CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add official Dockerfile for Boundary (#755)

Browse Source
This commit is contained in:
Jeff Malnick authored and GitHub committed 2020-10-29 08:44:57 -07:00
1 parent 0e61bd202b
commit 038540f9ad
7 files changed
+250 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+5
View File
@@ -4,6 +4,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
## vNext
### New and Improved
* docker: Official Docker image for `hashicorp/boundary`
([PR](https://github.com/hashicorp/boundary/pull/755))
### Bug Fixes
* controller, worker: Fix IPv4-only check so `0.0.0.0` specified without a port
Makefile
+27 -1
View File
@@ -149,7 +149,33 @@ test-ci: install-go
install-go:
./ci/goinstall.sh
.PHONY: api tools gen migrations proto website ci-config ci-verify set-ui-version
# Docker build and publish variables and targets
REGISTRY_NAME?=docker.io/hashicorp
IMAGE_NAME=boundary
VERSION?=0.1.1
IMAGE_TAG=$(REGISTRY_NAME)/$(IMAGE_NAME):$(VERSION)
IMAGE_TAG_DEV=$(REGISTRY_NAME)/$(IMAGE_NAME):latest-$(shell git rev-parse --short HEAD)
DOCKER_DIR=./docker
docker: docker-build docker-publish
# builds from releases.hashicorp.com official binary
docker-build:
docker build -t $(IMAGE_TAG) \
--build-arg VERSION=$(VERSION) \
-f $(DOCKER_DIR)/Release.dockerfile docker/
# builds from locally generated binary in bin/
docker-build-dev: export XC_OSARCH=linux/amd64
docker-build-dev: dev
docker build -t $(IMAGE_TAG_DEV) \
-f $(DOCKER_DIR)/Dev.dockerfile .
# requires appropriate permissions in dockerhub
docker-publish:
docker push $(IMAGE_TAG)
.PHONY: api tools gen migrations proto website ci-config ci-verify set-ui-version docker docker-build docker-build-dev docker-publish
.NOTPARALLEL:
docker/Dev.dockerfile
+17
View File
@@ -0,0 +1,17 @@
FROM docker.mirror.hashicorp.services/alpine:3.10
RUN addgroup boundary && \
adduser -S -G boundary boundary
ADD bin/boundary /bin/boundary
RUN mkdir /boundary/
ADD docker/config.hcl /boundary/config.hcl
RUN chown -R boundary:boundary /boundary/
EXPOSE 9200 9201 9202
VOLUME /boundary/
USER boundary
ENTRYPOINT ["/bin/boundary"]
CMD ["server", "-config", "/boundary/config.hcl"]
docker/README.md
+88
View File
@@ -0,0 +1,88 @@
# Boundary Docker Image
This directory contains the officially supported HashiCorp Dockerfile to build the hashicorp/boundary docker image.
## Build
See the Makefile targets in the root of this repository for building and publishing this image in either
development or release modes:
- `make docker-build-dev`
- `make docker-build`
- `make docker`
## Usage
### Dev Mode
Due to the limitations of `boundary dev` running and maintaining a postgres docker container, it's not recommended
to run `dev` mode inside docker. To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker), and the caveats
associated with it.
### Default Configuration
The default behavior of the Boundary docker image is to run `boundary server -config /boundary/config.hcl`. The default
configuration can be found in this directory and it's highly recommended that end users replace this configuration
with one that suites their environment.
### Postgres
The usage instructions in this README assume you have an external postgres database (version 11 or greater) to run
boundary server with. If you want to get started quickly, you can start a local postgres in docker:
```bash
docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
```
The postgres URL setting is defined with `env://BOUNDARY_POSTGRES_URL` so it can be easily overidden with `-e`
during docker run:
```bash
docker run <truncated> -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' <truncated>
```
### Database Init
If you're starting with a new, unused postgres instance, initialize the database using the default config.hcl:
```bash
docker run \
--network host \
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
boundary database init -config /boundary/config.hcl
```
If you want to run this with your own config.hcl (assuming config.hcl is located at `$(pwd)/config.hcl`):
```bash
docker run \
--network host \
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-v "$(pwd)":/boundary/ \
boundary database init -config /boundary/config.hcl
```
### Server
Start a Boundary server using the default `config.hcl`:
```bash
docker run \
--network host \
-p 9200:9200 \
-p 9201:9201 \
-p 9202:9202 \
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
boundary
```
Start a Boundary server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
```bash
docker run \
--network host \
-p 9200:9200 \
-p 9201:9201 \
-p 9202:9202 \
-v "$(pwd)":/boundary/ \
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
boundary
```
docker/Release.dockerfile
+46
View File
@@ -0,0 +1,46 @@
FROM docker.mirror.hashicorp.services/alpine:3.10
ARG VERSION=0.1.1
LABEL name="Boundary" \
maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
vendor="HashiCorp" \
version=$VERSION \
release=$VERSION \
summary="Boundary provides simple and secure access to hosts and services" \
description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler"
RUN addgroup boundary && \
adduser -s /bin/sh -S -G boundary boundary
ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_linux_amd64.zip /tmp/
ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_SHA256SUMS /tmp/
ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_SHA256SUMS.sig /tmp/
RUN apk add --no-cache ca-certificates gnupg openssl libcap su-exec dumb-init tzdata
RUN cd /tmp/ && \
BUILD_GPGKEY=91A6E7F85D05C65630BEF18951852D87348FFC4C; \
found=''; \
for server in \
hkp://p80.pool.sks-keyservers.net:80 \
hkp://keyserver.ubuntu.com:80 \
hkp://pgp.mit.edu:80 \
; do \
echo "Fetching GPG key $BUILD_GPGKEY from $server"; \
gpg --keyserver "$server" --recv-keys "$BUILD_GPGKEY" && found=yes && break; \
done; \
test -z "$found" && echo >&2 "error: failed to fetch GPG key $BUILD_GPGKEY" && exit 1; \
gpg --batch --verify boundary_${VERSION}_SHA256SUMS.sig boundary_${VERSION}_SHA256SUMS && \
grep boundary_${VERSION}_linux_amd64.zip boundary_${VERSION}_SHA256SUMS | sha256sum -c && \
unzip -d /bin boundary_${VERSION}_linux_amd64.zip
RUN mkdir /boundary/
ADD config.hcl /boundary/config.hcl
RUN chown -R boundary:boundary /boundary/
EXPOSE 9200 9201 9202
VOLUME /boundary/
USER boundary
ENTRYPOINT ["/bin/boundary"]
CMD ["server", "-config", "/boundary/config.hcl"]
docker/config.hcl
+66
View File
@@ -0,0 +1,66 @@
disable_mlock = true
controller {
name = "demo-controller-1"
description = "A controller for a demo!"
database {
url = "env://BOUNDARY_POSTGRES_URL"
#url = "postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable"
}
}
worker {
name = "demo-worker-1"
description = "A default worker created demonstration"
controllers = [
"0.0.0.0",
]
address = "0.0.0.0"
}
listener "tcp" {
address = "0.0.0.0"
purpose = "api"
tls_disable = true
}
listener "tcp" {
address = "0.0.0.0"
purpose = "cluster"
tls_disable = true
}
listener "tcp" {
address = "0.0.0.0"
purpose = "proxy"
tls_disable = true
}
# Root KMS configuration block: this is the root key for Boundary
# Use a production KMS such as AWS KMS in production installs
kms "aead" {
purpose = "root"
aead_type = "aes-gcm"
key = "uC8zAQ3sLJ9o0ZlH5lWIgxNZrNn0FiFqYj4802VKLKQ="
key_id = "global_root"
}
# Worker authorization KMS
# Use a production KMS such as AWS KMS for production installs
# This key is the same key used in the worker configuration
kms "aead" {
purpose = "worker-auth"
aead_type = "aes-gcm"
key = "cOQ9fiszFoxu/c20HbxRQ5E9dyDM6PqMY1GwqVLihsI="
key_id = "global_worker-auth"
}
# Recovery KMS block: configures the recovery key for Boundary
# Use a production KMS such as AWS KMS for production installs
kms "aead" {
purpose = "recovery"
aead_type = "aes-gcm"
key = "nIRSASgoP91KmaEcg/EAaM4iAkksyB+Lkes0gzrLIRM="
key_id = "global_recovery"
}
scripts/uigen.sh
+1 -2
View File
@@ -13,8 +13,7 @@ fi
(
cd "$UI_CLONE_DIR"
if ! docker-compose -f docker-compose-embedding.yml run build; then
echo "==> UI build failed."
exit 1
yarn install && yarn build
fi
)