From 2f7eb22891ba261f09e1995cb8fd555980e7fa1c Mon Sep 17 00:00:00 2001 From: Jairo Llopis Date: Thu, 12 Jan 2017 13:01:29 +0100 Subject: [PATCH 1/7] Dockerfile refactored to use Alpine. --- Dockerfile | 88 +++++++++++++++--------------------------------------- 1 file changed, 24 insertions(+), 64 deletions(-) diff --git a/Dockerfile b/Dockerfile index d42b632d4..157578cd5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,70 +1,30 @@ -# https://github.com/letsencrypt/letsencrypt/pull/431#issuecomment-103659297 -# it is more likely developers will already have ubuntu:trusty rather -# than e.g. debian:jessie and image size differences are negligible -FROM ubuntu:trusty +FROM python:2-alpine MAINTAINER Jakub Warmuz MAINTAINER William Budington -# Note: this only exposes the port to other docker containers. You -# still have to bind to 443@host at runtime, as per the ACME spec. -EXPOSE 443 - -# TODO: make sure --config-dir and --work-dir cannot be changed -# through the CLI (certbot-docker wrapper that uses standalone -# authenticator and text mode only?) +EXPOSE 80 443 VOLUME /etc/letsencrypt /var/lib/letsencrypt - WORKDIR /opt/certbot - -# no need to mkdir anything: -# https://docs.docker.com/reference/builder/#copy -# If doesn't exist, it is created along with all missing -# directories in its path. - -ENV DEBIAN_FRONTEND=noninteractive - -COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto -RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* \ - /tmp/* \ - /var/tmp/* - -# the above is not likely to change, so by putting it further up the -# Dockerfile we make sure we cache as much as possible - - -COPY setup.py README.rst CHANGES.rst MANIFEST.in letsencrypt-auto-source/pieces/pipstrap.py /opt/certbot/src/ - -# all above files are necessary for setup.py and venv setup, however, -# package source code directory has to be copied separately to a -# subdirectory... -# https://docs.docker.com/reference/builder/#copy: "If is a -# directory, the entire contents of the directory are copied, -# including filesystem metadata. Note: The directory itself is not -# copied, just its contents." Order again matters, three files are far -# more likely to be cached than the whole project directory - -COPY certbot /opt/certbot/src/certbot/ -COPY acme /opt/certbot/src/acme/ -COPY certbot-apache /opt/certbot/src/certbot-apache/ -COPY certbot-nginx /opt/certbot/src/certbot-nginx/ - - -RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv - -# PATH is set now so pipstrap upgrades the correct (v)env -ENV PATH /opt/certbot/venv/bin:$PATH -RUN /opt/certbot/venv/bin/python /opt/certbot/src/pipstrap.py && \ - /opt/certbot/venv/bin/pip install \ - -e /opt/certbot/src/acme \ - -e /opt/certbot/src \ - -e /opt/certbot/src/certbot-apache \ - -e /opt/certbot/src/certbot-nginx - -# install in editable mode (-e) to save space: it's not possible to -# "rm -rf /opt/certbot/src" (it's stays in the underlaying image); -# this might also help in debugging: you can "docker run --entrypoint -# bash" and investigate, apply patches, etc. - ENTRYPOINT [ "certbot" ] +COPY . src + +RUN apk add --no-cache --virtual .certbot-deps \ + dialog \ + augeas-libs \ + libffi \ + libssl1.0 \ + wget \ + ca-certificates \ + binutils +RUN apk add --no-cache --virtual .build-deps \ + gcc \ + linux-headers \ + openssl-dev \ + musl-dev \ + libffi-dev \ + && pip install --no-cache-dir \ + --editable /opt/certbot/src/acme \ + --editable /opt/certbot/src \ + --editable /opt/certbot/src/certbot-apache \ + --editable /opt/certbot/src/certbot-nginx \ + && apk del .build-deps From b23a2593902df4c5b401b57e6b0ec17bb1fd3e90 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 11:40:17 -0800 Subject: [PATCH 2/7] Don't install unnecessary packages in Dockerfile --- Dockerfile | 7 ------- 1 file changed, 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 157578cd5..fb5695a77 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,4 @@ FROM python:2-alpine -MAINTAINER Jakub Warmuz -MAINTAINER William Budington EXPOSE 80 443 VOLUME /etc/letsencrypt /var/lib/letsencrypt @@ -9,11 +7,8 @@ ENTRYPOINT [ "certbot" ] COPY . src RUN apk add --no-cache --virtual .certbot-deps \ - dialog \ - augeas-libs \ libffi \ libssl1.0 \ - wget \ ca-certificates \ binutils RUN apk add --no-cache --virtual .build-deps \ @@ -25,6 +20,4 @@ RUN apk add --no-cache --virtual .build-deps \ && pip install --no-cache-dir \ --editable /opt/certbot/src/acme \ --editable /opt/certbot/src \ - --editable /opt/certbot/src/certbot-apache \ - --editable /opt/certbot/src/certbot-nginx \ && apk del .build-deps From 6f8bf74c53c7a479209eeb7da83dc74b7f783f15 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 12:00:21 -0800 Subject: [PATCH 3/7] sort directives that never change in Dockerfile --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index fb5695a77..fcc11e8a5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,10 @@ FROM python:2-alpine +ENTRYPOINT [ "certbot" ] EXPOSE 80 443 VOLUME /etc/letsencrypt /var/lib/letsencrypt WORKDIR /opt/certbot -ENTRYPOINT [ "certbot" ] + COPY . src RUN apk add --no-cache --virtual .certbot-deps \ From f94c4eeff1394dba89c194e7f28b6a42725c7ed3 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 12:13:07 -0800 Subject: [PATCH 4/7] only copy necessary files in Dockerfile --- Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index fcc11e8a5..11d53788b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,9 @@ EXPOSE 80 443 VOLUME /etc/letsencrypt /var/lib/letsencrypt WORKDIR /opt/certbot -COPY . src +COPY CHANGES.rst README.rst setup.py src/ +COPY acme src/acme +COPY certbot src/certbot RUN apk add --no-cache --virtual .certbot-deps \ libffi \ From fb9b62a282cd1fdb8d279a9710cc3bea95a7f744 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 12:17:23 -0800 Subject: [PATCH 5/7] add Dockerfile-old --- Dockerfile-old | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 Dockerfile-old diff --git a/Dockerfile-old b/Dockerfile-old new file mode 100644 index 000000000..d42b632d4 --- /dev/null +++ b/Dockerfile-old @@ -0,0 +1,70 @@ +# https://github.com/letsencrypt/letsencrypt/pull/431#issuecomment-103659297 +# it is more likely developers will already have ubuntu:trusty rather +# than e.g. debian:jessie and image size differences are negligible +FROM ubuntu:trusty +MAINTAINER Jakub Warmuz +MAINTAINER William Budington + +# Note: this only exposes the port to other docker containers. You +# still have to bind to 443@host at runtime, as per the ACME spec. +EXPOSE 443 + +# TODO: make sure --config-dir and --work-dir cannot be changed +# through the CLI (certbot-docker wrapper that uses standalone +# authenticator and text mode only?) +VOLUME /etc/letsencrypt /var/lib/letsencrypt + +WORKDIR /opt/certbot + +# no need to mkdir anything: +# https://docs.docker.com/reference/builder/#copy +# If doesn't exist, it is created along with all missing +# directories in its path. + +ENV DEBIAN_FRONTEND=noninteractive + +COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto +RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* \ + /tmp/* \ + /var/tmp/* + +# the above is not likely to change, so by putting it further up the +# Dockerfile we make sure we cache as much as possible + + +COPY setup.py README.rst CHANGES.rst MANIFEST.in letsencrypt-auto-source/pieces/pipstrap.py /opt/certbot/src/ + +# all above files are necessary for setup.py and venv setup, however, +# package source code directory has to be copied separately to a +# subdirectory... +# https://docs.docker.com/reference/builder/#copy: "If is a +# directory, the entire contents of the directory are copied, +# including filesystem metadata. Note: The directory itself is not +# copied, just its contents." Order again matters, three files are far +# more likely to be cached than the whole project directory + +COPY certbot /opt/certbot/src/certbot/ +COPY acme /opt/certbot/src/acme/ +COPY certbot-apache /opt/certbot/src/certbot-apache/ +COPY certbot-nginx /opt/certbot/src/certbot-nginx/ + + +RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv + +# PATH is set now so pipstrap upgrades the correct (v)env +ENV PATH /opt/certbot/venv/bin:$PATH +RUN /opt/certbot/venv/bin/python /opt/certbot/src/pipstrap.py && \ + /opt/certbot/venv/bin/pip install \ + -e /opt/certbot/src/acme \ + -e /opt/certbot/src \ + -e /opt/certbot/src/certbot-apache \ + -e /opt/certbot/src/certbot-nginx + +# install in editable mode (-e) to save space: it's not possible to +# "rm -rf /opt/certbot/src" (it's stays in the underlaying image); +# this might also help in debugging: you can "docker run --entrypoint +# bash" and investigate, apply patches, etc. + +ENTRYPOINT [ "certbot" ] From eb1e3c4cb3c87d48563f80eb197fb06e817c4934 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 13:56:43 -0800 Subject: [PATCH 6/7] add docker-warning script --- tools/docker-warning.sh | 4 ++++ 1 file changed, 4 insertions(+) create mode 100755 tools/docker-warning.sh diff --git a/tools/docker-warning.sh b/tools/docker-warning.sh new file mode 100755 index 000000000..e4f5f40ee --- /dev/null +++ b/tools/docker-warning.sh @@ -0,0 +1,4 @@ +#!/bin/sh -e +echo "Warning: This Docker image will soon be switching to Alpine Linux." >&2 +echo "You can switch now using the certbot/certbot repo on Docker Hub." >&2 +exec /opt/certbot/venv/bin/certbot $@ From ca42e992228fc20ed88dfe3d2da5146c1e76b8a8 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Fri, 3 Mar 2017 13:57:03 -0800 Subject: [PATCH 7/7] add certbot wrapper to Dockerfile-old --- Dockerfile-old | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Dockerfile-old b/Dockerfile-old index d42b632d4..7bce82e0c 100644 --- a/Dockerfile-old +++ b/Dockerfile-old @@ -67,4 +67,9 @@ RUN /opt/certbot/venv/bin/python /opt/certbot/src/pipstrap.py && \ # this might also help in debugging: you can "docker run --entrypoint # bash" and investigate, apply patches, etc. +# set up certbot/letsencrypt wrapper to warn people about Dockerfile changes +COPY tools/docker-warning.sh /opt/certbot/bin/certbot +RUN ln -s /opt/certbot/bin/certbot /opt/certbot/bin/letsencrypt +ENV PATH /opt/certbot/bin:$PATH + ENTRYPOINT [ "certbot" ]