Rename binary to threshold and update build/release packaging
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
shadowdaoandClaude Sonnet 5.5 committed
1 parent
306960d24b
commit
5f5d35b9ff
23 files changed
+189
-258
No files matched your search
+1
-1
@@ -7,7 +7,7 @@ if [[ $remote_url == *"boundary-enterprise"* ]]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f cmd/boundary/package_registration_ent.go ]; then
|
||||
if [ -f cmd/threshold/package_registration_ent.go ]; then
|
||||
echo "Found enterprise file while pushing to oss remote"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
# Copyright IBM Corp. 2020, 2026
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
schema = 1
|
||||
artifacts {
|
||||
zip = [
|
||||
"boundary_${version}_darwin_amd64.zip",
|
||||
"boundary_${version}_darwin_arm64.zip",
|
||||
"boundary_${version}_freebsd_386.zip",
|
||||
"boundary_${version}_freebsd_amd64.zip",
|
||||
"boundary_${version}_freebsd_arm.zip",
|
||||
"boundary_${version}_linux_386.zip",
|
||||
"boundary_${version}_linux_amd64.zip",
|
||||
"boundary_${version}_linux_arm.zip",
|
||||
"boundary_${version}_linux_arm64.zip",
|
||||
"boundary_${version}_netbsd_386.zip",
|
||||
"boundary_${version}_netbsd_amd64.zip",
|
||||
"boundary_${version}_netbsd_arm.zip",
|
||||
"boundary_${version}_openbsd_386.zip",
|
||||
"boundary_${version}_openbsd_amd64.zip",
|
||||
"boundary_${version}_openbsd_arm.zip",
|
||||
"boundary_${version}_solaris_amd64.zip",
|
||||
"boundary_${version}_windows_386.zip",
|
||||
"boundary_${version}_windows_amd64.zip",
|
||||
]
|
||||
rpm = [
|
||||
"boundary-${version_linux}-1.aarch64.rpm",
|
||||
"boundary-${version_linux}-1.armv7hl.rpm",
|
||||
"boundary-${version_linux}-1.i386.rpm",
|
||||
"boundary-${version_linux}-1.x86_64.rpm",
|
||||
]
|
||||
deb = [
|
||||
"boundary_${version_linux}-1_amd64.deb",
|
||||
"boundary_${version_linux}-1_arm64.deb",
|
||||
"boundary_${version_linux}-1_armhf.deb",
|
||||
"boundary_${version_linux}-1_i386.deb",
|
||||
]
|
||||
container = [
|
||||
"boundary_default_linux_386_${version}_${commit_sha}.docker.tar",
|
||||
"boundary_default_linux_amd64_${version}_${commit_sha}.docker.tar",
|
||||
"boundary_default_linux_arm64_${version}_${commit_sha}.docker.tar",
|
||||
"boundary_default_linux_arm_${version}_${commit_sha}.docker.tar",
|
||||
]
|
||||
}
|
||||
@@ -1,16 +1,15 @@
|
||||
# Boundary Docker Image
|
||||
# Threshold Docker Image
|
||||
|
||||
The root of this repository contains the officially supported HashiCorp Dockerfile to build the hashicorp/boundary docker image.
|
||||
The dev docker image should be built for local dev and testing,
|
||||
while the production docker image is built in CI and makes use of CI-built binaries.
|
||||
The official docker image is built using the official binaries from releases.hashicorp.com.
|
||||
The root of this repository contains the Dockerfile used to build the Threshold
|
||||
docker image. Threshold is a community fork of HashiCorp Boundary Community
|
||||
Edition and is not affiliated with or endorsed by HashiCorp or IBM.
|
||||
|
||||
The dev docker image is built from a locally built binary (`./bin/threshold`),
|
||||
while the production docker image makes use of CI-built binaries.
|
||||
|
||||
## Build
|
||||
|
||||
See the Makefile targets in the root of this repository
|
||||
for building Boundary images in either development or release modes:
|
||||
See the Makefile targets in the root of this repository for building images:
|
||||
|
||||
- `make docker-build-dev`
|
||||
- `make docker-multiarch-build`
|
||||
- `make docker-build`
|
||||
- `make docker`
|
||||
@@ -1,46 +1,46 @@
|
||||
<!---
|
||||
This is used for the Overview tab for the boundary docker image on hub.docker.com
|
||||
https://hub.docker.com/r/hashicorp/boundary
|
||||
This is used for the Overview tab for the threshold docker image on hub.docker.com
|
||||
https://repo.anhonesthost.net/CyberCoveLLC/threshold
|
||||
--->
|
||||
|
||||
# Boundary
|
||||
# Threshold
|
||||
|
||||
## Usage
|
||||
|
||||
See the latest updates to the Dockerfile for this image in our
|
||||
[GitHub repository](https://github.com/hashicorp/boundary).
|
||||
[repository](https://repo.anhonesthost.net/CyberCoveLLC/threshold).
|
||||
|
||||
### Dev Mode
|
||||
|
||||
Due to the limitations of `boundary dev` running and maintaining a postgres docker container,
|
||||
Due to the limitations of `threshold dev` running and maintaining a postgres docker container,
|
||||
it's not recommended to run `dev` mode inside docker.
|
||||
To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker),
|
||||
and the caveats associated with it.
|
||||
|
||||
### Default Configuration
|
||||
|
||||
The default behavior of the Boundary docker image is to run `boundary server -config /boundary/config.hcl`.
|
||||
The default behavior of the Threshold docker image is to run `threshold server -config /threshold/config.hcl`.
|
||||
The included `config.hcl` file is meant to serve as an example,
|
||||
and is not suitable for actual deployment.
|
||||
Please see the comments within the file for more information;
|
||||
full configuration details can be found on Boundary's documentation site.
|
||||
full configuration details can be found on Threshold's documentation site.
|
||||
|
||||
### Postgres
|
||||
|
||||
The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run boundary server with.
|
||||
The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.
|
||||
If you want to get started quickly, you can start a local postgres in docker:
|
||||
|
||||
```bash
|
||||
docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
|
||||
```
|
||||
|
||||
The postgres URL setting is defined with `env://BOUNDARY_POSTGRES_URL` so it can be easily set with `-e` during docker run:
|
||||
The postgres URL setting is defined with `env://THRESHOLD_POSTGRES_URL` so it can be easily set with `-e` during docker run:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
--network host \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
hashicorp/boundary
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
repo.anhonesthost.net/cybercovellc/threshold
|
||||
```
|
||||
|
||||
### Database Init
|
||||
@@ -52,8 +52,8 @@ initialize the database using the default `config.hcl`:
|
||||
```bash
|
||||
docker run \
|
||||
--network host \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
hashicorp/boundary database init -config /boundary/config.hcl
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
|
||||
```
|
||||
|
||||
If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
|
||||
@@ -61,22 +61,22 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
|
||||
```bash
|
||||
docker run \
|
||||
--network host \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
-v "$(pwd)":/boundary/ \
|
||||
hashicorp/boundary database init -config /boundary/config.hcl
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
-v "$(pwd)":/threshold/ \
|
||||
repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
|
||||
```
|
||||
|
||||
### Database Migration
|
||||
|
||||
If you are updating to a newer version of boundary with a database instance
|
||||
If you are updating to a newer version of threshold with a database instance
|
||||
that was initialized with an older version,
|
||||
you will need to apply the database migrations:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
--network host \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
hashicorp/boundary database migrate -config /boundary/config.hcl
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
|
||||
```
|
||||
|
||||
If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
|
||||
@@ -84,14 +84,14 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
|
||||
```bash
|
||||
docker run \
|
||||
--network host \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
-v "$(pwd)":/boundary/ \
|
||||
hashicorp/boundary database migrate -config /boundary/config.hcl
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
-v "$(pwd)":/threshold/ \
|
||||
repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
|
||||
```
|
||||
|
||||
### Server
|
||||
|
||||
Start a Boundary server using the default `config.hcl`:
|
||||
Start a Threshold server using the default `config.hcl`:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
@@ -99,11 +99,11 @@ docker run \
|
||||
-p 9200:9200 \
|
||||
-p 9201:9201 \
|
||||
-p 9202:9202 \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
hashicorp/boundary
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
repo.anhonesthost.net/cybercovellc/threshold
|
||||
```
|
||||
|
||||
Start a Boundary server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
|
||||
Start a Threshold server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
@@ -111,7 +111,7 @@ docker run \
|
||||
-p 9200:9200 \
|
||||
-p 9201:9201 \
|
||||
-p 9202:9202 \
|
||||
-v "$(pwd)":/boundary/ \
|
||||
-e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
hashicorp/boundary
|
||||
-v "$(pwd)":/threshold/ \
|
||||
-e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
|
||||
repo.anhonesthost.net/cybercovellc/threshold
|
||||
```
|
||||
@@ -14,12 +14,12 @@ controller {
|
||||
|
||||
database {
|
||||
# This configuration setting requires the user to execute the container with the URL as an env var
|
||||
# to connect to the Boundary postgres DB. An example of how this can be done assuming the postgres
|
||||
# to connect to the Threshold postgres DB. An example of how this can be done assuming the postgres
|
||||
# database is running as a container and you're using Docker for Mac (replace host.docker.internal with
|
||||
# localhost if you're on Linux):
|
||||
#
|
||||
# $ docker run -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] boundary:[version]
|
||||
url = "env://BOUNDARY_POSTGRES_URL"
|
||||
# $ docker run -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] threshold:[version]
|
||||
url = "env://THRESHOLD_POSTGRES_URL"
|
||||
}
|
||||
|
||||
public_cluster_addr = "env://HOSTNAME"
|
||||
@@ -48,7 +48,7 @@ listener "tcp" {
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
# Root KMS configuration block: this is the root key for Boundary
|
||||
# Root KMS configuration block: this is the root key for Threshold
|
||||
# Use a production KMS such as AWS KMS in production installs
|
||||
kms "aead" {
|
||||
purpose = "root"
|
||||
@@ -67,7 +67,7 @@ kms "aead" {
|
||||
key_id = "global_worker-auth"
|
||||
}
|
||||
|
||||
# Recovery KMS block: configures the recovery key for Boundary
|
||||
# Recovery KMS block: configures the recovery key for Threshold
|
||||
# Use a production KMS such as AWS KMS for production installs
|
||||
kms "aead" {
|
||||
purpose = "recovery"
|
||||
|
||||
@@ -12,24 +12,34 @@ set -e
|
||||
# Prevent core dumps
|
||||
ulimit -c 0
|
||||
|
||||
# If the user is trying to run Boundary directly with some arguments, then
|
||||
# pass them to Boundary.
|
||||
# Backwards compatibility: honor legacy BOUNDARY_* environment variables by
|
||||
# mirroring them to their THRESHOLD_* equivalents when the latter are unset.
|
||||
# (The Threshold CLI itself also falls back to BOUNDARY_* for CLI variables.)
|
||||
for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
|
||||
new_name="THRESHOLD_${legacy_name#BOUNDARY_}"
|
||||
if [ -z "$(printenv "$new_name")" ]; then
|
||||
export "$new_name=$(printenv "$legacy_name")"
|
||||
fi
|
||||
done
|
||||
|
||||
# If the user is trying to run Threshold directly with some arguments, then
|
||||
# pass them to Threshold.
|
||||
if [ "${1:0:1}" = '-' ]; then
|
||||
set -- boundary "$@"
|
||||
set -- threshold "$@"
|
||||
fi
|
||||
|
||||
if [ "$1" = 'server' ]; then
|
||||
shift
|
||||
set -- boundary server \
|
||||
set -- threshold server \
|
||||
"$@"
|
||||
elif boundary --help "$1" 2>&1 | grep -q "boundary $1"; then
|
||||
elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
|
||||
# We can't use the return code to check for the existence of a subcommand, so
|
||||
# we have to use grep to look for a pattern in the help output.
|
||||
set -- boundary "$@"
|
||||
set -- threshold "$@"
|
||||
fi
|
||||
|
||||
# If we are running Boundary, make sure it executes as the proper user.
|
||||
if [ "$1" = 'boundary' ]; then
|
||||
# If we are running Threshold, make sure it executes as the proper user.
|
||||
if [ "$1" = 'threshold' ]; then
|
||||
is_root=0
|
||||
if [ "$(id -u)" = '0' ]; then
|
||||
is_root=1
|
||||
@@ -38,23 +48,23 @@ if [ "$1" = 'boundary' ]; then
|
||||
if [ -z "$SKIP_CHOWN" ]; then
|
||||
if [ "$is_root" = '1' ]; then
|
||||
# If the config dir is bind mounted then chown it
|
||||
if [ "$(stat -c %u /boundary)" != "$(id -u boundary)" ]; then
|
||||
chown -R boundary:boundary /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
|
||||
if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
|
||||
chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
|
||||
fi
|
||||
else
|
||||
>&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /boundary"
|
||||
>&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$SKIP_SETCAP" ]; then
|
||||
if [ "$is_root" = '1' ]; then
|
||||
# Allow mlock to avoid swapping Boundary memory to disk
|
||||
setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))
|
||||
# Allow mlock to avoid swapping Threshold memory to disk
|
||||
setcap cap_ipc_lock=+ep $(readlink -f $(which threshold))
|
||||
|
||||
# In the case Boundary has been started in a container without IPC_LOCK privileges
|
||||
if ! boundary -version 1>/dev/null 2>/dev/null; then
|
||||
>&2 echo "Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
|
||||
setcap cap_ipc_lock=-ep $(readlink -f $(which boundary))
|
||||
# In the case Threshold has been started in a container without IPC_LOCK privileges
|
||||
if ! threshold -version 1>/dev/null 2>/dev/null; then
|
||||
>&2 echo "Couldn't start Threshold with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
|
||||
setcap cap_ipc_lock=-ep $(readlink -f $(which threshold))
|
||||
fi
|
||||
else
|
||||
>&2 echo "SKIP_SETCAP not set but running non-root; skipping setcap"
|
||||
@@ -62,7 +72,7 @@ if [ "$1" = 'boundary' ]; then
|
||||
fi
|
||||
|
||||
if [ "$is_root" = '1' ]; then
|
||||
set -- su-exec boundary "$@"
|
||||
set -- su-exec threshold "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
File renamed without changes.
+3
-3
@@ -15,7 +15,7 @@
|
||||
# # supply the url, or "env://" to name an environment variable
|
||||
# # that contains the URL.
|
||||
# database {
|
||||
# url = "postgresql://boundary:boundarydemo@postgres.yourdomain.com:5432/boundary"
|
||||
# url = "postgresql://threshold:thresholddemo@postgres.yourdomain.com:5432/threshold"
|
||||
# }
|
||||
# }
|
||||
|
||||
@@ -42,7 +42,7 @@
|
||||
# purpose = "cluster"
|
||||
# }
|
||||
|
||||
# # Root KMS configuration block: this is the root key for Boundary
|
||||
# # Root KMS configuration block: this is the root key for Threshold
|
||||
# # Use a production KMS such as AWS KMS in production installs
|
||||
# kms "aead" {
|
||||
# purpose = "root"
|
||||
@@ -61,7 +61,7 @@
|
||||
# key_id = "global_worker-auth"
|
||||
# }
|
||||
|
||||
# # Recovery KMS block: configures the recovery key for Boundary
|
||||
# # Recovery KMS block: configures the recovery key for Threshold
|
||||
# # Use a production KMS such as AWS KMS for production installs
|
||||
# kms "aead" {
|
||||
# purpose = "recovery"
|
||||
File renamed without changes.
@@ -1,23 +0,0 @@
|
||||
[Unit]
|
||||
Description="HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
|
||||
Documentation=https://www.boundaryproject.io/docs
|
||||
StartLimitIntervalSec=60
|
||||
StartLimitBurst=3
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-/etc/boundary.d/boundary.env
|
||||
User=boundary
|
||||
Group=boundary
|
||||
ProtectSystem=full
|
||||
ProtectHome=read-only
|
||||
ExecStart=/usr/bin/boundary server -config=/etc/boundary.d/boundary.hcl
|
||||
ExecReload=/bin/kill --signal HUP $MAINPID
|
||||
KillMode=process
|
||||
KillSignal=SIGINT
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
TimeoutStopSec=30
|
||||
LimitMEMLOCK=infinity
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,23 @@
|
||||
[Unit]
|
||||
Description="Threshold (fork of HashiCorp Boundary CE) - Identity-based access management for dynamic infrastructure"
|
||||
Documentation=https://repo.anhonesthost.net/CyberCoveLLC/threshold
|
||||
StartLimitIntervalSec=60
|
||||
StartLimitBurst=3
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=-/etc/threshold.d/threshold.env
|
||||
User=threshold
|
||||
Group=threshold
|
||||
ProtectSystem=full
|
||||
ProtectHome=read-only
|
||||
ExecStart=/usr/bin/threshold server -config=/etc/threshold.d/threshold.hcl
|
||||
ExecReload=/bin/kill --signal HUP $MAINPID
|
||||
KillMode=process
|
||||
KillSignal=SIGINT
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
TimeoutStopSec=30
|
||||
LimitMEMLOCK=infinity
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
if [ "$1" = "purge" ]
|
||||
then
|
||||
userdel boundary
|
||||
userdel threshold
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -eu
|
||||
|
||||
USER="boundary"
|
||||
USER="threshold"
|
||||
|
||||
if ! id -u $USER > /dev/null 2>&1; then
|
||||
useradd \
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
# Copyright IBM Corp. 2020, 2026
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/boundary"
|
||||
url_docker_registry_ecr = "https://gallery.ecr.aws/hashicorp/boundary"
|
||||
url_license = "https://github.com/hashicorp/boundary/blob/main/LICENSE"
|
||||
url_project_website = "https://www.boundaryproject.io"
|
||||
url_release_notes = "https://www.boundaryproject.io/docs/releases/release-notes"
|
||||
url_source_repository = "https://github.com/hashicorp/boundary"
|
||||
url_license = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/LICENSE"
|
||||
url_project_website = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
|
||||
url_release_notes = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/CHANGELOG.md"
|
||||
url_source_repository = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
|
||||
@@ -0,0 +1,44 @@
|
||||
# Copyright IBM Corp. 2020, 2026
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
schema = 1
|
||||
artifacts {
|
||||
zip = [
|
||||
"threshold_${version}_darwin_amd64.zip",
|
||||
"threshold_${version}_darwin_arm64.zip",
|
||||
"threshold_${version}_freebsd_386.zip",
|
||||
"threshold_${version}_freebsd_amd64.zip",
|
||||
"threshold_${version}_freebsd_arm.zip",
|
||||
"threshold_${version}_linux_386.zip",
|
||||
"threshold_${version}_linux_amd64.zip",
|
||||
"threshold_${version}_linux_arm.zip",
|
||||
"threshold_${version}_linux_arm64.zip",
|
||||
"threshold_${version}_netbsd_386.zip",
|
||||
"threshold_${version}_netbsd_amd64.zip",
|
||||
"threshold_${version}_netbsd_arm.zip",
|
||||
"threshold_${version}_openbsd_386.zip",
|
||||
"threshold_${version}_openbsd_amd64.zip",
|
||||
"threshold_${version}_openbsd_arm.zip",
|
||||
"threshold_${version}_solaris_amd64.zip",
|
||||
"threshold_${version}_windows_386.zip",
|
||||
"threshold_${version}_windows_amd64.zip",
|
||||
]
|
||||
rpm = [
|
||||
"threshold-${version_linux}-1.aarch64.rpm",
|
||||
"threshold-${version_linux}-1.armv7hl.rpm",
|
||||
"threshold-${version_linux}-1.i386.rpm",
|
||||
"threshold-${version_linux}-1.x86_64.rpm",
|
||||
]
|
||||
deb = [
|
||||
"threshold_${version_linux}-1_amd64.deb",
|
||||
"threshold_${version_linux}-1_arm64.deb",
|
||||
"threshold_${version_linux}-1_armhf.deb",
|
||||
"threshold_${version_linux}-1_i386.deb",
|
||||
]
|
||||
container = [
|
||||
"threshold_default_linux_386_${version}_${commit_sha}.docker.tar",
|
||||
"threshold_default_linux_amd64_${version}_${commit_sha}.docker.tar",
|
||||
"threshold_default_linux_arm64_${version}_${commit_sha}.docker.tar",
|
||||
"threshold_default_linux_arm_${version}_${commit_sha}.docker.tar",
|
||||
]
|
||||
}
|
||||
+28
-83
@@ -13,108 +13,53 @@
|
||||
# For local dev and testing purposes, please build and use the `dev` docker image.
|
||||
|
||||
|
||||
# Development docker image
|
||||
FROM docker.mirror.hashicorp.services/alpine:3.21 as dev
|
||||
# Development docker image (built from the locally built ./bin/threshold)
|
||||
FROM alpine:3.21 as dev
|
||||
|
||||
RUN set -eux && \
|
||||
addgroup boundary && \
|
||||
adduser -s /bin/sh -S -G boundary boundary && \
|
||||
addgroup threshold && \
|
||||
adduser -s /bin/sh -S -G threshold threshold && \
|
||||
apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
||||
|
||||
ADD bin/boundary /bin/boundary
|
||||
RUN setcap cap_ipc_lock=+ep /bin/boundary
|
||||
ADD bin/threshold /bin/threshold
|
||||
RUN setcap cap_ipc_lock=+ep /bin/threshold
|
||||
|
||||
RUN mkdir /boundary/
|
||||
ADD .release/docker/config.hcl /boundary/config.hcl
|
||||
RUN chown -R boundary:boundary /boundary/
|
||||
RUN chmod -R 640 /boundary/*
|
||||
RUN mkdir /threshold/
|
||||
ADD .release/docker/config.hcl /threshold/config.hcl
|
||||
RUN chown -R threshold:threshold /threshold/
|
||||
RUN chmod -R 640 /threshold/*
|
||||
|
||||
EXPOSE 9200 9201 9202
|
||||
VOLUME /boundary/
|
||||
VOLUME /threshold/
|
||||
|
||||
LABEL org.opencontainers.image.licenses="BUSL-1.1"
|
||||
|
||||
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
COPY bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
|
||||
COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
||||
|
||||
USER boundary
|
||||
USER threshold
|
||||
ENTRYPOINT ["docker-entrypoint.sh"]
|
||||
CMD ["server", "-config", "/boundary/config.hcl"]
|
||||
|
||||
|
||||
# Official docker image that uses binaries from releases.hashicorp.com
|
||||
FROM docker.mirror.hashicorp.services/alpine:3.21 as official
|
||||
|
||||
ARG PRODUCT_VERSION
|
||||
|
||||
LABEL name="Boundary" \
|
||||
maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
|
||||
vendor="HashiCorp" \
|
||||
version=$PRODUCT_VERSION \
|
||||
release=$PRODUCT_VERSION \
|
||||
summary="Boundary provides simple and secure access to hosts and services" \
|
||||
description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
|
||||
org.opencontainers.image.licenses="BUSL-1.1"
|
||||
|
||||
RUN set -eux && \
|
||||
addgroup boundary && \
|
||||
adduser -s /bin/sh -S -G boundary boundary && \
|
||||
apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables && \
|
||||
gpg --keyserver keyserver.ubuntu.com --recv-keys C874011F0AB405110D02105534365D9472D7468F && \
|
||||
cd /tmp && \
|
||||
apkArch="$(apk --print-arch)" && \
|
||||
case "${apkArch}" in \
|
||||
aarch64) boundaryArch='arm64' ;; \
|
||||
armhf) boundaryArch='armhfv6' ;; \
|
||||
x86) boundaryArch='386' ;; \
|
||||
x86_64) boundaryArch='amd64' ;; \
|
||||
*) echo >&2 "error: unsupported architecture: ${apkArch} (see https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/ )" && exit 1 ;; \
|
||||
esac && \
|
||||
wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
|
||||
wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS && \
|
||||
wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
|
||||
gpg --batch --verify boundary_${PRODUCT_VERSION}_SHA256SUMS.sig boundary_${PRODUCT_VERSION}_SHA256SUMS && \
|
||||
grep boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS | sha256sum -c && \
|
||||
unzip -d /bin boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
|
||||
rm boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
|
||||
setcap cap_ipc_lock=+ep /bin/boundary && \
|
||||
cp /bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt && \
|
||||
mkdir /boundary
|
||||
|
||||
COPY .release/docker/config.hcl /boundary/config.hcl
|
||||
|
||||
RUN chown -R boundary:boundary /boundary/
|
||||
RUN chmod -R 640 /boundary/*
|
||||
|
||||
EXPOSE 9200 9201 9202
|
||||
VOLUME /boundary/
|
||||
|
||||
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
USER boundary
|
||||
ENTRYPOINT ["docker-entrypoint.sh"]
|
||||
CMD ["server", "-config", "/boundary/config.hcl"]
|
||||
CMD ["server", "-config", "/threshold/config.hcl"]
|
||||
|
||||
|
||||
# Production docker image
|
||||
# Remember, this cannot be built locally
|
||||
FROM docker.mirror.hashicorp.services/alpine:3.21 as default
|
||||
FROM alpine:3.21 as default
|
||||
|
||||
ARG BIN_NAME
|
||||
# NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com
|
||||
# and the version to download. Example: NAME=boundary PRODUCT_VERSION=1.2.3.
|
||||
ARG NAME=boundary
|
||||
# NAME is the name of the software (and of the user/group created in the image);
|
||||
# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
|
||||
ARG NAME=threshold
|
||||
ARG PRODUCT_VERSION
|
||||
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
|
||||
ARG TARGETOS TARGETARCH
|
||||
|
||||
LABEL name="Boundary" \
|
||||
maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
|
||||
vendor="HashiCorp" \
|
||||
LABEL name="Threshold" \
|
||||
vendor="Threshold (fork of HashiCorp Boundary CE)" \
|
||||
version=$PRODUCT_VERSION \
|
||||
release=$PRODUCT_VERSION \
|
||||
summary="Boundary provides simple and secure access to hosts and services" \
|
||||
description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
|
||||
summary="Threshold provides simple and secure access to hosts and services" \
|
||||
description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
|
||||
org.opencontainers.image.licenses="BUSL-1.1"
|
||||
|
||||
# Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
|
||||
@@ -126,20 +71,20 @@ RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}
|
||||
|
||||
RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
||||
|
||||
COPY .release/docker/config.hcl /boundary/config.hcl
|
||||
COPY .release/docker/config.hcl /threshold/config.hcl
|
||||
|
||||
COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
|
||||
COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
|
||||
COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
||||
RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME
|
||||
|
||||
RUN chown -R ${NAME}:${NAME} /boundary
|
||||
RUN chmod -R 640 /boundary/*
|
||||
RUN chown -R ${NAME}:${NAME} /threshold
|
||||
RUN chmod -R 640 /threshold/*
|
||||
|
||||
EXPOSE 9200 9201 9202
|
||||
VOLUME /boundary/
|
||||
VOLUME /threshold/
|
||||
|
||||
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
USER ${NAME}
|
||||
ENTRYPOINT ["docker-entrypoint.sh"]
|
||||
CMD ["server", "-config", "/boundary/config.hcl"]
|
||||
CMD ["server", "-config", "/threshold/config.hcl"]
|
||||
@@ -55,16 +55,16 @@ dev:
|
||||
.PHONY: build
|
||||
build: BUILD_TAGS+=ui
|
||||
build: build-ui-ifne
|
||||
@echo "==> Building Boundary with UI features enabled"
|
||||
@echo "==> Building Threshold with UI features enabled"
|
||||
@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"
|
||||
|
||||
.PHONY: build-no-ui
|
||||
build-no-ui:
|
||||
@echo "==> Building Boundary without UI features"
|
||||
@echo "==> Building Threshold without UI features"
|
||||
@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"
|
||||
|
||||
.PHONY: install
|
||||
install: export BOUNDARY_INSTALL_BINARY=1
|
||||
install: export THRESHOLD_INSTALL_BINARY=1
|
||||
install: build
|
||||
|
||||
.PHONY: install-no-plugins
|
||||
@@ -74,7 +74,7 @@ install-no-plugins: install
|
||||
.PHONY: build-memprof
|
||||
build-memprof: BUILD_TAGS+=memprofiler
|
||||
build-memprof:
|
||||
@echo "==> Building Boundary with memory profiling enabled"
|
||||
@echo "==> Building Threshold with memory profiling enabled"
|
||||
@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"
|
||||
|
||||
# Format Go files, ignoring files marked as generated through the header defined at
|
||||
@@ -363,35 +363,14 @@ install-go:
|
||||
./ci/goinstall.sh
|
||||
|
||||
# Docker build and publish variables and targets
|
||||
REGISTRY_NAME?=docker.io/hashicorp
|
||||
IMAGE_NAME=boundary
|
||||
REGISTRY_NAME?=repo.anhonesthost.net/cybercovellc
|
||||
IMAGE_NAME=threshold
|
||||
VERSION?=0.7.4
|
||||
IMAGE_TAG=$(REGISTRY_NAME)/$(IMAGE_NAME):$(VERSION)
|
||||
IMAGE_TAG_DEV?=$(REGISTRY_NAME)/$(IMAGE_NAME):latest-$(shell git rev-parse --short HEAD)
|
||||
|
||||
.PHONY: docker
|
||||
docker: docker-build
|
||||
|
||||
.PHONY: docker-build
|
||||
# Builds from the releases.hashicorp.com official binary
|
||||
docker-build:
|
||||
docker build \
|
||||
--tag $(IMAGE_TAG) \
|
||||
--tag hashicorp/boundary:latest \
|
||||
--target=official \
|
||||
--build-arg VERSION=$(VERSION) \
|
||||
.
|
||||
|
||||
.PHONY: docker-multiarch-build
|
||||
# Builds multiarch from the releases.hashicorp.com official binary
|
||||
docker-multiarch-build:
|
||||
docker buildx build \
|
||||
--tag $(IMAGE_TAG) \
|
||||
--tag hashicorp/boundary:latest \
|
||||
--target=official \
|
||||
--build-arg VERSION=$(VERSION) \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
.
|
||||
docker: docker-build-dev
|
||||
|
||||
DEV_DOCKER_GOOS ?= linux
|
||||
DEV_DOCKER_GOARCH ?= amd64
|
||||
@@ -406,7 +385,7 @@ docker-build-dev: build
|
||||
--platform $(DEV_DOCKER_GOOS)/$(DEV_DOCKER_GOARCH) \
|
||||
--tag $(IMAGE_TAG_DEV) \
|
||||
--target=dev \
|
||||
--build-arg=boundary \
|
||||
--build-arg=threshold \
|
||||
.
|
||||
@echo "Successfully built $(IMAGE_TAG_DEV)"
|
||||
|
||||
@@ -417,7 +396,7 @@ docker-build-dev: build
|
||||
version:
|
||||
@go run \
|
||||
-ldflags "-X 'github.com/hashicorp/boundary/version.Version=$(shell cat version/VERSION)'" \
|
||||
./cmd/boundary version \
|
||||
./cmd/threshold version \
|
||||
| awk '/Version Number:/ { print $$3 }'
|
||||
|
||||
EDITION?=
|
||||
@@ -425,7 +404,7 @@ EDITION?=
|
||||
# This is used for release builds by .github/workflows/build.yml
|
||||
edition:
|
||||
@if [ -z "$(EDITION)" ]; then \
|
||||
go run ./cmd/boundary version -format=json | jq -r '.version_metadata // "oss"'; \
|
||||
go run ./cmd/threshold version -format=json | jq -r '.version_metadata // "oss"'; \
|
||||
else \
|
||||
echo $(EDITION); \
|
||||
fi; \
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB |
File renamed without changes.
File renamed without changes.
File renamed without changes.
+4
-4
@@ -17,7 +17,7 @@ DIR="$( cd -P "$( dirname "$SOURCE" )/.." && pwd )"
|
||||
cd "$DIR"
|
||||
|
||||
# Set build tags
|
||||
BUILD_TAGS="${BUILD_TAGS:-"boundary"}"
|
||||
BUILD_TAGS="${BUILD_TAGS:-"threshold"}"
|
||||
echo "==> Build tags: ${BUILD_TAGS}"
|
||||
|
||||
# Get the git commit
|
||||
@@ -61,7 +61,7 @@ fi
|
||||
BASE_PRODUCT_VERSION=${BASE_PRODUCT_VERSION:=$(cat version/VERSION)}
|
||||
|
||||
# Declare binary paths!
|
||||
BINARY_NAME="boundary${BINARY_SUFFIX}"
|
||||
BINARY_NAME="threshold${BINARY_SUFFIX}"
|
||||
BIN_PATH=${BIN_PATH:=bin/${BINARY_NAME}}
|
||||
BIN_PARENT_DIR="${BIN_PATH%/*}"
|
||||
BIN_PARENT_DIR="${BIN_PARENT_DIR##*/}"
|
||||
@@ -85,10 +85,10 @@ ${GO_CMD} build \
|
||||
-X 'github.com/hashicorp/boundary/version.BuildDate=$BUILD_DATE'
|
||||
" \
|
||||
-o "$BIN_PATH" \
|
||||
./cmd/boundary
|
||||
./cmd/threshold
|
||||
|
||||
# Copy binary into gopath if desired
|
||||
if [ "${BOUNDARY_INSTALL_BINARY}x" != "x" ]; then
|
||||
if [ "${THRESHOLD_INSTALL_BINARY:-${BOUNDARY_INSTALL_BINARY:-}}x" != "x" ]; then
|
||||
echo "==> Moving binary into GOPATH/bin..."
|
||||
mv -f "${BIN_PATH}" "${GOPATH}/bin/"
|
||||
fi
|
||||
|
||||
Reference in new issue
Block a user