shadowdaoandClaude Sonnet 5.5
d07030a10b
Linux packages: migrate /etc/boundary.d to /etc/threshold.d without clobbering, reuse the boundary service user, carry over service enablement with a boundary.service alias, provide a boundary command. Docker: accept /boundary/config.hcl, boundary command, /boundary symlink. CLI: deprecation notice when invoked as boundary (stderr only). Dev mode: also create *.threshold.dev aliases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
105 lines
3.8 KiB
Docker
105 lines
3.8 KiB
Docker
# Copyright IBM Corp. 2020, 2026
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
# This Dockerfile contains multiple targets.
|
|
# Use 'docker build --target=<name> .' to build one.
|
|
# e.g. `docker build --target=dev .`
|
|
#
|
|
# All non-dev targets have a VERSION argument that must be provided
|
|
# via --build-arg=VERSION=<version> when building.
|
|
# e.g. --build-arg=0.7.4
|
|
#
|
|
# `default` is the production docker image which cannot be built locally.
|
|
# For local dev and testing purposes, please build and use the `dev` docker image.
|
|
|
|
|
|
# Development docker image (built from the locally built ./bin/threshold)
|
|
FROM alpine:3.21 as dev
|
|
|
|
RUN set -eux && \
|
|
addgroup threshold && \
|
|
adduser -s /bin/sh -S -G threshold threshold && \
|
|
apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
|
|
|
ADD bin/threshold /bin/threshold
|
|
RUN setcap cap_ipc_lock=+ep /bin/threshold
|
|
|
|
RUN mkdir /threshold/
|
|
ADD .release/docker/config.hcl /threshold/config.hcl
|
|
RUN chown -R threshold:threshold /threshold/
|
|
RUN chmod -R 640 /threshold/*
|
|
|
|
# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
|
|
# "boundary" command alias (prints a deprecation notice on stderr).
|
|
RUN mkdir -p /usr/share/threshold && \
|
|
cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
|
|
ln -s /threshold /boundary && \
|
|
ln -s threshold /bin/boundary
|
|
|
|
EXPOSE 9200 9201 9202
|
|
VOLUME /threshold/
|
|
|
|
LABEL org.opencontainers.image.licenses="BUSL-1.1"
|
|
|
|
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
|
|
|
USER threshold
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["server", "-config", "/threshold/config.hcl"]
|
|
|
|
|
|
# Production docker image
|
|
# Remember, this cannot be built locally
|
|
FROM alpine:3.21 as default
|
|
|
|
ARG BIN_NAME
|
|
# NAME is the name of the software (and of the user/group created in the image);
|
|
# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
|
|
ARG NAME=threshold
|
|
ARG PRODUCT_VERSION
|
|
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
|
|
ARG TARGETOS TARGETARCH
|
|
|
|
LABEL name="Threshold" \
|
|
vendor="Threshold (fork of HashiCorp Boundary CE)" \
|
|
version=$PRODUCT_VERSION \
|
|
release=$PRODUCT_VERSION \
|
|
summary="Threshold provides simple and secure access to hosts and services" \
|
|
description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
|
|
org.opencontainers.image.licenses="BUSL-1.1"
|
|
|
|
# Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
|
|
ENV NAME=$NAME
|
|
ENV VERSION=$PRODUCT_VERSION
|
|
|
|
# Create a non-root user to run the software.
|
|
RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}
|
|
|
|
RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
|
|
|
COPY .release/docker/config.hcl /threshold/config.hcl
|
|
|
|
COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
|
|
COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
|
RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME
|
|
|
|
RUN chown -R ${NAME}:${NAME} /threshold
|
|
RUN chmod -R 640 /threshold/*
|
|
|
|
# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
|
|
# "boundary" command alias (prints a deprecation notice on stderr).
|
|
RUN mkdir -p /usr/share/threshold && \
|
|
cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
|
|
ln -s /threshold /boundary && \
|
|
ln -s ${BIN_NAME} /bin/boundary
|
|
|
|
EXPOSE 9200 9201 9202
|
|
VOLUME /threshold/
|
|
|
|
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
USER ${NAME}
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["server", "-config", "/threshold/config.hcl"]
|