Skip to content

Commit 12778bd

Browse files
badal773pawan-59Badal Kumar Prusty
authored
misc: update sample dockerfiles use non-root user (UID 2002) and base images (#6512)
* updated golang version to 1.23 * updated go sample dockerfile * modified versions to java-21 LTS * modified versions to node v22.14.0 LTS * modified versions to node v22.14.0 LTS * updated base images versions * update Dockerfile for non-root user and update latest stable * update dockerfile and nginx.conf * added dockerfile for react * refactor * refactor * refactor * refactor * resolved all review points * wip --------- Co-authored-by: pawan-59 <[email protected]> Co-authored-by: Badal Kumar Prusty <[email protected]>
1 parent 2643db0 commit 12778bd

25 files changed

+496
-350
lines changed

‎sample-docker-templates/django/Dockerfile‎

Lines changed: 30 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,47 @@
1-
# Dockerfile
1+
# Base Image - slim Python
2+
FROM python:3.13-slim
23

3-
# Base Image
4-
FROM python:3.8
4+
# Environment settings
5+
ENV PYTHONUNBUFFERED=1 LANG=C.UTF-8
56

6-
# set default environment variables
7-
ENV PYTHONUNBUFFERED 1
8-
ENV LANG C.UTF-8
9-
10-
# to take runtime arguments and set env variables
7+
# Django superuser build args
118
ARG DJANGO_SUPERUSER_USERNAME
12-
ENV DJANGO_SUPERUSER_USERNAME=${DJANGO_SUPERUSER_USERNAME}
13-
149
ARG DJANGO_SUPERUSER_PASSWORD
15-
ENV DJANGO_SUPERUSER_PASSWORD=${DJANGO_SUPERUSER_PASSWORD}
16-
1710
ARG DJANGO_SUPERUSER_EMAIL
11+
ENV DJANGO_SUPERUSER_USERNAME=${DJANGO_SUPERUSER_USERNAME}
12+
ENV DJANGO_SUPERUSER_PASSWORD=${DJANGO_SUPERUSER_PASSWORD}
1813
ENV DJANGO_SUPERUSER_EMAIL=${DJANGO_SUPERUSER_EMAIL}
1914

20-
# create and set working directory
21-
RUN mkdir /app
15+
# Set workdir
2216
WORKDIR /app
2317

24-
RUN chown -R www-data:www-data /app
25-
26-
# Add current directory code to working directory
27-
COPY . /app/
28-
29-
# install environment dependencies
30-
RUN pip install -r requirements.txt
31-
32-
# install nginx
33-
RUN apt-get update && apt-get install nginx vim -y --no-install-recommends
18+
# Install system dependencies and nginx, then install Python deps
19+
COPY requirements.txt .
20+
RUN apt-get update && \
21+
apt-get install -y --no-install-recommends nginx vim && \
22+
pip install --no-cache-dir -r requirements.txt && \
23+
rm -rf /var/lib/apt/lists/*
3424

35-
#Refer https://github.com/devtron-labs/devtron/blob/main/sample-docker-templates/django/nginx.default for sample nginx.default file
36-
COPY nginx.default /etc/nginx/sites-available/default
25+
# Copy app code, nginx.conf, and start script
26+
COPY app/ ./
27+
COPY nginx.conf /etc/nginx/nginx.conf
28+
RUN chmod +x start-server.sh
3729

38-
RUN ln -sf /dev/stdout /var/log/nginx/access.log \
39-
&& ln -sf /dev/stderr /var/log/nginx/error.log
30+
# Create non-root user and set permissions
31+
RUN groupadd -g 2002 nonroot && \
32+
useradd -u 2002 -g nonroot -s /bin/bash -m nonroot && \
33+
mkdir -p /tmp/nginx-logs && \
34+
chown -R nonroot:nonroot /app /tmp/nginx-logs
4035

36+
# Expose port 8080
37+
EXPOSE 8080
4138

42-
# start server
43-
EXPOSE 8000
39+
# Switch to non-root
40+
USER nonroot
4441

42+
# Stop signal for graceful shutdown
43+
# https://docs.docker.com/reference/dockerfile/#stopsignal
4544
STOPSIGNAL SIGTERM
4645

47-
# Refer https://github.com/devtron-labs/devtron/blob/main/sample-docker-templates/django/start-server.sh for sample start-server.sh file
46+
# Start server (migrations, superuser, gunicorn, nginx)
4847
CMD ["/app/start-server.sh"]

‎sample-docker-templates/django/nginx.conf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
worker_processes auto;
2+
error_log /tmp/nginx-logs/error.log warn;
3+
pid /tmp/nginx-logs/nginx.pid;
4+
5+
events {
6+
worker_connections 1024;
7+
}
8+
9+
http {
10+
include mime.types;
11+
default_type application/octet-stream;
12+
13+
access_log /tmp/nginx-logs/access.log;
14+
15+
client_body_temp_path /tmp/nginx-logs/client_temp;
16+
proxy_temp_path /tmp/nginx-logs/proxy_temp;
17+
fastcgi_temp_path /tmp/nginx-logs/fastcgi_temp;
18+
uwsgi_temp_path /tmp/nginx-logs/uwsgi_temp;
19+
scgi_temp_path /tmp/nginx-logs/scgi_temp;
20+
21+
server {
22+
listen 8080;
23+
server_name localhost;
24+
25+
location / {
26+
proxy_pass http://127.0.0.1:8000;
27+
proxy_set_header Host $host;
28+
proxy_set_header X-Real-IP $remote_addr;
29+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
30+
}
31+
32+
location /static/ {
33+
root /app;
34+
}
35+
}
36+
}

‎sample-docker-templates/django/nginx.default‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎sample-docker-templates/django/start-server.sh‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,13 @@
1-
#!/usr/bin/env bash
2-
#
3-
# Copyright (c) 2024. Devtron Inc.
4-
#
5-
# Licensed under the Apache License, Version 2.0 (the "License");
6-
# you may not use this file except in compliance with the License.
7-
# You may obtain a copy of the License at
8-
#
9-
# http://www.apache.org/licenses/LICENSE-2.0
10-
#
11-
# Unless required by applicable law or agreed to in writing, software
12-
# distributed under the License is distributed on an "AS IS" BASIS,
13-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14-
# See the License for the specific language governing permissions and
15-
# limitations under the License.
16-
#
1+
#!/bin/sh
172

18-
# start-server.sh
19-
python manage.py migrate
20-
python manage.py createsuperuser --no-input
3+
# Apply DB migrations
4+
python /app/manage.py migrate
215

22-
(gunicorn DjangoApp.wsgi --user www-data --bind 0.0.0.0:8000 --workers 3) && nginx -g "daemon off;"
6+
# create superuser
7+
python /app/manage.py createsuperuser --no-input
8+
9+
# Start gunicorn as non-root user binding on port 8000
10+
gunicorn demo-project.wsgi:application --user nonroot --bind 0.0.0.0:8000 --workers 3 &
11+
12+
# Start nginx (already configured to run without root)
13+
nginx -g "daemon off;"

‎sample-docker-templates/flask/Dockerfile‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,40 @@
1-
#Base Image
2-
FROM python:3.8
1+
# Base Image - slim Python
2+
FROM python:3.13-slim
33

4-
#Getting System Ready to install dependencies
5-
RUN apt-get clean \
6-
&& apt-get -y update
4+
# Environment settings
5+
ENV PYTHONUNBUFFERED=1 LANG=C.UTF-8
76

8-
#Installing nginx
9-
RUN apt-get -y install nginx \
10-
&& apt-get -y install python3-dev \
11-
&& apt-get -y install build-essential
12-
13-
#Creating symbolic link for access and error log from nginx
14-
RUN ln -sf /dev/stdout /var/log/nginx/access.log \
15-
&& ln -sf /dev/stderr /var/log/nginx/error.log
7+
# Set workdir
8+
WORKDIR /app
169

17-
#Creating a dir in Container
18-
RUN mkdir /app
10+
COPY requirements.txt requirements.txt
1911

20-
#Moving into the directory created
21-
WORKDIR /app
12+
# Install system dependencies and nginx, then install Python deps
13+
RUN apt-get update && \
14+
apt-get install -y --no-install-recommends nginx gcc python3-dev musl-dev build-essential libexpat1 && \
15+
pip install --no-cache-dir -r requirements.txt && \
16+
apt-get purge -y --auto-remove gcc python3-dev musl-dev build-essential && \
17+
rm -rf /var/lib/apt/lists/*
2218

23-
#Changing ownership of files in /app
24-
RUN chown -R www-data:www-data /app
19+
# Copy app code, configs, and start script
20+
COPY nginx.conf /etc/nginx/nginx.conf
21+
COPY app.py uwsgi.ini start.sh ./
22+
RUN chmod +x start.sh
2523

26-
#Adding the complete project in dir created
27-
ADD . /app/
24+
# Create non-root user and set permissions
25+
RUN groupadd -g 2002 nonroot && \
26+
useradd -u 2002 -g nonroot -s /bin/bash -m nonroot && \
27+
mkdir -p /tmp/nginx-logs && \
28+
chown -R nonroot:nonroot /app /tmp/nginx-logs
2829

29-
#Installing dependencies
30-
RUN pip3 install -r requirements.txt
30+
# Expose port 8080
31+
EXPOSE 8080
3132

32-
# Refer https://raw.githubusercontent.com/devtron-labs/devtron/main/sample-docker-templates/flask/nginx.default for sample nginx.default file
33-
COPY nginx.default /etc/nginx/sites-available/default
33+
# Switch to non-root
34+
USER nonroot
3435

35-
#Refer https://raw.githubusercontent.com/devtron-labs/devtron/main/sample-docker-templates/flask/start.sh for sample start.sh file
36-
#Making start.sh executable
37-
RUN chmod +x ./start.sh
36+
# Stop signal for graceful shutdown
37+
STOPSIGNAL SIGTERM
3838

39-
CMD ["./start.sh"]
39+
# Start server (migrations, superuser, gunicorn, nginx)
40+
CMD ["/app/start.sh"]

‎sample-docker-templates/flask/nginx.conf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
worker_processes auto;
2+
error_log /tmp/nginx-logs/error.log warn;
3+
pid /tmp/nginx-logs/nginx.pid;
4+
5+
events {}
6+
7+
http {
8+
include /etc/nginx/mime.types;
9+
default_type application/octet-stream;
10+
11+
access_log /tmp/nginx-logs/access.log;
12+
13+
client_body_temp_path /tmp/nginx-logs/client_temp;
14+
proxy_temp_path /tmp/nginx-logs/proxy_temp;
15+
fastcgi_temp_path /tmp/nginx-logs/fastcgi_temp;
16+
uwsgi_temp_path /tmp/nginx-logs/uwsgi_temp;
17+
scgi_temp_path /tmp/nginx-logs/scgi_temp;
18+
19+
server {
20+
listen 8080;
21+
server_name localhost;
22+
23+
location / {
24+
proxy_pass http://127.0.0.1:5000;
25+
proxy_set_header Host $host;
26+
proxy_set_header X-Real-IP $remote_addr;
27+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
28+
proxy_set_header X-Forwarded-Proto $scheme;
29+
}
30+
31+
location /static/ {
32+
alias /app/static/;
33+
}
34+
}
35+
}

‎sample-docker-templates/flask/nginx.default‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎sample-docker-templates/flask/start.sh‎

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,7 @@
1-
#!/usr/bin/env bash
2-
#
3-
# Copyright (c) 2024. Devtron Inc.
4-
#
5-
# Licensed under the Apache License, Version 2.0 (the "License");
6-
# you may not use this file except in compliance with the License.
7-
# You may obtain a copy of the License at
8-
#
9-
# http://www.apache.org/licenses/LICENSE-2.0
10-
#
11-
# Unless required by applicable law or agreed to in writing, software
12-
# distributed under the License is distributed on an "AS IS" BASIS,
13-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14-
# See the License for the specific language governing permissions and
15-
# limitations under the License.
16-
#
17-
18-
service nginx start
19-
# Refer https://raw.githubusercontent.com/devtron-labs/devtron/main/sample-docker-templates/flask/uwsgi.ini for sample uwsgi.ini file
20-
uwsgi --ini uwsgi.ini
1+
#!/bin/sh
212

3+
# Start uWSGI in the background
4+
uwsgi --ini /app/uwsgi.ini &
225

6+
# Start Nginx in the foreground
7+
nginx -g "daemon off;"

‎sample-docker-templates/flask/uwsgi.ini‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,11 @@
11
[uwsgi]
22
module = app:app
3-
uid = www-data
4-
gid = www-data
53
master = true
64
processes = 5
75

8-
socket = /tmp/uwsgi.socket
9-
chmod-sock = 664
10-
vacuum = true
11-
12-
die-on-term = true
13-
6+
http = 127.0.0.1:5000
7+
uid = nonroot
8+
gid = nonroot
149

10+
vacuum = true
11+
die-on-term = true

0 commit comments

Comments
 (0)