forked from NetApp/trident
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Alpine provides relatively little value, but carries with it a large amount of security risks. Despite the team's belief that most of the security risks don't put users in any actual danger, it is a burden to evalualte them all. Switching to a base image with a smaller attack surfaces greatly reduces this burden and gives users more assurance of security. As part of this change, CGO is disabled. We didn't need it, and it was adding needless dependencies. Also, because this change removes the shell from the container, it replaces the chroot-wrapper script with a binary that does the same thing. Co-authored-by: Andrew Kerr <[email protected]>
- Loading branch information
Showing
16 changed files
with
160 additions
and
126 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,25 +1,9 @@ | ||
| FROM alpine:3.12 | ||
| FROM gcr.io/distroless/static:eddfb5cd7a24d656f77afae595ffe6c232eab847 | ||
|
|
||
| LABEL maintainer="[email protected]" \ | ||
| LABEL maintainers="The NetApp Trident Team" \ | ||
| app="trident.netapp.io" \ | ||
| description="Trident Storage Orchestrator" | ||
|
|
||
| # Use APK mirrors for fault tolerance | ||
| RUN printf "http://dl-2.alpinelinux.org/alpine/v3.12/main\nhttp://dl-3.alpinelinux.org/alpine/v3.12/main\nhttp://dl-4.alpinelinux.org/alpine/v3.12/main\nhttp://dl-5.alpinelinux.org/alpine/v3.12/main\n\nhttp://dl-1.alpinelinux.org/alpine/v3.12/community\nhttp://dl-2.alpinelinux.org/alpine/v3.12/community\nhttp://dl-3.alpinelinux.org/alpine/v3.12/community\nhttp://dl-4.alpinelinux.org/alpine/v3.12/community\nhttp://dl-5.alpinelinux.org/alpine/v3.12/community" > /etc/apk/repositories | ||
|
|
||
| RUN apk update || true && \ | ||
| apk add coreutils util-linux blkid \ | ||
| lsscsi \ | ||
| e2fsprogs \ | ||
| bash \ | ||
| kmod \ | ||
| curl \ | ||
| jq \ | ||
| ca-certificates | ||
|
|
||
| # for go binaries to work inside an alpine container | ||
| RUN mkdir /lib64 && ln -s /lib/libc.musl-x86_64.so.1 /lib64/ld-linux-x86-64.so.2 | ||
|
|
||
| ARG PORT=8000 | ||
| ENV PORT $PORT | ||
| EXPOSE $PORT | ||
|
|
@@ -32,33 +16,9 @@ ENV K8S $K8S | |
| ENV TRIDENT_IP localhost | ||
| ENV TRIDENT_SERVER 127.0.0.1:$PORT | ||
|
|
||
| COPY ./scripts/* $BIN $CLI_BIN /usr/local/bin/ | ||
|
|
||
| RUN mkdir /netapp | ||
| ADD chroot-host-wrapper.sh /netapp | ||
| RUN ln -s /netapp/chroot-host-wrapper.sh /netapp/blkid \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/blockdev \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/cat \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/dd \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/df \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/free \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/iscsiadm \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/ls \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/lsblk \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/lsscsi \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/mkdir \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/mkfs.ext3 \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/mkfs.ext4 \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/mkfs.xfs \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/mount \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/multipath \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/multipathd \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/pgrep \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/resize2fs \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/rmdir \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/stat \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/umount \ | ||
| && ln -s /netapp/chroot-host-wrapper.sh /netapp/xfs_growfs | ||
|
|
||
| COPY $BIN / | ||
| COPY $CLI_BIN /bin/ | ||
| ADD chwrap.tar / | ||
|
|
||
| CMD ["/usr/bin/env -i PATH='/netapp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' /usr/local/bin/$BIN -port $PORT -crd_persistence -k8s_api_server $K8S"] | ||
| ENTRYPOINT ["/bin/$CLI_BIN"] | ||
| CMD ["version"] | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| /* | ||
| * Copyright (c) 2020 NetApp | ||
| * All rights reserved | ||
| */ | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "os" | ||
| "strings" | ||
|
|
||
| "golang.org/x/sys/unix" | ||
| ) | ||
|
|
||
| func validBinary(path string) bool { | ||
| var stat unix.Stat_t | ||
| if err := unix.Stat(path, &stat); nil != err { | ||
| // Can't stat file | ||
| return false | ||
| } | ||
| if (stat.Mode&unix.S_IFMT) != unix.S_IFREG && (stat.Mode&unix.S_IFMT) != unix.S_IFLNK { | ||
| // Not a regular file or symlink | ||
| return false | ||
| } | ||
| if 0 == stat.Mode&unix.S_IRUSR || 0 == stat.Mode&unix.S_IXUSR { | ||
| // Not readable or not executable | ||
| return false | ||
| } | ||
| return true | ||
| } | ||
|
|
||
| func findBinary(prefix, binary string) string { | ||
| for _, part1 := range []string{"usr/local/", "usr/", ""} { | ||
| for _, part2 := range []string{"sbin", "bin"} { | ||
| path := "/" + part1 + part2 + "/" + binary | ||
| if validBinary(prefix + path) { | ||
| return path | ||
| } | ||
| } | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| func modifyEnv(oldEnv []string) []string { | ||
| var newEnv []string | ||
| for _, e := range oldEnv { | ||
| if !strings.HasPrefix(e, "PATH=") { | ||
| newEnv = append(newEnv, e) | ||
| } | ||
| } | ||
| newEnv = append(newEnv, "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin") | ||
| return newEnv | ||
| } | ||
|
|
||
| func main() { | ||
| // First modify argv0 to strip off any absolute or relative paths | ||
| argv := os.Args | ||
| binary := argv[0] | ||
| idx := strings.LastIndexByte(binary, '/') | ||
| if 0 <= idx { | ||
| binary = binary[idx+1:] | ||
| } | ||
| // Now implement the path search logic, but in the host's filesystem | ||
| argv0 := findBinary("/host", binary) | ||
| if "" == argv0 { | ||
| panic(binary + " not found") | ||
| } | ||
| // Chroot in the the host's FS | ||
| if err := unix.Chroot("/host"); nil != err { | ||
| panic(err) | ||
| } | ||
| // Change cwd to the root | ||
| if err := unix.Chdir("/"); nil != err { | ||
| panic(err) | ||
| } | ||
| // Exec the intended binary | ||
| if err := unix.Exec(argv0, argv, modifyEnv(os.Environ())); nil != err { | ||
| panic(err) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| #!/bin/sh -e | ||
|
|
||
| [ -n "$1" ] && [ -n "$2" ] || exit 1 | ||
|
|
||
| PREFIX=/tmp/$(uuidgen) | ||
| mkdir -p $PREFIX/netapp | ||
| cp "$1" $PREFIX/netapp/chwrap | ||
| for BIN in blkid blockdev cat dd df free iscsiadm ls lsblk lsscsi mkdir mkfs.ext3 mkfs.ext4 mkfs.xfs mount multipath multipathd pgrep resize2fs rmdir stat umount xfs_growfs ; do | ||
| ln -s chwrap $PREFIX/netapp/$BIN | ||
| done | ||
| tar --owner=0 --group=0 -C $PREFIX -cf "$2" netapp | ||
| rm -rf $PREFIX |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| /* | ||
| * Copyright (c) 2020 NetApp | ||
| * All rights reserved | ||
| */ | ||
|
|
||
| package cmd | ||
|
|
||
| import ( | ||
| "time" | ||
|
|
||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func init() { | ||
| RootCmd.AddCommand(pauseCmd) | ||
| } | ||
|
|
||
| var pauseCmd = &cobra.Command{ | ||
| Use: "pause", | ||
| Short: "Sleep forever", | ||
| Hidden: true, | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| for { | ||
| time.Sleep(time.Second) | ||
| } | ||
| }, | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.