Nguyen Minh Phuc
a59d3848ae
ci / lint (push) Successful in 36s
ci / unit (push) Successful in 1m40s
ci / types (push) Successful in 1m49s
ci / dockerfile (push) Successful in 44s
ci / security (push) Successful in 1m50s
ci / chart (push) Successful in 1m10s
ci / integration (push) Successful in 1m39s
ci / image (api) (push) Successful in 6m16s
ci / image (reconciler) (push) Successful in 7m32s
ci / image (worker) (push) Failing after 6m36s
ci / bump (push) Has been skipped
trivy took the worker image from 39 findings (2 CRITICAL) to 18 (0 CRITICAL) after the previous bump. The residue is kubectl's vendored deps: k8s v1.35.x pins github.com/moby/spdystream v0.5.0, and the fix is in 0.5.1. v1.36.2 vendors 0.5.1. One minor ahead of the v1.35.3 API server, which is inside kubectl's supported +/-1 window. reconciler was already green because it ships helm only.
73 lines
3.7 KiB
Docker
73 lines
3.7 KiB
Docker
# syntax=docker/dockerfile:1.10
|
|
#
|
|
# svcforge worker. Build from the REPO ROOT:
|
|
# docker buildx build -f services/worker/Dockerfile -t svcforge/worker:dev .
|
|
#
|
|
# The only service that shells out to helm/kubectl, so the only one carrying those two
|
|
# binaries. They are copied from pinned images rather than curl'd, so the version is a
|
|
# reviewable line in a Dockerfile instead of a network call at build time.
|
|
|
|
FROM python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS builder
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.5.11@sha256:0ac957607303916420297a4c9c213bb33fbd3c888f9cd7f4f7273596ebf42b85 /uv /usr/local/bin/uv
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY libs/svcforge_core/pyproject.toml libs/svcforge_core/
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable \
|
|
--no-install-project --no-install-package svcforge-core
|
|
|
|
COPY libs/ libs/
|
|
COPY services/worker/ services/worker/
|
|
COPY catalog.yaml ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable && \
|
|
/app/.venv/bin/python -c 'import svcforge_core, sys; \
|
|
p = svcforge_core.__file__; \
|
|
sys.exit(0) if "site-packages" in p else sys.exit("not a wheel install: " + p)'
|
|
|
|
# --- runtime --------------------------------------------------------------------------
|
|
FROM python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de
|
|
|
|
ARG BUILD_SHA=unknown
|
|
LABEL org.opencontainers.image.title="svcforge-worker" \
|
|
org.opencontainers.image.source="https://gitea.oci-oci.duckdns.org/gitea_admin/svcforge" \
|
|
org.opencontainers.image.revision="${BUILD_SHA}"
|
|
|
|
RUN useradd -u 10001 -m -s /usr/sbin/nologin svcforge
|
|
WORKDIR /app
|
|
COPY --from=builder --chown=10001:10001 /app /app
|
|
|
|
# helm 3.21.3, not 3.16.2. 3.16.2 was built with Go 1.22.9 and carries CRITICAL
|
|
# CVE-2025-68121 (crypto/tls) and CVE-2026-33186 (grpc), plus HIGH CVE-2026-35469
|
|
# (spdystream, fixed in 0.5.1) — trivy fails the build on them and is right to.
|
|
# Deliberately 3.x: helm 4 is a breaking change and is not a CVE fix.
|
|
COPY --from=alpine/helm:3.21.3@sha256:35da09ba0716fc7c3cd63b6b31ee380a9c7662e95f29ab0e4ae962420afd315b /usr/bin/helm /usr/local/bin/helm
|
|
# kubectl 1.36.2 from the OFFICIAL registry.k8s.io image, replacing
|
|
# bitnamilegacy/kubectl:1.31.2. Two reasons, either sufficient:
|
|
# - CVEs: the bitnami image is Go 1.22.9 and ships containerd < 1.7.29 (HIGH
|
|
# CVE-2024-25621) along with the same crypto/tls and grpc CRITICALs as helm above.
|
|
# - Skew: the target cluster runs v1.35.3. 1.31.2 is four minors behind, well outside
|
|
# kubectl's supported +/-1 window, so it was unsupported against this cluster.
|
|
# bitnamilegacy publishes no 1.35 tag. registry.k8s.io/kubectl is the upstream-maintained
|
|
# image, is a manifest list with linux/arm64 (this cluster is Ampere), and puts the binary
|
|
# at /bin/kubectl rather than bitnami's /opt/bitnami path.
|
|
#
|
|
# 1.36.2 rather than 1.36.x-matching-the-cluster: k8s v1.35.x vendors
|
|
# github.com/moby/spdystream v0.5.0, which carries CVE-2026-35469 (HIGH, fixed in
|
|
# 0.5.1). v1.36.2 vendors 0.5.1. trivy blocks the release on it, correctly. One
|
|
# minor ahead of the v1.35.3 API server is inside kubectl's supported +/-1 window.
|
|
COPY --from=registry.k8s.io/kubectl:v1.36.2@sha256:b0d792e0d8dfb9bb1b922b78b23137e2a34bb6f9667640353a9d2aadd1fd7761 /bin/kubectl /usr/local/bin/kubectl
|
|
|
|
ENV PATH="/app/.venv/bin:$PATH" \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
HELM_CACHE_HOME=/tmp/helm/cache \
|
|
HELM_CONFIG_HOME=/tmp/helm/config \
|
|
HELM_DATA_HOME=/tmp/helm/data
|
|
USER 10001
|
|
ENTRYPOINT ["python", "-m", "services.worker.main"]
|