the operating system"
36+
exit 0
37+
fi
38+
39+
entrypoint_log "$ME: info: Getting the checksum of /$DEFAULT_CONF_FILE"
40+
41+
case "$ID" in
42+
"debian")
43+
CHECKSUM=$(dpkg-query --show --showformat='${Conffiles}\n' nginx | grep $DEFAULT_CONF_FILE | cut -d' ' -f 3)
44+
echo "$CHECKSUM /$DEFAULT_CONF_FILE" | md5sum -c - >/dev/null 2>&1 || {
45+
entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
46+
exit 0
47+
}
48+
;;
49+
"alpine")
50+
CHECKSUM=$(apk manifest nginx 2>/dev/null| grep $DEFAULT_CONF_FILE | cut -d' ' -f 1 | cut -d ':' -f 2)
51+
echo "$CHECKSUM /$DEFAULT_CONF_FILE" | sha1sum -c - >/dev/null 2>&1 || {
52+
entrypoint_log "$ME: info: /$DEFAULT_CONF_FILE differs from the packaged version"
53+
exit 0
54+
}
55+
;;
56+
*)
57+
entrypoint_log "$ME: info: Unsupported distribution"
58+
exit 0
59+
;;
60+
esac
61+
62+
# enable ipv6 on default.conf listen sockets
63+
sed -i -E 's,listen 8080;,listen 8080;\n listen [::]:8080;,' /$DEFAULT_CONF_FILE
64+
65+
entrypoint_log "$ME: info: Enabled listen on IPv6 in /$DEFAULT_CONF_FILE"
66+
67+
exit 0
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/sh
2+
# vim:sw=2:ts=2:sts=2:et
3+
4+
set -eu
5+
6+
LC_ALL=C
7+
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
8+
9+
[ "${NGINX_ENTRYPOINT_LOCAL_RESOLVERS:-}" ] || return 0
10+
11+
NGINX_LOCAL_RESOLVERS=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {if ($2 ~ ":") {print "["$2"]"} else {print $2}}' /etc/resolv.conf)
12+
13+
NGINX_LOCAL_RESOLVERS="${NGINX_LOCAL_RESOLVERS% }"
14+
15+
export NGINX_LOCAL_RESOLVERS
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
ME=$(basename "$0")
6+
7+
entrypoint_log() {
8+
if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
9+
echo "$@"
10+
fi
11+
}
12+
13+
add_stream_block() {
14+
local conffile="/etc/nginx/nginx.conf"
15+
16+
if grep -q -E "\s*stream\s*\{" "$conffile"; then
17+
entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates"
18+
else
19+
# check if the file can be modified, e.g. not on a r/o filesystem
20+
touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; }
21+
entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf"
22+
cat << END >> "$conffile"
23+
# added by "$ME" on "$(date)"
24+
stream {
25+
include $stream_output_dir/*.conf;
26+
}
27+
END
28+
fi
29+
}
30+
31+
auto_envsubst() {
32+
local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}"
33+
local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
34+
local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}"
35+
local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}"
36+
local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}"
37+
local filter="${NGINX_ENVSUBST_FILTER:-}"
38+
39+
local template defined_envs relative_path output_path subdir
40+
defined_envs=$(printf '${%s} ' $(awk "END { for (name in ENVIRON) { print ( name ~ /${filter}/ ) ? name : \"\" } }" < /dev/null ))
41+
[ -d "$template_dir" ] || return 0
42+
if [ ! -w "$output_dir" ]; then
43+
entrypoint_log "$ME: ERROR: $template_dir exists, but $output_dir is not writable"
44+
return 0
45+
fi
46+
find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
47+
relative_path="${template#"$template_dir/"}"
48+
output_path="$output_dir/${relative_path%"$suffix"}"
49+
subdir=$(dirname "$relative_path")
50+
# create a subdirectory where the template file exists
51+
mkdir -p "$output_dir/$subdir"
52+
entrypoint_log "$ME: Running envsubst on $template to $output_path"
53+
envsubst "$defined_envs" < "$template" > "$output_path"
54+
done
55+
56+
# Print the first file with the stream suffix, this will be false if there are none
57+
if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then
58+
mkdir -p "$stream_output_dir"
59+
if [ ! -w "$stream_output_dir" ]; then
60+
entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable"
61+
return 0
62+
fi
63+
add_stream_block
64+
find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
65+
relative_path="${template#"$template_dir/"}"
66+
output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
67+
subdir=$(dirname "$relative_path")
68+
# create a subdirectory where the template file exists
69+
mkdir -p "$stream_output_dir/$subdir"
70+
entrypoint_log "$ME: Running envsubst on $template to $output_path"
71+
envsubst "$defined_envs" < "$template" > "$output_path"
72+
done
73+
fi
74+
}
75+
76+
auto_envsubst
77+
78+
exit 0

0 commit comments

Comments
 (0)