Skip to content

Commit c9237ba

Browse files
valentijnscholtenvalentijnscholten
committed
cleanup
1 parent 9bbec28 commit c9237ba

5 files changed

Lines changed: 454 additions & 3 deletions

File tree

‎.github/workflows/release-2-tag-docker-push.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,11 @@ jobs:
2929
git config --global user.name "${{ env.GIT_USERNAME }}"
3030
git config --global user.email "${{ env.GIT_EMAIL }}"
3131
32-
# TODO REMOVE -f
3332
- name: Create new tag ${{ github.event.inputs.release_number }}
3433
# at this point, the PR from the 1st workflow is merged into master.
3534
run: |
36-
git tag -f -a ${{ github.event.inputs.release_number }} -m "[bot] release ${{ github.event.inputs.release_number }}"
37-
git push origin ${{ github.event.inputs.release_number }} -f
35+
git tag -a ${{ github.event.inputs.release_number }} -m "[bot] release ${{ github.event.inputs.release_number }}"
36+
git push origin ${{ github.event.inputs.release_number }}
3837
3938
publish-docker-containers:
4039
needs: tag

‎Dockerfile.django-alpine‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,139 @@
1+
2+
# code: language=Dockerfile
3+
4+
# The code for the build image should be identical with the code in
5+
# Dockerfile.nginx to use the caching mechanism of Docker.
6+
7+
# Ref: https://devguide.python.org/#branchstatus
18
FROM python:3.11.11-alpine3.21@sha256:9af3561825050da182afc74b106388af570b99c500a69c8216263aa245a2001b AS base
9+
FROM base AS build
10+
WORKDIR /app
11+
RUN \
12+
apk update && \
13+
apk add --no-cache \
14+
gcc \
15+
build-base \
16+
bind-tools \
17+
postgresql16-client \
18+
xmlsec \
19+
git \
20+
util-linux \
21+
curl-dev \
22+
openssl \
23+
libffi-dev \
24+
python3-dev \
25+
libpq-dev \
26+
&& \
27+
rm -rf /var/cache/apk/* && \
28+
true
29+
COPY requirements.txt ./
30+
# CPUCOUNT=1 is needed, otherwise the wheel for uwsgi won't always be build succesfully
31+
# https://github.com/unbit/uwsgi/issues/1318#issuecomment-542238096
32+
RUN CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt
33+
34+
FROM base AS django
35+
WORKDIR /app
36+
ARG uid=1001
37+
ARG gid=1337
38+
ARG appuser=defectdojo
39+
ENV appuser=${appuser}
40+
RUN \
41+
apk update && \
42+
apk add --no-cache \
43+
openjpeg \
44+
jpeg \
45+
tiff \
46+
bind-tools \
47+
xmlsec \
48+
git \
49+
util-linux \
50+
postgresql16-client \
51+
curl-dev \
52+
openssl \
53+
# needed for integration-tests
54+
bash \
55+
&& \
56+
rm -rf /var/cache/apk/* && \
57+
true
58+
COPY --from=build /tmp/wheels /tmp/wheels
59+
COPY requirements.txt ./
60+
RUN export PYCURL_SSL_LIBRARY=openssl && \
61+
pip3 install \
62+
--no-cache-dir \
63+
--no-index \
64+
--find-links=/tmp/wheels \
65+
-r ./requirements.txt
66+
67+
COPY \
68+
docker/entrypoint-celery-beat.sh \
69+
docker/entrypoint-celery-worker.sh \
70+
docker/entrypoint-initializer.sh \
71+
docker/entrypoint-first-boot.sh \
72+
docker/entrypoint-uwsgi.sh \
73+
docker/entrypoint-uwsgi-dev.sh \
74+
docker/entrypoint-unit-tests.sh \
75+
docker/entrypoint-unit-tests-devDocker.sh \
76+
docker/wait-for-it.sh \
77+
docker/secret-file-loader.sh \
78+
docker/reach_database.sh \
79+
docker/certs/* \
80+
/
81+
COPY wsgi.py manage.py docker/unit-tests.sh ./
82+
COPY dojo/ ./dojo/
83+
84+
# Add extra fixtures to docker image which are loaded by the initializer
85+
COPY docker/extra_fixtures/* /app/dojo/fixtures/
86+
87+
COPY tests/ ./tests/
88+
RUN \
89+
# Remove placeholder copied from docker/certs
90+
rm -f /readme.txt && \
91+
# Remove placeholder copied from docker/extra_fixtures
92+
rm -f dojo/fixtures/readme.txt && \
93+
mkdir -p dojo/migrations && \
94+
chmod g=u dojo/migrations && \
95+
true
96+
USER root
97+
RUN \
98+
addgroup --gid ${gid} ${appuser} && \
99+
adduser --system --no-create-home --disabled-password --gecos '' \
100+
--uid ${uid} --ingroup ${appuser} ${appuser} && \
101+
chown -R root:root /app && \
102+
chmod -R u+rwX,go+rX,go-w /app && \
103+
# Allow for bind mounting local_settings.py and other setting overrides
104+
chown -R root:${appuser} /app/dojo/settings && \
105+
chmod -R 775 /app/dojo/settings && \
106+
mkdir /var/run/${appuser} && \
107+
chown ${appuser} /var/run/${appuser} && \
108+
chmod g=u /var/run/${appuser} && \
109+
chmod 775 /*.sh && \
110+
mkdir -p media/threat && chown -R ${uid} media && \
111+
# To avoid warning: (staticfiles.W004) The directory '/app/components/node_modules' in the STATICFILES_DIRS setting does not exist.
112+
mkdir -p components/node_modules && \
113+
chown ${appuser} components/node_modules
114+
USER ${uid}
115+
ENV \
116+
# Only variables that are not defined in settings.dist.py
117+
DD_ADMIN_USER=admin \
118+
DD_ADMIN_MAIL=admin@defectdojo.local \
119+
DD_ADMIN_PASSWORD='' \
120+
DD_ADMIN_FIRST_NAME=Admin \
121+
DD_ADMIN_LAST_NAME=User \
122+
DD_CELERY_LOG_LEVEL="INFO" \
123+
DD_CELERY_WORKER_POOL_TYPE="solo" \
124+
# Enable prefork and options below to ramp-up celeryworker performance. Presets should work fine for a machine with 8GB of RAM, while still leaving room.
125+
# See https://docs.celeryproject.org/en/stable/userguide/workers.html#id12 for more details
126+
# DD_CELERY_WORKER_POOL_TYPE="prefork" \
127+
# DD_CELERY_WORKER_AUTOSCALE_MIN="2" \
128+
# DD_CELERY_WORKER_AUTOSCALE_MAX="8" \
129+
# DD_CELERY_WORKER_CONCURRENCY="8" \
130+
# DD_CELERY_WORKER_PREFETCH_MULTIPLIER="128" \
131+
DD_INITIALIZE=true \
132+
DD_UWSGI_MODE="socket" \
133+
DD_UWSGI_ENDPOINT="0.0.0.0:3031" \
134+
DD_UWSGI_NUM_OF_PROCESSES="2" \
135+
DD_UWSGI_NUM_OF_THREADS="2"
136+
ENTRYPOINT ["/entrypoint-uwsgi.sh"]
137+
138+
FROM django AS django-unittests
139+
COPY unittests/ ./unittests/

‎Dockerfile.django-debian‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,142 @@
1+
2+
# code: language=Dockerfile
3+
4+
# The code for the build image should be identical with the code in
5+
# Dockerfile.nginx to use the caching mechanism of Docker.
6+
7+
# Ref: https://devguide.python.org/#branchstatus
18
FROM python:3.11.11-slim-bookworm@sha256:42420f737ba91d509fc60d5ed65ed0492678a90c561e1fa08786ae8ba8b52eda AS base
9+
FROM base AS build
10+
WORKDIR /app
11+
RUN \
12+
apt-get -y update && \
13+
apt-get -y install --no-install-recommends \
14+
gcc \
15+
build-essential \
16+
dnsutils \
17+
libpq-dev \
18+
postgresql-client \
19+
xmlsec1 \
20+
git \
21+
uuid-runtime \
22+
# libcurl4-openssl-dev is required for installing pycurl python package
23+
libcurl4-openssl-dev \
24+
&& \
25+
apt-get clean && \
26+
rm -rf /var/lib/apt/lists && \
27+
true
28+
COPY requirements.txt ./
29+
# CPUCOUNT=1 is needed, otherwise the wheel for uwsgi won't always be build succesfully
30+
# https://github.com/unbit/uwsgi/issues/1318#issuecomment-542238096
31+
RUN CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt
32+
33+
FROM base AS django
34+
WORKDIR /app
35+
ARG uid=1001
36+
ARG gid=1337
37+
ARG appuser=defectdojo
38+
ENV appuser=${appuser}
39+
RUN \
40+
apt-get -y update && \
41+
# ugly fix to install postgresql-client without errors
42+
mkdir -p /usr/share/man/man1 /usr/share/man/man7 && \
43+
apt-get -y install --no-install-recommends \
44+
# libopenjp2-7 libjpeg62 libtiff are required by the pillow package
45+
libopenjp2-7 \
46+
libjpeg62 \
47+
libtiff6 \
48+
dnsutils \
49+
xmlsec1 \
50+
git \
51+
uuid-runtime \
52+
libpq-dev \
53+
# only required for the dbshell (used by the initializer job)
54+
postgresql-client \
55+
# libcurl4-openssl-dev is required for installing pycurl python package
56+
libcurl4-openssl-dev \
57+
&& \
58+
apt-get clean && \
59+
rm -rf /var/lib/apt/lists && \
60+
true
61+
COPY --from=build /tmp/wheels /tmp/wheels
62+
COPY requirements.txt ./
63+
RUN export PYCURL_SSL_LIBRARY=openssl && \
64+
pip3 install \
65+
--no-cache-dir \
66+
--no-index \
67+
--find-links=/tmp/wheels \
68+
-r ./requirements.txt
69+
70+
COPY \
71+
docker/entrypoint-celery-beat.sh \
72+
docker/entrypoint-celery-worker.sh \
73+
docker/entrypoint-initializer.sh \
74+
docker/entrypoint-first-boot.sh \
75+
docker/entrypoint-uwsgi.sh \
76+
docker/entrypoint-uwsgi-dev.sh \
77+
docker/entrypoint-unit-tests.sh \
78+
docker/entrypoint-unit-tests-devDocker.sh \
79+
docker/wait-for-it.sh \
80+
docker/secret-file-loader.sh \
81+
docker/reach_database.sh \
82+
docker/certs/* \
83+
/
84+
COPY wsgi.py manage.py docker/unit-tests.sh ./
85+
COPY dojo/ ./dojo/
86+
87+
# Add extra fixtures to docker image which are loaded by the initializer
88+
COPY docker/extra_fixtures/* /app/dojo/fixtures/
89+
90+
COPY tests/ ./tests/
91+
RUN \
92+
# Remove placeholder copied from docker/certs
93+
rm -f /readme.txt && \
94+
# Remove placeholder copied from docker/extra_fixtures
95+
rm -f dojo/fixtures/readme.txt && \
96+
mkdir -p dojo/migrations && \
97+
chmod g=u dojo/migrations && \
98+
true
99+
USER root
100+
RUN \
101+
addgroup --gid ${gid} ${appuser} && \
102+
adduser --system --no-create-home --disabled-password --gecos '' \
103+
--uid ${uid} --gid ${gid} ${appuser} && \
104+
chown -R root:root /app && \
105+
chmod -R u+rwX,go+rX,go-w /app && \
106+
# Allow for bind mounting local_settings.py and other setting overrides
107+
chown -R root:${appuser} /app/dojo/settings && \
108+
chmod -R 775 /app/dojo/settings && \
109+
mkdir /var/run/${appuser} && \
110+
chown ${appuser} /var/run/${appuser} && \
111+
chmod g=u /var/run/${appuser} && \
112+
chmod 775 /*.sh && \
113+
mkdir -p media/threat && chown -R ${uid} media && \
114+
# To avoid warning: (staticfiles.W004) The directory '/app/components/node_modules' in the STATICFILES_DIRS setting does not exist.
115+
mkdir -p components/node_modules && \
116+
chown ${appuser} components/node_modules
117+
USER ${uid}
118+
ENV \
119+
# Only variables that are not defined in settings.dist.py
120+
DD_ADMIN_USER=admin \
121+
DD_ADMIN_MAIL=admin@defectdojo.local \
122+
DD_ADMIN_PASSWORD='' \
123+
DD_ADMIN_FIRST_NAME=Admin \
124+
DD_ADMIN_LAST_NAME=User \
125+
DD_CELERY_LOG_LEVEL="INFO" \
126+
DD_CELERY_WORKER_POOL_TYPE="solo" \
127+
# Enable prefork and options below to ramp-up celeryworker performance. Presets should work fine for a machine with 8GB of RAM, while still leaving room.
128+
# See https://docs.celeryproject.org/en/stable/userguide/workers.html#id12 for more details
129+
# DD_CELERY_WORKER_POOL_TYPE="prefork" \
130+
# DD_CELERY_WORKER_AUTOSCALE_MIN="2" \
131+
# DD_CELERY_WORKER_AUTOSCALE_MAX="8" \
132+
# DD_CELERY_WORKER_CONCURRENCY="8" \
133+
# DD_CELERY_WORKER_PREFETCH_MULTIPLIER="128" \
134+
DD_INITIALIZE=true \
135+
DD_UWSGI_MODE="socket" \
136+
DD_UWSGI_ENDPOINT="0.0.0.0:3031" \
137+
DD_UWSGI_NUM_OF_PROCESSES="2" \
138+
DD_UWSGI_NUM_OF_THREADS="2"
139+
ENTRYPOINT ["/entrypoint-uwsgi.sh"]
140+
141+
FROM django AS django-unittests
142+
COPY unittests/ ./unittests/

‎Dockerfile.nginx-alpine‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,78 @@
55
# Dockerfile.django-alpine to use the caching mechanism of Docker.
66

77
# Ref: https://devguide.python.org/#branchstatus
8+
FROM python:3.11.11-alpine3.20@sha256:6e18772230b36e78251ed179a2a2a2b3cc94726f02e1fddccdcfbe05b17bdc96 AS base
9+
10+
FROM base AS build
11+
WORKDIR /app
12+
RUN \
13+
apk update && \
14+
apk add --no-cache \
15+
gcc \
16+
build-base \
17+
bind-tools \
18+
postgresql16-client \
19+
xmlsec \
20+
git \
21+
util-linux \
22+
curl-dev \
23+
openssl \
24+
libffi-dev \
25+
python3-dev \
26+
libpq-dev \
27+
&& \
28+
rm -rf /var/cache/apk/* && \
29+
true
30+
COPY requirements.txt ./
31+
# CPUCOUNT=1 is needed, otherwise the wheel for uwsgi won't always be build succesfully
32+
# https://github.com/unbit/uwsgi/issues/1318#issuecomment-542238096
33+
RUN CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt
34+
35+
36+
FROM build AS collectstatic
37+
RUN apk add nodejs npm
38+
RUN npm install -g yarn --force
39+
40+
41+
# installing DefectDojo packages
42+
RUN pip3 install \
43+
--no-cache-dir \
44+
--no-index \
45+
--find-links=/tmp/wheels \
46+
-r ./requirements.txt
47+
48+
# generate static files
49+
COPY components/ ./components/
50+
RUN \
51+
cd components && \
52+
yarn
53+
COPY manage.py ./
54+
COPY dojo/ ./dojo/
55+
RUN env DD_SECRET_KEY='.' python3 manage.py collectstatic --noinput && true
856

957
FROM nginx:1.27.4-alpine3.21@sha256:4ff102c5d78d254a6f0da062b3cf39eaf07f01eec0927fd21e219d0af8bc0591
58+
ARG uid=1001
59+
ARG appuser=defectdojo
60+
COPY --from=collectstatic /app/static/ /usr/share/nginx/html/static/
61+
COPY wsgi_params nginx/nginx.conf nginx/nginx_TLS.conf /etc/nginx/
62+
COPY docker/entrypoint-nginx.sh /
63+
RUN \
64+
apk add --no-cache openssl && \
65+
chmod -R g=u /var/cache/nginx && \
66+
mkdir /var/run/defectdojo && \
67+
chmod -R g=u /var/run/defectdojo && \
68+
mkdir -p /etc/nginx/ssl && \
69+
chmod -R g=u /etc/nginx && \
70+
true
71+
ENV \
72+
DD_UWSGI_PASS="uwsgi_server" \
73+
DD_UWSGI_HOST="uwsgi" \
74+
DD_UWSGI_PORT="3031" \
75+
GENERATE_TLS_CERTIFICATE="false" \
76+
USE_TLS="false" \
77+
NGINX_METRICS_ENABLED="false" \
78+
METRICS_HTTP_AUTH_USER="" \
79+
METRICS_HTTP_AUTH_PASSWORD=""
80+
USER ${uid}
81+
EXPOSE 8080
82+
ENTRYPOINT ["/entrypoint-nginx.sh"]

0 commit comments

Comments
 (0)