91 lines
3.1 KiB
Docker
91 lines
3.1 KiB
Docker
# Copyright IBM Corp. 2020, 2026
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
# This Dockerfile contains multiple targets.
|
|
# Use 'docker build --target=<name> .' to build one.
|
|
# e.g. `docker build --target=dev .`
|
|
#
|
|
# All non-dev targets have a VERSION argument that must be provided
|
|
# via --build-arg=VERSION=<version> when building.
|
|
# e.g. --build-arg=0.7.4
|
|
#
|
|
# `default` is the production docker image which cannot be built locally.
|
|
# For local dev and testing purposes, please build and use the `dev` docker image.
|
|
|
|
|
|
# Development docker image (built from the locally built ./bin/threshold)
|
|
FROM alpine:3.21 as dev
|
|
|
|
RUN set -eux && \
|
|
addgroup threshold && \
|
|
adduser -s /bin/sh -S -G threshold threshold && \
|
|
apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
|
|
|
ADD bin/threshold /bin/threshold
|
|
RUN setcap cap_ipc_lock=+ep /bin/threshold
|
|
|
|
RUN mkdir /threshold/
|
|
ADD .release/docker/config.hcl /threshold/config.hcl
|
|
RUN chown -R threshold:threshold /threshold/
|
|
RUN chmod -R 640 /threshold/*
|
|
|
|
EXPOSE 9200 9201 9202
|
|
VOLUME /threshold/
|
|
|
|
LABEL org.opencontainers.image.licenses="BUSL-1.1"
|
|
|
|
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
|
|
|
USER threshold
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["server", "-config", "/threshold/config.hcl"]
|
|
|
|
|
|
# Production docker image
|
|
# Remember, this cannot be built locally
|
|
FROM alpine:3.21 as default
|
|
|
|
ARG BIN_NAME
|
|
# NAME is the name of the software (and of the user/group created in the image);
|
|
# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
|
|
ARG NAME=threshold
|
|
ARG PRODUCT_VERSION
|
|
# TARGETARCH and TARGETOS are set automatically when --platform is provided.
|
|
ARG TARGETOS TARGETARCH
|
|
|
|
LABEL name="Threshold" \
|
|
vendor="Threshold (fork of HashiCorp Boundary CE)" \
|
|
version=$PRODUCT_VERSION \
|
|
release=$PRODUCT_VERSION \
|
|
summary="Threshold provides simple and secure access to hosts and services" \
|
|
description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
|
|
org.opencontainers.image.licenses="BUSL-1.1"
|
|
|
|
# Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
|
|
ENV NAME=$NAME
|
|
ENV VERSION=$PRODUCT_VERSION
|
|
|
|
# Create a non-root user to run the software.
|
|
RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}
|
|
|
|
RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables
|
|
|
|
COPY .release/docker/config.hcl /threshold/config.hcl
|
|
|
|
COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
|
|
COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
|
|
RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME
|
|
|
|
RUN chown -R ${NAME}:${NAME} /threshold
|
|
RUN chmod -R 640 /threshold/*
|
|
|
|
EXPOSE 9200 9201 9202
|
|
VOLUME /threshold/
|
|
|
|
COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
USER ${NAME}
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["server", "-config", "/threshold/config.hcl"]
|