diff --git a/Dockerfile b/Dockerfile index fdb207afc83b0dec8106a7ccca8de6c215992743..ad0ecf64aa748be453f26537c7fb5735d22f0741 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,78 +1,73 @@ -ARG BASE_REGISTRY=registry1.dsop.io -ARG BASE_IMAGE=ironbank/redhat/ubi/ubi8 -ARG BASE_TAG=8.2 - -FROM docker.bintray.io/jfrog/artifactory-oss:7.11.5 AS base - -FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} - -LABEL org.opencontainers.image.title="JFrog Artifactory OSS" \ - org.opencontainers.image.description="JFrog Artifactory OSS image based on the Red Hat Universal Base Image for DSOP." \ - org.opencontainers.image.url="https://jfrog.com" \ - org.opencontainers.image.version="7.11.5" \ - maintainer="cht@dsop.io" - -USER root - -# Set vars -ARG ARTIFACTORY_VERSION=7.11.5 -ENV JF_ARTIFACTORY_USER=artifactory \ - ARTIFACTORY_VERSION=${ARTIFACTORY_VERSION} \ - ARTIFACTORY_BOOTSTRAP=/artifactory_bootstrap \ - JF_PRODUCT_HOME=/opt/jfrog/artifactory \ - JF_PRODUCT_DATA_INTERNAL=/var/opt/jfrog/artifactory \ - RECOMMENDED_MAX_OPEN_FILES=32000 \ - MIN_MAX_OPEN_FILES=10000 \ - RECOMMENDED_MAX_OPEN_PROCESSES=1024 - -COPY --from=base /opt/jfrog/artifactory/ /opt/jfrog/artifactory/ -COPY --from=base /var/opt/jfrog/artifactory/ /var/opt/jfrog/artifactory/ -COPY --from=base /opt/jfrog/artifactory/app/third-party /opt/jfrog/artifactory/app/third-party -COPY ./scripts/entrypoint-artifactory.sh / -COPY ./scripts/artifactory.sh /opt/jfrog/artifactory/app/bin/ -COPY ./scripts/artifactoryCommon.sh /opt/jfrog/artifactory/app/bin/ -COPY ./scripts/installerCommon.sh /opt/jfrog/artifactory/app/bin/ -COPY ./scripts/migrate.sh /opt/jfrog/artifactory/app/bin/ - -# Handle permissions and ownership in ${JF_PRODUCT_HOME}/app -# set artifactory home and data -# set docker as distribution for callhome -# Handle run with custom uid and gid with no volume mounted -# Handle bootstrap directory permissions -RUN groupadd -g 1030 ${JF_ARTIFACTORY_USER} && \ - useradd -d "$JF_PRODUCT_HOME" -u 1030 -g 1030 -m -s /bin/bash ${JF_ARTIFACTORY_USER} && \ - dnf upgrade -y && \ - dnf install -y procps-ng net-tools cronie hostname --setopt=tsflags=nodocs && \ - dnf clean all && \ - rm -rf /var/cache/dnf && \ - chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${JF_PRODUCT_HOME} && \ - chmod 777 ${JF_PRODUCT_HOME}/app/run && \ - chmod -R 755 ${JF_PRODUCT_HOME}/app/artifactory/tomcat && \ - chmod -R 777 ${JF_PRODUCT_HOME}/app/artifactory/tomcat/webapps && \ - chmod -R go+w ${JF_PRODUCT_HOME}/app ${JF_PRODUCT_HOME}/app/bin ${JF_PRODUCT_HOME}/app/artifactory/tomcat/conf && \ - chmod +x ${JF_PRODUCT_HOME}/app/bin/*.sh ${JF_PRODUCT_HOME}/app/artifactory/tomcat/bin/*.sh && \ - ln -s ${JF_PRODUCT_DATA_INTERNAL} ${JF_PRODUCT_HOME}/var && \ - chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${JF_PRODUCT_DATA_INTERNAL} && \ - chmod +x /entrypoint-artifactory.sh && \ - chmod -R 777 ${JF_PRODUCT_DATA_INTERNAL} && \ - mkdir -p ${ARTIFACTORY_BOOTSTRAP} && \ - chmod -R 766 ${ARTIFACTORY_BOOTSTRAP} && \ - chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${ARTIFACTORY_BOOTSTRAP} - -# Expose Router's port -EXPOSE 8081 - -# The user that will run the container and artifactory -USER ${JF_ARTIFACTORY_USER} - -# Default mount for data directory -VOLUME ${JF_PRODUCT_DATA_INTERNAL} - -# Change workdir to Artifactory Home -WORKDIR ${JF_PRODUCT_HOME} - -HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=5 \ - CMD curl -I -f http://localhost:8082/ui/ || exit 1 - -# Start the simple standalone mode of Artifactory +ARG BASE_REGISTRY=registry1.dsop.io +ARG BASE_IMAGE=ironbank/redhat/ubi/ubi8 +ARG BASE_TAG=8.2 + +FROM docker.bintray.io/jfrog/artifactory-oss:7.11.5 AS base + +FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} + + +USER root + +# Set vars +ARG ARTIFACTORY_VERSION=7.11.5 +ENV JF_ARTIFACTORY_USER=artifactory \ + ARTIFACTORY_VERSION=${ARTIFACTORY_VERSION} \ + ARTIFACTORY_BOOTSTRAP=/artifactory_bootstrap \ + JF_PRODUCT_HOME=/opt/jfrog/artifactory \ + JF_PRODUCT_DATA_INTERNAL=/var/opt/jfrog/artifactory \ + RECOMMENDED_MAX_OPEN_FILES=32000 \ + MIN_MAX_OPEN_FILES=10000 \ + RECOMMENDED_MAX_OPEN_PROCESSES=1024 + +COPY --from=base /opt/jfrog/artifactory/ /opt/jfrog/artifactory/ +COPY --from=base /var/opt/jfrog/artifactory/ /var/opt/jfrog/artifactory/ +COPY --from=base /opt/jfrog/artifactory/app/third-party /opt/jfrog/artifactory/app/third-party +COPY ./scripts/entrypoint-artifactory.sh / +COPY ./scripts/artifactory.sh /opt/jfrog/artifactory/app/bin/ +COPY ./scripts/artifactoryCommon.sh /opt/jfrog/artifactory/app/bin/ +COPY ./scripts/installerCommon.sh /opt/jfrog/artifactory/app/bin/ +COPY ./scripts/migrate.sh /opt/jfrog/artifactory/app/bin/ + +# Handle permissions and ownership in ${JF_PRODUCT_HOME}/app +# set artifactory home and data +# set docker as distribution for callhome +# Handle run with custom uid and gid with no volume mounted +# Handle bootstrap directory permissions +RUN groupadd -g 1030 ${JF_ARTIFACTORY_USER} && \ + useradd -d "$JF_PRODUCT_HOME" -u 1030 -g 1030 -m -s /bin/bash ${JF_ARTIFACTORY_USER} && \ + dnf upgrade -y && \ + dnf install -y procps-ng net-tools cronie hostname --setopt=tsflags=nodocs && \ + dnf clean all && \ + rm -rf /var/cache/dnf && \ + chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${JF_PRODUCT_HOME} && \ + chmod 777 ${JF_PRODUCT_HOME}/app/run && \ + chmod -R 755 ${JF_PRODUCT_HOME}/app/artifactory/tomcat && \ + chmod -R 777 ${JF_PRODUCT_HOME}/app/artifactory/tomcat/webapps && \ + chmod -R go+w ${JF_PRODUCT_HOME}/app ${JF_PRODUCT_HOME}/app/bin ${JF_PRODUCT_HOME}/app/artifactory/tomcat/conf && \ + chmod +x ${JF_PRODUCT_HOME}/app/bin/*.sh ${JF_PRODUCT_HOME}/app/artifactory/tomcat/bin/*.sh && \ + ln -s ${JF_PRODUCT_DATA_INTERNAL} ${JF_PRODUCT_HOME}/var && \ + chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${JF_PRODUCT_DATA_INTERNAL} && \ + chmod +x /entrypoint-artifactory.sh && \ + chmod -R 777 ${JF_PRODUCT_DATA_INTERNAL} && \ + mkdir -p ${ARTIFACTORY_BOOTSTRAP} && \ + chmod -R 766 ${ARTIFACTORY_BOOTSTRAP} && \ + chown -R ${JF_ARTIFACTORY_USER}:${JF_ARTIFACTORY_USER} ${ARTIFACTORY_BOOTSTRAP} + +# Expose Router's port +EXPOSE 8081 + +# The user that will run the container and artifactory +USER ${JF_ARTIFACTORY_USER} + +# Default mount for data directory +VOLUME ${JF_PRODUCT_DATA_INTERNAL} + +# Change workdir to Artifactory Home +WORKDIR ${JF_PRODUCT_HOME} + +HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=5 \ + CMD curl -I -f http://localhost:8082/ui/ || exit 1 + +# Start the simple standalone mode of Artifactory ENTRYPOINT ["/entrypoint-artifactory.sh"] \ No newline at end of file diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index b0199e3fd9888385524c72a2349b06f5c9a5b18b..0000000000000000000000000000000000000000 --- a/Jenkinsfile +++ /dev/null @@ -1,2 +0,0 @@ -@Library('DCCSCR@master') _ -dccscrPipeline(version: "7.11.5") diff --git a/download.yaml b/download.yaml deleted file mode 100644 index 4fffb70168a3c3c465cf4f77d7a56ecf532f067b..0000000000000000000000000000000000000000 --- a/download.yaml +++ /dev/null @@ -1,3 +0,0 @@ -resources: - - url: "docker://docker.bintray.io/jfrog/artifactory-oss@sha256:9792ca19a3a723a23ad6b41ad34fd7c2e5b6a5088ebd8b2a79cd7cd45067dbda" - tag: "docker.bintray.io/jfrog/artifactory-oss:7.11.5" \ No newline at end of file diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml new file mode 100644 index 0000000000000000000000000000000000000000..7f813eb4f3299597102588839c89fb9005cee2a3 --- /dev/null +++ b/hardening_manifest.yaml @@ -0,0 +1,55 @@ +--- +apiVersion: v1 + +# The repository name in registry1, excluding /ironbank/ +name: "jfrog/artifactory/artifactory-oss" + +# List of tags to push for the repository in registry1 +# The most specific version should be the first tag and will be shown +# on ironbank.dsop.io +tags: +- "7.11.5" +- "latest" + +# Build args passed to Dockerfile ARGs +args: + BASE_IMAGE: "redhat/ubi/ubi8" + BASE_TAG: "8.3" + +# Docker image labels +labels: + org.opencontainers.image.title: "artifactory-oss" + ## Human-readable description of the software packaged in the image + # org.opencontainers.image.description: "FIXME" + ## License(s) under which contained software is distributed + # org.opencontainers.image.licenses: "FIXME" + ## URL to find more information on the image + # org.opencontainers.image.url: "FIXME" + ## Name of the distributing entity, organization or individual + # org.opencontainers.image.vendor: "FIXME" + org.opencontainers.image.version: "7.11.5" + ## Keywords to help with search (ex. "cicd,gitops,golang") + # mil.dso.ironbank.image.keywords: "FIXME" + ## This value can be "opensource" or "commercial" + # mil.dso.ironbank.image.type: "FIXME" + ## Product the image belongs to for grouping multiple images + # mil.dso.ironbank.product.name: "FIXME" + +# List of resources to make available to the offline build context +resources: +- tag: docker.bintray.io/jfrog/artifactory-oss:7.11.5 + url: docker://docker.bintray.io/jfrog/artifactory-oss@sha256:9792ca19a3a723a23ad6b41ad34fd7c2e5b6a5088ebd8b2a79cd7cd45067dbda + +# List of project maintainers +# FIXME: Fill in the following details for the current container owner in the whitelist +# FIXME: Include any other vendor information if applicable +maintainers: +- email: "danielmi@jfrog.com" +# # The name of the current container owner +# name: "FIXME" +# # The gitlab username of the current container owner +# username: "FIXME" +# cht_member: true # FIXME: Uncomment if the maintainer is a member of CHT +# - name: "FIXME" +# username: "FIXME" +# email: "FIXME" diff --git a/renovate.json b/renovate.json index 3ea9186011ce07e1ea4814841c26792dd339e611..1387d509fda8ee3078c2fb70d798c3aca0f7a5df 100644 --- a/renovate.json +++ b/renovate.json @@ -1,23 +1,40 @@ { - "assignees": ["@matt.vasquez"], - "baseBranches": ["development"], - "regexManagers": [ - { - "fileMatch": ["^Dockerfile$"], - "matchStrings": [ - "version=\"(?.*?)\"" - ], - "depNameTemplate": "jfrog/artifactory/artifactory-oss", - "datasourceTemplate": "docker" - }, - { - "fileMatch": ["^Jenkinsfile$"], - "matchStrings": [ - "version:\\s+\"(?.*?)\"" - ], - "depNameTemplate": "jfrog/artifactory/artifactory-oss", - "datasourceTemplate": "docker" - } - ] - } - \ No newline at end of file + "assignees": [ + "@matt.vasquez" + ], + "baseBranches": [ + "development" + ], + "regexManagers": [ + { + "fileMatch": [ + "^Dockerfile$" + ], + "matchStrings": [ + "version=\"(?.*?)\"" + ], + "depNameTemplate": "jfrog/artifactory/artifactory-oss", + "datasourceTemplate": "docker" + }, + { + "fileMatch": [ + "^hardening_manifest.yaml$" + ], + "matchStrings": [ + "org\\.opencontainers\\.image\\.version:\\s+\"(?.+?)\"" + ], + "depNameTemplate": "jfrog/artifactory/artifactory-oss", + "datasourceTemplate": "docker" + }, + { + "fileMatch": [ + "^hardening_manifest.yaml$" + ], + "matchStrings": [ + "tags:\\s+-\\s+\"(?.+?)\"" + ], + "depNameTemplate": "jfrog/artifactory/artifactory-oss", + "datasourceTemplate": "docker" + } + ] +} \ No newline at end of file