mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
coder-tasks[bot]
818fc72802
Updates the IronBank Dockerfile base image from UBI8-minimal 8.7 to UBI9-minimal 9.6 and removes `python3-urllib3` (which ships urllib3 1.26.5) to address CVE-2026-44431. Coder is a Go binary and does not use Python at runtime; the package is safe to remove. Also updates `build_ironbank.sh` to match the new base image references. Fixes https://linear.app/codercom/issue/ENT-50 > [!NOTE] > This PR was authored by Coder Agents. <details><summary>Context</summary> Mirrors the same fix applied on `release/2.29` (`fix/ironbank-urllib3-v2.29`) and `release/2.30` (`fix/ironbank-urllib3-v2.30`). </details> Co-authored-by: doc-check[bot] <doc-check[bot]@users.noreply.github.com>
99 lines
4.4 KiB
Docker
99 lines
4.4 KiB
Docker
ARG BASE_REGISTRY=registry1.dso.mil
|
|
ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9-minimal
|
|
ARG BASE_TAG=9.6
|
|
|
|
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
|
|
|
|
SHELL ["/bin/bash", "-c"]
|
|
|
|
ENV LANG=en_US.UTF-8
|
|
|
|
RUN microdnf update --assumeyes && \
|
|
microdnf install --assumeyes \
|
|
ca-certificates \
|
|
git \
|
|
gzip \
|
|
shadow-utils \
|
|
tar \
|
|
unzip && \
|
|
# Remove python3-urllib3 if present to address CVE-2026-44431.
|
|
# Coder is a Go binary and does not use Python at runtime.
|
|
microdnf remove --assumeyes python3-urllib3 2>/dev/null || true && \
|
|
microdnf clean all
|
|
|
|
# Configure the cryptography policy manually. These policies likely
|
|
# have no impact, since Go doesn't link against these libraries.
|
|
#
|
|
# Normally, one uses the update-crypto-policies script to create these
|
|
# links, which is included in the crypto-policies-scripts package, but
|
|
# that pulls in Python, so we create the links manually here. This
|
|
# list of links comes from running strace on the update-crypto-policies
|
|
# script (strace update-crypto-policies --set FIPS) in Fedora, since
|
|
# RHEL and UBI do not provide an strace package by default.
|
|
RUN echo "FIPS" >/etc/crypto-policies/config && \
|
|
cp --force /usr/share/crypto-policies/policies/FIPS.pol /etc/crypto-policies/state/CURRENT.pol && \
|
|
echo "FIPS" >/etc/crypto-policies/state/current && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/bind.txt /etc/crypto-policies/back-ends/bind.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/gnutls.txt /etc/crypto-policies/back-ends/gnutls.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/java.txt /etc/crypto-policies/back-ends/java.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/krb5.txt /etc/crypto-policies/back-ends/krb5.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/libreswan.txt /etc/crypto-policies/back-ends/libreswan.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/libssh.txt /etc/crypto-policies/back-ends/libssh.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/nss.txt /etc/crypto-policies/back-ends/nss.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/openssh.txt /etc/crypto-policies/back-ends/openssh.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/opensshserver.txt /etc/crypto-policies/back-ends/opensshserver.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/openssl.txt /etc/crypto-policies/back-ends/openssl.config && \
|
|
ln --symbolic --force /usr/share/crypto-policies/FIPS/opensslcnf.txt /etc/crypto-policies/back-ends/opensslcnf.config
|
|
|
|
# Copy and extract Coder binary from tar file. We have to put this in /opt to
|
|
# match the Dockerfile.
|
|
ARG CODER_BIN=/opt/coder
|
|
ARG CODER_BIN_TAR_GZ=coder.tar.gz
|
|
COPY "$CODER_BIN_TAR_GZ" /tmp/coder.tar.gz
|
|
RUN mkdir -p /opt && \
|
|
tar -xzvf /tmp/coder.tar.gz --directory /opt --strip-components=1 ./coder && \
|
|
rm /tmp/coder.tar.gz
|
|
ENV PATH="/opt:${PATH}"
|
|
|
|
# Copy and extract Terraform binary from zip file.
|
|
ARG TERRAFORM_BIN_DIR=/opt/terraform
|
|
ARG TERRAFORM_BIN_ZIP=terraform.zip
|
|
COPY "$TERRAFORM_BIN_ZIP" /tmp/terraform.zip
|
|
RUN mkdir -p "$TERRAFORM_BIN_DIR" && \
|
|
unzip /tmp/terraform.zip -d "$TERRAFORM_BIN_DIR" && \
|
|
rm /tmp/terraform.zip
|
|
ENV PATH="${TERRAFORM_BIN_DIR}:${PATH}"
|
|
|
|
# Install the Coder Terraform provider to a well-known location.
|
|
ARG TERRAFORM_PLUGINS_DIR=/opt/terraform/plugins
|
|
ARG TERRAFORM_CODER_PROVIDER_VERSION
|
|
ARG TERRAFORM_CODER_PROVIDER_ZIP=terraform-provider-coder.zip
|
|
COPY "$TERRAFORM_CODER_PROVIDER_ZIP" "${TERRAFORM_PLUGINS_DIR}/registry.terraform.io/coder/coder/terraform-provider-coder_${TERRAFORM_CODER_PROVIDER_VERSION}_linux_amd64.zip"
|
|
|
|
# Configure Terraform to use plugins from this dir.
|
|
COPY terraform-filesystem-mirror.tfrc /opt/terraform/config.tfrc
|
|
ENV TF_CLI_CONFIG_FILE=/opt/terraform/config.tfrc
|
|
|
|
# Uninstall the build dependencies.
|
|
RUN microdnf remove --assumeyes \
|
|
tar \
|
|
unzip && \
|
|
microdnf clean all
|
|
|
|
# Transfer ownership of the binaries to the 'coder' user.
|
|
RUN useradd coder \
|
|
--create-home \
|
|
--shell=/bin/bash \
|
|
--uid=1000 \
|
|
--user-group && \
|
|
chown --recursive --quiet coder:coder "$CODER_BIN" && \
|
|
chown --recursive --quiet coder:coder "$TERRAFORM_BIN_DIR" && \
|
|
chown --recursive --quiet coder:coder "$TERRAFORM_PLUGINS_DIR" && \
|
|
chmod 0755 /home/coder
|
|
|
|
USER 1000
|
|
ENV HOME /home/coder
|
|
ENV USER=coder
|
|
|
|
ENTRYPOINT [ "/opt/coder", "server" ]
|