Update alpine dockerfile to install Erlang and OpenSSL to /opt
This commit is contained in:
Luke Bakken
yosifkit
parent
fecac447f8
commit
daf0c85adf
|
|
@ -36,8 +36,8 @@ ENV OTP_VERSION 25.3.2.5
|
|||
ENV OTP_SOURCE_SHA256="1f899b4b1ef8569c08713b76bc54607a09503a1d188e6d61512036188cc356db"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -50,7 +50,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -92,11 +92,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -131,7 +131,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -154,7 +154,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -180,40 +180,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:3.18
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -241,11 +246,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.10.25
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -189,7 +189,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -225,8 +225,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.10.25
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
|
|
@ -36,8 +36,8 @@ ENV OTP_VERSION 25.3.2.5
|
|||
ENV OTP_SOURCE_SHA256="1f899b4b1ef8569c08713b76bc54607a09503a1d188e6d61512036188cc356db"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -50,7 +50,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -92,11 +92,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -131,7 +131,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -154,7 +154,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -180,40 +180,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:3.18
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -241,11 +246,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.11.21
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -189,7 +189,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -225,8 +225,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.11.21
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
|
|
@ -36,8 +36,8 @@ ENV OTP_VERSION 25.3.2.5
|
|||
ENV OTP_SOURCE_SHA256="1f899b4b1ef8569c08713b76bc54607a09503a1d188e6d61512036188cc356db"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -50,7 +50,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -92,11 +92,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -131,7 +131,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -154,7 +154,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -180,40 +180,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:3.18
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -241,11 +246,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.12.2
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -189,7 +189,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -225,8 +225,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.12.2
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
|
|
@ -36,8 +36,8 @@ ENV OTP_VERSION 26.0.2
|
|||
ENV OTP_SOURCE_SHA256="47853ea9230643a0a31004433f07a71c1b92d6e0094534f629e3b75dbc62f193"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -50,7 +50,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -92,11 +92,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -131,7 +131,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -154,7 +154,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -180,40 +180,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:3.18
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -241,11 +246,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.13.0-beta.4
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -189,7 +189,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -225,8 +225,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.13.0-beta.4
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
|
|
@ -36,8 +36,8 @@ ENV OTP_VERSION 25.3.2.5
|
|||
ENV OTP_SOURCE_SHA256="1f899b4b1ef8569c08713b76bc54607a09503a1d188e6d61512036188cc356db"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -50,7 +50,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -92,11 +92,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -131,7 +131,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -154,7 +154,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -180,40 +180,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:3.18
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -241,11 +246,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.9.29
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -189,7 +189,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -225,8 +225,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION 3.9.29
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
|
|
@ -70,8 +70,8 @@ ENV OTP_VERSION {{ .otp.version }}
|
|||
ENV OTP_SOURCE_SHA256="{{ .otp.sha256 }}"
|
||||
|
||||
# install openssl & erlang to a path that isn't auto-checked for libs to prevent accidental use by system packages
|
||||
ENV INSTALL_PATH_PREFIX='/usr/local/erlang'
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
|
||||
# Install dependencies required to build Erlang/OTP from source
|
||||
# https://erlang.org/doc/installation_guide/INSTALL.html
|
||||
|
|
@ -84,7 +84,7 @@ RUN set -eux; \
|
|||
\
|
||||
OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
|
||||
OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
|
||||
OPENSSL_CONFIG_DIR="$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Required by the crypto & ssl Erlang/OTP applications
|
||||
wget --output-document "$OPENSSL_PATH.tar.gz.asc" "$OPENSSL_SOURCE_URL.asc"; \
|
||||
|
|
@ -126,11 +126,11 @@ RUN set -eux; \
|
|||
./Configure \
|
||||
"$opensslMachine" \
|
||||
enable-fips \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--openssldir="$OPENSSL_CONFIG_DIR" \
|
||||
--libdir="$INSTALL_PATH_PREFIX/lib" \
|
||||
--libdir="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
-Wl,-rpath="$INSTALL_PATH_PREFIX/lib" \
|
||||
-Wl,-rpath="$OPENSSL_INSTALL_PATH_PREFIX/lib" \
|
||||
${opensslExtraConfig:-} \
|
||||
; \
|
||||
# Compile, install OpenSSL, verify that the command-line works & development headers are present
|
||||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -165,7 +165,7 @@ RUN set -eux; \
|
|||
export ERL_TOP="$OTP_PATH"; \
|
||||
export CFLAGS='-g -O2'; \
|
||||
# add -rpath to avoid conflicts between our OpenSSL's "libssl.so" and the libssl package by making sure "$INSTALL_PATH_PREFIX/lib" is searched first (but only for Erlang/OpenSSL to avoid issues with other tools using libssl; https://github.com/docker-library/rabbitmq/issues/364)
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$INSTALL_PATH_PREFIX/lib"; \
|
||||
export CFLAGS="$CFLAGS -Wl,-rpath=$OPENSSL_INSTALL_PATH_PREFIX/lib"; \
|
||||
hostArch="$(dpkg-architecture --query DEB_HOST_GNU_TYPE)"; \
|
||||
buildArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
dpkgArch="$(dpkg --print-architecture)"; dpkgArch="${dpkgArch##*-}"; \
|
||||
|
|
@ -175,7 +175,7 @@ RUN set -eux; \
|
|||
amd64 | arm64) jitFlag='--enable-jit' ;; \
|
||||
esac; \
|
||||
./configure \
|
||||
--prefix="$INSTALL_PATH_PREFIX" \
|
||||
--prefix="$ERLANG_INSTALL_PATH_PREFIX" \
|
||||
--host="$hostArch" \
|
||||
--build="$buildArch" \
|
||||
--disable-hipe \
|
||||
|
|
@ -188,7 +188,7 @@ RUN set -eux; \
|
|||
--enable-smp-support \
|
||||
--enable-threads \
|
||||
--with-microstate-accounting=extra \
|
||||
--with-ssl="$INSTALL_PATH_PREFIX" \
|
||||
--with-ssl="$OPENSSL_INSTALL_PATH_PREFIX" \
|
||||
--without-common_test \
|
||||
--without-debugger \
|
||||
--without-dialyzer \
|
||||
|
|
@ -214,40 +214,45 @@ RUN set -eux; \
|
|||
make install; \
|
||||
\
|
||||
# Remove unnecessary files
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name examples -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name src -exec rm -rf '{}' +; \
|
||||
find "$ERLANG_INSTALL_PATH_PREFIX/lib/erlang" -type d -name include -exec rm -rf '{}' +
|
||||
|
||||
# Check that Erlang/OTP crypto & ssl were compiled against OpenSSL correctly
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
RUN find $ERLANG_INSTALL_PATH_PREFIX -type f -name 'crypto.so' -exec ldd {} \; | awk '/libcrypto\.so/ { if (!index($3,ENVIRON["OPENSSL_INSTALL_PATH_PREFIX"])) exit 1 }'
|
||||
RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [crypto:supports(), ssl:versions()]), init:stop().'
|
||||
|
||||
FROM alpine:{{ .alpine.version }}
|
||||
|
||||
# INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
ENV INSTALL_PATH_PREFIX /usr/local/erlang
|
||||
COPY --from=erlang-builder "$INSTALL_PATH_PREFIX" "$INSTALL_PATH_PREFIX"
|
||||
ENV PATH="$INSTALL_PATH_PREFIX/bin:$PATH"
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
COPY --from=openssl-builder $OPENSSL_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX
|
||||
ENV PATH $ERLANG_INSTALL_PATH_PREFIX/bin:$OPENSSL_INSTALL_PATH_PREFIX/bin:$PATH
|
||||
|
||||
ENV RABBITMQ_DATA_DIR=/var/lib/rabbitmq
|
||||
ENV RABBITMQ_DATA_DIR /var/lib/rabbitmq
|
||||
|
||||
RUN set -eux; \
|
||||
# Configure OpenSSL to use system certs
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
ln -vsf /etc/ssl/certs /etc/ssl/private "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
|
||||
\
|
||||
# Ensure run-time dependencies are installed
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive $ERLANG_INSTALL_PATH_PREFIX $OPENSSL_INSTALL_PATH_PREFIX \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| grep -v '^$\|lib\(crypto\|ssl\)' \
|
||||
| awk 'system("test -e /usr/local/lib/" $1) == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-cache --virtual .otp-run-deps $runDeps; \
|
||||
\
|
||||
# Check that OpenSSL still works after copying from previous builder
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
sed -i.ORIG -e "/\.include.*fips/ s!.*!.include $OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf!" \
|
||||
-e '/# fips =/s/.*/fips = fips_sect/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/openssl.cnf"; \
|
||||
sed -i.ORIG -e '/^activate/s/^/#/' "$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl/fipsmodule.cnf"; \
|
||||
[ "$(command -v openssl)" = "$OPENSSL_INSTALL_PATH_PREFIX/bin/openssl" ]; \
|
||||
openssl version; \
|
||||
openssl version -d; \
|
||||
\
|
||||
|
|
@ -275,11 +280,11 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION {{ .version }}
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH=$RABBITMQ_HOME/sbin:$PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
||||
# Install RabbitMQ
|
||||
RUN set -eux; \
|
||||
|
|
|
|||
|
|
@ -141,7 +141,7 @@ RUN set -eux; \
|
|||
ln -sf /etc/ssl/certs /etc/ssl/private "$OPENSSL_CONFIG_DIR"
|
||||
|
||||
# smoke test
|
||||
RUN openssl version
|
||||
RUN $OPENSSL_INSTALL_PATH_PREFIX/bin/openssl version
|
||||
|
||||
FROM openssl-builder as erlang-builder
|
||||
|
||||
|
|
@ -223,7 +223,7 @@ RUN erl -noshell -eval 'ok = crypto:start(), ok = io:format("~p~n~n~p~n~n", [cry
|
|||
|
||||
FROM ubuntu:{{ .ubuntu.version }}
|
||||
|
||||
# ERLANG_INSTALL_PATH_PREFIX is in a different stage, so define it again
|
||||
# OPENSSL/ERLANG_INSTALL_PATH_PREFIX are defined in a different stage, so define them again
|
||||
ENV ERLANG_INSTALL_PATH_PREFIX /opt/erlang
|
||||
ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
|
||||
COPY --from=erlang-builder $ERLANG_INSTALL_PATH_PREFIX $ERLANG_INSTALL_PATH_PREFIX
|
||||
|
|
@ -259,8 +259,8 @@ RUN set -eux; \
|
|||
# Use the latest stable RabbitMQ release (https://www.rabbitmq.com/download.html)
|
||||
ENV RABBITMQ_VERSION {{ .version }}
|
||||
# https://www.rabbitmq.com/signatures.html#importing-gpg
|
||||
ENV RABBITMQ_PGP_KEY_ID="0x0A9AF2115F4687BD29803A206B73A36E6026DFCA"
|
||||
ENV RABBITMQ_HOME=/opt/rabbitmq
|
||||
ENV RABBITMQ_PGP_KEY_ID 0x0A9AF2115F4687BD29803A206B73A36E6026DFCA
|
||||
ENV RABBITMQ_HOME /opt/rabbitmq
|
||||
|
||||
# Add RabbitMQ to PATH
|
||||
ENV PATH $RABBITMQ_HOME/sbin:$PATH
|
||||
|
|
|
|||
Loading…
Reference in New Issue