mirror of
https://github.com/pgsty/minio.git
synced 2026-11-09 17:21:51 +03:00
Feng Ruohang
53a8f7583f
The distroless variant inherited Debian's CA bundle, which still contains the two roots (Comodo AAA Services root, emSign ECC Root CA - G3) that the classic image blocklists per RHSB-2026-012. Build the same UBI bundle in a throwaway stage and replace the only file under /etc/ssl/certs with it. Pin the busybox and distroless bases by digest like Dockerfile.goreleaser, and gate the shipped file in test-release: the bundle must parse and must not contain either blocklisted subject. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com>
73 lines
3.7 KiB
Docker
73 lines
3.7 KiB
Docker
# The distroless variant ships exactly one program: the silo binary.
|
|
# No shell, no mc, no curl, no entrypoint script; health checking is
|
|
# provided by the binary itself (`silo healthcheck`).
|
|
# Design note: https://silo.pgsty.com/compatibility/feature/healthcheck/
|
|
|
|
# A distroless final stage cannot RUN anything, so /data is prepared in a
|
|
# throwaway stage. It ships world-writable (see pgsty/silo#55): Docker
|
|
# seeds fresh volumes from the image-layer mountpoint, no entrypoint
|
|
# exists to repair ownership at runtime, and 0777 is what keeps every
|
|
# privilege mode working, --user included.
|
|
FROM busybox:1.37.0@sha256:a7dbc319b1438115a207e11930dc4bb3e643dcb3ec0bdd694bb36cd8fad289ec AS prep
|
|
RUN mkdir -p /prep/data && chmod 0777 /prep/data
|
|
|
|
# Debian's bundle in distroless still trusts the roots the classic image
|
|
# blocklists. Build the same bundle as Dockerfile.goreleaser so both variants
|
|
# trust the same roots; it is architecture-neutral, so build it natively.
|
|
FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/ubi:latest@sha256:16e9e43d99e181463513cc84a514859b1abb9460f1c4d9e208da4b4e51cd5cc3 AS certs
|
|
# Native root blocklist mitigation: https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
|
|
RUN dnf -y install ca-certificates && \
|
|
if [ -d /etc/pki/ca-trust/source/blocklist ]; then \
|
|
blocklist=/etc/pki/ca-trust/source/blocklist; \
|
|
else \
|
|
blocklist=/etc/pki/ca-trust/source/blacklist; \
|
|
fi && \
|
|
trust extract --overwrite --format=pem-bundle \
|
|
--filter='pkcs11:object=Comodo%20AAA%20Services%20root;type=cert' \
|
|
"$blocklist/Comodo_AAA_Services_root.pem" && \
|
|
trust extract --overwrite --format=pem-bundle \
|
|
--filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
|
|
"$blocklist/emSign_ECC_Root_CA_-_G3.pem" && \
|
|
update-ca-trust && \
|
|
cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt
|
|
|
|
FROM gcr.io/distroless/static-debian12:latest@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2
|
|
|
|
LABEL org.opencontainers.image.title="Silo" \
|
|
org.opencontainers.image.description="S3-Interface Libre Object Storage (distroless)" \
|
|
org.opencontainers.image.url="https://silo.pgsty.com" \
|
|
org.opencontainers.image.source="https://github.com/pgsty/silo" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-or-later" \
|
|
maintainer="PGSTY <https://silo.pgsty.com>"
|
|
|
|
ENV MINIO_ACCESS_KEY_FILE=access_key \
|
|
MINIO_SECRET_KEY_FILE=secret_key \
|
|
MINIO_ROOT_USER_FILE=access_key \
|
|
MINIO_ROOT_PASSWORD_FILE=secret_key \
|
|
MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
|
|
MINIO_CONFIG_ENV_FILE=config.env \
|
|
HOME=/tmp
|
|
|
|
# The only file under /etc/ssl/certs, so replacing it is sufficient.
|
|
COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --chmod=0755 silo /usr/bin/silo
|
|
# COPY of a directory copies its contents, not the directory entry, so an
|
|
# empty /prep/data would arrive as a default root:0755 /data and non-root
|
|
# runs would fail storage init. Copying the parent makes data/ itself a
|
|
# copied entry, which --chmod then actually applies to.
|
|
COPY --from=prep --chmod=0777 /prep/ /
|
|
COPY LICENSE NOTICE CREDITS /licenses/
|
|
|
|
EXPOSE 9000
|
|
VOLUME ["/data"]
|
|
|
|
# Exec form is mandatory: there is no /bin/sh in this image. `ready`
|
|
# rather than `live` because Docker health feeds start-order gating
|
|
# (readiness semantics); the two are identical unless KMS/etcd are used.
|
|
# The outer timeout stays above the probe's own 5s deadline so the
|
|
# probe can report its diagnostic line instead of being SIGKILLed.
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=2m --start-interval=2s --retries=3 \
|
|
CMD ["/usr/bin/silo", "healthcheck", "ready"]
|
|
|
|
ENTRYPOINT ["/usr/bin/silo"]
|