Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Updated Docker image from Ubuntu to Alpine #278

Merged
merged 3 commits into from
Nov 8, 2021
Merged

feat: Updated Docker image from Ubuntu to Alpine #278

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4eb2c3f
feat: Move Docker image to alpine
MaxymVlasov Nov 6, 2021
0fead90
Apply review suggestions
MaxymVlasov Nov 7, 2021
2c2e9e2
Apply revie suggestions
MaxymVlasov Nov 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 48 additions & 58 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,14 @@
FROM ubuntu:20.04 as builder

# Install general dependencies
RUN apt update && \
DEBIAN_FRONTEND=noninteractive apt install -y \
# Needed for pre-commit in next build stage
git \
libpcre2-8-0 \
# Builder deps
unzip \
software-properties-common \
curl \
python3 \
python3-pip \
# infracost deps
jq && \
ARG TAG=3.9.7-alpine3.14
FROM python:${TAG} as builder

WORKDIR /bin_dir

RUN apk add --no-cache \
# Builder deps
curl \
unzip && \
# Upgrade pip for be able get latest Checkov
python3 -m pip install --upgrade pip && \
# Cleanup
rm -rf /var/lib/apt/lists/*
python3 -m pip install --upgrade pip

ARG PRE_COMMIT_VERSION=${PRE_COMMIT_VERSION:-latest}
ARG TERRAFORM_VERSION=${TERRAFORM_VERSION:-latest}
Expand All @@ -27,21 +18,15 @@ RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-comm
|| pip3 install --no-cache-dir pre-commit==${PRE_COMMIT_VERSION}

# Install terraform because pre-commit needs it
RUN curl -fsSL https://apt.releases.hashicorp.com/gpg | apt-key add - && \
apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" && \
apt update && \
( \
[ "$TERRAFORM_VERSION" = "latest" ] && apt install -y terraform \
|| apt install -y terraform=${TERRAFORM_VERSION} \
) && \
# Cleanup
rm -rf /var/lib/apt/lists/*
RUN if [ "${TERRAFORM_VERSION}" = "latest" ]; then \
TERRAFORM_VERSION="$(curl -s https://api.github.com/repos/hashicorp/terraform/releases/latest | grep tag_name | grep -o -E -m 1 "[0-9.]+")" \
; fi && \
curl -L "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" > terraform.zip && \
unzip terraform.zip terraform && rm terraform.zip

#
# Install tools
#
WORKDIR /bin_dir

ARG CHECKOV_VERSION=${CHECKOV_VERSION:-false}
ARG INFRACOST_VERSION=${INFRACOST_VERSION:-false}
ARG TERRAFORM_DOCS_VERSION=${TERRAFORM_DOCS_VERSION:-false}
Expand Down Expand Up @@ -143,42 +128,47 @@ RUN . /.env && \
RUN . /.env && \
F=tools_versions_info && \
pre-commit --version >> $F && \
terraform --version | head -n 1 >> $F && \
(if [ "$CHECKOV_VERSION" != "false" ]; then echo "checkov $(checkov --version)" >> $F; else echo "checkov SKIPPED" >> $F ; fi) && \
(if [ "$INFRACOST_VERSION" != "false" ]; then echo "$(./infracost --version)" >> $F; else echo "infracost SKIPPED" >> $F ; fi) && \
(if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then ./terraform-docs --version >> $F; else echo "terraform-docs SKIPPED" >> $F; fi) && \
(if [ "$TERRAGRUNT_VERSION" != "false" ]; then ./terragrunt --version >> $F; else echo "terragrunt SKIPPED" >> $F ; fi) && \
(if [ "$TERRASCAN_VERSION" != "false" ]; then echo "terrascan $(./terrascan version)" >> $F; else echo "terrascan SKIPPED" >> $F ; fi) && \
(if [ "$TFLINT_VERSION" != "false" ]; then ./tflint --version >> $F; else echo "tflint SKIPPED" >> $F ; fi) && \
(if [ "$TFSEC_VERSION" != "false" ]; then echo "tfsec $(./tfsec --version)" >> $F; else echo "tfsec SKIPPED" >> $F ; fi) && \
echo "\n\n" && cat $F && echo "\n\n"

# based on debian:buster-slim
# https://github.com/docker-library/python/blob/master/3.9/buster/slim/Dockerfile
FROM python:3.9-slim-buster

# Python 3.8 (ubuntu 20.04) -> Python3.9 hacks
COPY --from=builder /usr/local/lib/python3.8/dist-packages/ /usr/local/lib/python3.9/site-packages/
COPY --from=builder /usr/lib/python3/dist-packages /usr/local/lib/python3.9/site-packages
RUN mkdir /usr/lib/python3 && \
ln -s /usr/local/lib/python3.9/site-packages /usr/lib/python3/site-packages && \
ln -s /usr/local/bin/python3 /usr/bin/python3
# Copy binaries needed for pre-commit
COPY --from=builder /usr/lib/git-core/ /usr/lib/git-core/
COPY --from=builder /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 /usr/lib/x86_64-linux-gnu/
./terraform --version | head -n 1 >> $F && \
(if [ "$CHECKOV_VERSION" != "false" ]; then echo "checkov $(checkov --version)" >> $F; else echo "checkov SKIPPED" >> $F ; fi) && \
(if [ "$INFRACOST_VERSION" != "false" ]; then echo "$(./infracost --version)" >> $F; else echo "infracost SKIPPED" >> $F ; fi) && \
(if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then ./terraform-docs --version >> $F; else echo "terraform-docs SKIPPED" >> $F ; fi) && \
(if [ "$TERRAGRUNT_VERSION" != "false" ]; then ./terragrunt --version >> $F; else echo "terragrunt SKIPPED" >> $F ; fi) && \
(if [ "$TERRASCAN_VERSION" != "false" ]; then echo "terrascan $(./terrascan version)" >> $F; else echo "terrascan SKIPPED" >> $F ; fi) && \
(if [ "$TFLINT_VERSION" != "false" ]; then ./tflint --version >> $F; else echo "tflint SKIPPED" >> $F ; fi) && \
(if [ "$TFSEC_VERSION" != "false" ]; then echo "tfsec $(./tfsec --version)" >> $F; else echo "tfsec SKIPPED" >> $F ; fi) && \
echo -e "\n\n" && cat $F && echo -e "\n\n"



FROM python:${TAG}
MaxymVlasov marked this conversation as resolved.
Show resolved Hide resolved

RUN apk add --no-cache \
# pre-commit deps
git \
# All hooks deps
bash
MaxymVlasov marked this conversation as resolved.
Show resolved Hide resolved

# Copy tools
COPY --from=builder \
# Needed for all hooks
/usr/local/bin/pre-commit \
# Hooks and terraform binaries
/bin_dir/ \
/usr/bin/terraform \
/usr/local/bin/checkov* \
/usr/local/bin/pre-commit \
/usr/bin/git \
/usr/bin/git-shell \
/usr/bin/jq \
/usr/bin/
# Copy pre-commit packages
COPY --from=builder /usr/local/lib/python3.9/site-packages/ /usr/local/lib/python3.9/site-packages/
# Copy terrascan policies
COPY --from=builder /root/ /root/

# Install hooks extra deps
RUN if [ "$(grep -o '^terraform-docs SKIPPED$' /usr/bin/tools_versions_info)" = "" ]; then \
apk add --no-cache perl \
; fi && \
if [ "$(grep -o '^infracost SKIPPED$' /usr/bin/tools_versions_info)" = "" ]; then \
apk add --no-cache jq \
; fi

ENV PRE_COMMIT_COLOR=${PRE_COMMIT_COLOR:-always}

ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-}
Expand Down