mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
30749911bd
Dockerfile.goreleaser now copies silo to /usr/bin/silo, defaults to CMD ["silo"], and labels the image as Silo. MINIO_UPDATE_MINISIGN_PUBKEY is removed from the image environment: with the updater permanently disabled it was dead weight, and leaving upstream's verification key in a Silo image implied a trust relationship that does not exist. The MINIO_* runtime environment variables, ports, volume and health endpoints are unchanged. The image keeps shipping mcli with an /usr/bin/mc symlink. That is the client, not a MinIO-branded alias for the server binary, and the Helm post-install job and existing container scripts call it by name. docker-entrypoint.sh translates a legacy first argument: `minio server /data` becomes `silo server /data`, so an existing `command: minio server ...` in compose or a Pod spec keeps working across the image swap. The translation is argv-level only - no file named minio is installed, and an explicitly overridden `entrypoint: /usr/bin/minio` still fails, which is the honest outcome since that path genuinely no longer exists. The entrypoint also fixes an unrelated startup hazard it was already carrying: when the image runs under an arbitrary UID, HOME points at an unreadable /root and the server probes its default config directory during initialization. It now falls back to /tmp when HOME is unset, /root, missing or unwritable. docker-entrypoint_test.sh pins all of it - empty argv, legacy minio, native silo, bare flags, and an explicit shell command that must stay explicit. It is wired into make rebrand-guard and into the go.yml, release.yml and test-release.yml gates, so removing the shim breaks CI rather than breaking users. Passing locally. download-static-curl.sh gains checksum verification for the curl it fetches into the build stage. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
104 lines
4.3 KiB
Docker
104 lines
4.3 KiB
Docker
FROM golang:1.26.5-alpine AS build
|
|
|
|
ARG TARGETARCH
|
|
|
|
ENV GOPATH=/go
|
|
ENV CGO_ENABLED=0
|
|
|
|
ARG MC_REPO=pgsty/mc
|
|
ARG MC_VERSION=RELEASE.2026-08-04T00-00-00Z
|
|
ARG MC_AMD64_SHA256=4aa1fa83ea153025a3f60684e13f453749dd17587257ccb7f0dde42b560120be
|
|
ARG MC_ARM64_SHA256=18f7bd442aec24c5eb5ffd1ef368eb44f94045e2da109a344ad184f34641e273
|
|
|
|
RUN apk add -U --no-cache \
|
|
ca-certificates \
|
|
bash \
|
|
curl \
|
|
jq && \
|
|
case "${TARGETARCH}" in \
|
|
amd64) MC_ARCH=amd64; MC_PINNED_SHA256="${MC_AMD64_SHA256}" ;; \
|
|
arm64) MC_ARCH=arm64; MC_PINNED_SHA256="${MC_ARM64_SHA256}" ;; \
|
|
*) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
|
|
esac && \
|
|
if [ "${MC_VERSION}" = "latest" ]; then \
|
|
MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/latest"; \
|
|
else \
|
|
MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/tags/${MC_VERSION}"; \
|
|
fi && \
|
|
curl -fsSL "${MC_RELEASE_URL}" -o /tmp/mc-release.json && \
|
|
MC_ARCHIVE_URL=$(jq -r --arg arch "${MC_ARCH}" \
|
|
'.assets[] | select(.name | endswith("_linux_" + $arch + ".tar.gz")) | .browser_download_url' \
|
|
/tmp/mc-release.json | head -n 1) && \
|
|
MC_CHECKSUM_URL=$(jq -r \
|
|
'.assets[] | select(.name | endswith("_checksums.txt")) | .browser_download_url' \
|
|
/tmp/mc-release.json | head -n 1) && \
|
|
[ -n "${MC_ARCHIVE_URL}" ] || { echo "Cannot find mcli archive for linux/${MC_ARCH}"; exit 1; } && \
|
|
[ -n "${MC_CHECKSUM_URL}" ] || { echo "Cannot find mcli checksums file"; exit 1; } && \
|
|
ARCHIVE_NAME=$(basename "${MC_ARCHIVE_URL}") && \
|
|
echo "Downloading ${ARCHIVE_NAME} ..." && \
|
|
curl -fsSL "${MC_ARCHIVE_URL}" -o /tmp/mcli.tar.gz && \
|
|
curl -fsSL "${MC_CHECKSUM_URL}" -o /tmp/mcli_checksums.txt && \
|
|
EXPECTED=$(grep " ${ARCHIVE_NAME}$" /tmp/mcli_checksums.txt | awk '{print $1}') && \
|
|
ACTUAL=$(sha256sum /tmp/mcli.tar.gz | awk '{print $1}') && \
|
|
[ -n "${EXPECTED}" ] || { echo "Checksum entry not found for ${ARCHIVE_NAME}"; exit 1; } && \
|
|
[ "${EXPECTED}" = "${MC_PINNED_SHA256}" ] || { echo "Published checksum drift for ${ARCHIVE_NAME}"; exit 1; } && \
|
|
[ "${MC_PINNED_SHA256}" = "${ACTUAL}" ] || { echo "Checksum mismatch: expected ${MC_PINNED_SHA256}, got ${ACTUAL}"; exit 1; } && \
|
|
echo "Checksum OK: ${ACTUAL}" && \
|
|
mkdir -p /tmp/mcli-extract && \
|
|
tar -xzf /tmp/mcli.tar.gz -C /tmp/mcli-extract/ && \
|
|
if [ -f /tmp/mcli-extract/mcli ]; then \
|
|
cp /tmp/mcli-extract/mcli /go/bin/mcli; \
|
|
elif [ -f /tmp/mcli-extract/mc ]; then \
|
|
cp /tmp/mcli-extract/mc /go/bin/mcli; \
|
|
else \
|
|
echo "No mc or mcli binary found in archive:"; ls -la /tmp/mcli-extract/; exit 1; \
|
|
fi && \
|
|
chmod +x /go/bin/mcli && \
|
|
ln -sf mcli /go/bin/mc
|
|
|
|
COPY dockerscripts/download-static-curl.sh /build/download-static-curl
|
|
RUN chmod +x /build/download-static-curl && \
|
|
/build/download-static-curl
|
|
|
|
FROM registry.access.redhat.com/ubi9/ubi:latest AS certs
|
|
RUN dnf -y install ca-certificates && \
|
|
update-ca-trust && \
|
|
cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf
|
|
|
|
FROM registry.access.redhat.com/ubi9/ubi-micro:latest
|
|
|
|
LABEL org.opencontainers.image.title="Silo" \
|
|
org.opencontainers.image.description="S3-Interface Libre Object Storage" \
|
|
org.opencontainers.image.url="https://silo.pgsty.com" \
|
|
org.opencontainers.image.source="https://github.com/pgsty/minio" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-or-later" \
|
|
maintainer="PGSTY <https://silo.pgsty.com>"
|
|
|
|
ENV MINIO_ACCESS_KEY_FILE=access_key \
|
|
MINIO_SECRET_KEY_FILE=secret_key \
|
|
MINIO_ROOT_USER_FILE=access_key \
|
|
MINIO_ROOT_PASSWORD_FILE=secret_key \
|
|
MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
|
|
MINIO_CONFIG_ENV_FILE=config.env \
|
|
HOME=/tmp \
|
|
MC_CONFIG_DIR=/tmp/.mc
|
|
|
|
COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY silo /usr/bin/silo
|
|
COPY --from=build /go/bin/mcli /usr/bin/mcli
|
|
COPY --from=build /go/bin/curl* /usr/bin/
|
|
COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
|
|
COPY LICENSE /licenses/LICENSE
|
|
COPY CREDITS /licenses/CREDITS
|
|
|
|
RUN chmod +x /usr/bin/silo /usr/bin/mcli /usr/bin/docker-entrypoint.sh && \
|
|
ln -sf mcli /usr/bin/mc
|
|
|
|
EXPOSE 9000
|
|
VOLUME ["/data"]
|
|
|
|
ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
|
|
CMD ["silo"]
|