tianon commented on a change in pull request #28: Update with feedback from
@yosifkit
URL: https://github.com/apache/couchdb-docker/pull/28#discussion_r141112407
##########
File path: 1.6.1/Dockerfile
##########
@@ -28,19 +28,27 @@ RUN apt-get update -y && apt-get install -y
--no-install-recommends \
libnspr4-0d \
&& rm -rf /var/lib/apt/lists/*
-# grab gosu for easy step-down from root and tini for signal handling
-RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
B42F6819007F00F88E364FD4036A9C25BF357DD4 \
- && curl -o /usr/local/bin/gosu -fSL
"https://github.com/tianon/gosu/releases/download/1.7/gosu-$(dpkg
--print-architecture)" \
- && curl -o /usr/local/bin/gosu.asc -fSL
"https://github.com/tianon/gosu/releases/download/1.7/gosu-$(dpkg
--print-architecture).asc" \
- && gpg --verify /usr/local/bin/gosu.asc \
- && rm /usr/local/bin/gosu.asc \
- && chmod +x /usr/local/bin/gosu \
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
6380DC428747F6C393FEACA59A84159D7001A4E5 \
- && curl -o /usr/local/bin/tini -fSL
"https://github.com/krallin/tini/releases/download/v0.14.0/tini"; \
- && curl -o /usr/local/bin/tini.asc -fSL
"https://github.com/krallin/tini/releases/download/v0.14.0/tini.asc"; \
- && gpg --verify /usr/local/bin/tini.asc \
- && rm /usr/local/bin/tini.asc \
- && chmod +x /usr/local/bin/tini
+# grab gosu for easy step-down from root
+ENV GOSU_VERSION 1.10
+RUN set -x \
+ && apt-get update && apt-get install -y --no-install-recommends
ca-certificates wget && rm -rf /var/lib/apt/lists/* \
+ && wget -O /usr/local/bin/gosu
"https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg
--print-architecture)" \
+ && wget -O /usr/local/bin/gosu.asc
"https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg
--print-architecture).asc" \
+ && export GNUPGHOME="$(mktemp -d)" \
+ && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
B42F6819007F00F88E364FD4036A9C25BF357DD4 \
+ && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
+ && rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
+ && chmod +x /usr/local/bin/gosu \
+ && gosu nobody true \
+&& apt-get purge -y --auto-remove wget
+
+# grab tini for signal handling
+ENV TINI_VERSION v0.16.1
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini
/usr/local/bin/tini
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini.asc
/usr/local/bin/tini.asc
Review comment:
Sure, I can do that -- so, it's technically part of 1.13+ (via `docker run
--init`), but cannot be enabled by default at the image level, and also cannot
be enabled for swarm-mode services via CLI (yet).
I'd recommend something similar to
https://github.com/tianon/gosu/blob/e87cf95808a7b16208515c49012aa3410bc5bba8/INSTALL.md#from-debian:
(which can be shorter if the two are combined, which is why I recommend
combining them -- this could also be made shorter by using the `curl` which is
already installed, but I'd really recommend instead removing `curl` from the
image unless CouchDB itself requires it to be installed)
```dockerfile
ENV TINI_VERSION 0.16.1
RUN set -ex; \
\
apt-get update; \
apt-get install -y --no-install-recommends wget; \
rm -rf /var/lib/apt/lists/*; \
\
dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
wget -O /usr/local/bin/tini
"https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-$dpkgArch";;
\
wget -O /usr/local/bin/tini.asc
"https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-$dpkgArch.asc";;
\
\
# verify the signature
export GNUPGHOME="$(mktemp -d)"; \
gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
595E85A6B1B4779EA4DAAEC70B588DFF0527A9B7; \
gpg --batch --verify /usr/local/bin/tini.asc /usr/local/bin/tini; \
rm -r "$GNUPGHOME" /usr/local/bin/tini.asc; \
\
chmod +x /usr/local/bin/tini; \
# verify that the binary works
tini --version; \
\
apt-get purge -y --auto-remove wget
```
For comparison, here's a simplified version of something similar that keeps
the `gosu` and `tini` parts separate:
```dockerfile
RUN set -ex; \
\
apt-get update; \
apt-get install -y --no-install-recommends wget; \
rm -rf /var/lib/apt/lists/*; \
\
dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
\
# install gosu
GOSU_VERSION='1.10'; \
wget -O /usr/local/bin/gosu
"https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch";;
\
wget -O /usr/local/bin/gosu.asc
"https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc";;
\
export GNUPGHOME="$(mktemp -d)"; \
gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
B42F6819007F00F88E364FD4036A9C25BF357DD4; \
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc; \
chmod +x /usr/local/bin/gosu; \
gosu nobody true; \
\
# install tini
TINI_VERSION='0.16.1'; \
wget -O /usr/local/bin/tini
"https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-$dpkgArch";;
\
wget -O /usr/local/bin/tini.asc
"https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-$dpkgArch.asc";;
\
export GNUPGHOME="$(mktemp -d)"; \
gpg --keyserver ha.pool.sks-keyservers.net --recv-keys
595E85A6B1B4779EA4DAAEC70B588DFF0527A9B7; \
gpg --batch --verify /usr/local/bin/tini.asc /usr/local/bin/tini; \
rm -r "$GNUPGHOME" /usr/local/bin/tini.asc; \
chmod +x /usr/local/bin/tini; \
tini --version; \
\
apt-get purge -y --auto-remove wget
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
