Newer
Older
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# This affects how strings in Java class files are interpreted.
# We want UTF-8 and this is the only locale in the base image that supports it
ENV LANG="C.UTF-8"
# openjdk11 (base image) does not expose all the fips ciphers, like HmacSHA256, when fips enabled
# This causes issues with keytool & connect, so disable it for ONLY those java processes (not other processes, the OS, or K8S host)
ARG JAVA_OPTS="-Dsecurity.useSystemPropertiesFile=false -Dcom.redhat.fips=false"
ENV JDK_JAVA_OPTIONS=$JAVA_OPTS
ENV JAVA_TOOL_OPTIONS=$JAVA_OPTS
ENV CUB_CLASSPATH='"/usr/share/java/cp-base-new/*"'
USER root
## Add the Confluent Docker Utility Belt which helps with starting the proper applications
## https://github.com/confluentinc/common-docker/tree/master/utility-belt
COPY archive.key /tmp
## For auditing & debugging
COPY LICENSE /licenses/cp-base-new_LICENSE
COPY Dockerfile /etc/confluent/ironbank/cp-base-new_Dockerfile
COPY hardening_manifest.yaml /etc/confluent/ironbank/cp-base-new_Dockerfile
COPY --chmod=755 scripts/dnfupdate /usr/bin/
COPY --chmod=755 scripts/replacejar /usr/bin/
## copy from dockerhub image
COPY --from=base /etc/confluent /etc/confluent
COPY --from=base /etc/cp-base-new /etc/cp-base-new
COPY --from=base /licenses /licenses
COPY --from=base /usr/share/java/cp-base-new /usr/share/java/cp-base-new
COPY --from=base /usr/share/doc /usr/share/doc
COPY --from=base /usr/local/lib /usr/local/lib
COPY --from=base /usr/local/lib64 /usr/local/lib64
COPY --from=base /usr/local/bin /usr/local/bin
RUN echo "===> dnf installs" \
&& dnf install -y --nodocs python39 openssl tar procps iputils hostname \
&& dnf install -y --nodocs glibc glibc-common glibc-minimal-langpack \
&& dnf install -y --nodocs tzdata libgcc libstdc++ cyrus-sasl-lib libsolv \
&& rpm --import /tmp/archive.key \
&& echo "===> python aliasing" \
&& ln -s /usr/bin/python3.9 /usr/bin/python \
&& ln -s /usr/bin/pip3 /usr/bin/pip \
&& alias python=python3.9 \
&& alias pip=pip3 \
&& alternatives --set python /usr/bin/python3.9 \
&& echo "===> manual hardening" \
&& python3 -m pip install --upgrade setuptools \
&& pip3 install urllib3 --upgrade \
&& dnf erase -y procps-ng gdb-gdbserver \
&& echo "===> appuser setup" \
&& mkdir -p /usr/logs /licenses \
&& useradd --no-log-init --create-home --shell /bin/bash appuser \
&& chown appuser:appuser -R /usr/logs \
&& dnfupdate
USER appuser
## healthcheck not applicable since this is ONLY used as a base image