mirror of
https://github.com/krkn-chaos/krkn.git
synced 2026-08-25 09:27:36 +00:00
Paige Patton
55d8bf7062
Assisted By: Claude Code: Assisted By: Claude Code: Signed-off-by: Paige Patton <prubenda@redhat.com>
123 lines
4.9 KiB
Docker
123 lines
4.9 KiB
Docker
# Vulnerability Remediation (2026-06-30):
|
|
# - Go 1.26: Required by kubevirt go.work (>= 1.26.0); also used for oc, yq
|
|
# - oc release-5.1: Latest OpenShift CLI with newer dependencies
|
|
# - Fedora 45: Latest base image with updated system packages
|
|
# - yq v4.44.6: Compiled from source with Go 1.26
|
|
# - docker 7.0+: Native Unix socket support, allows requests>=2.32
|
|
# - Pinned Go modules: go-git v5.19.0, fulcio v1.8.5, sigstore v1.10.4
|
|
# - See requirements.txt and SECURITY.md for accepted risks
|
|
|
|
# oc build
|
|
FROM golang:1.26 AS oc-build
|
|
RUN apt-get update && apt-get install -y --no-install-recommends libkrb5-dev
|
|
WORKDIR /tmp
|
|
# oc build
|
|
RUN git clone --branch release-5.1 https://github.com/openshift/oc.git
|
|
WORKDIR /tmp/oc
|
|
RUN go mod edit -go 1.26 &&\
|
|
go mod edit -require github.com/go-git/go-git/v5@v5.19.0 &&\
|
|
go mod edit -require github.com/go-git/go-billy/v5@v5.9.0 &&\
|
|
go mod edit -require go.opentelemetry.io/otel@v1.41.0 &&\
|
|
go mod edit -require github.com/moby/spdystream@v0.5.1 &&\
|
|
go mod edit -require golang.org/x/net@v0.38.0 &&\
|
|
go mod edit -require github.com/Azure/go-ntlmssp@v0.1.1 &&\
|
|
go mod edit -require github.com/sigstore/fulcio@v1.8.5 &&\
|
|
go mod edit -require github.com/sigstore/sigstore@v1.10.4 &&\
|
|
go mod edit -replace golang.org/x/net=golang.org/x/net@v0.38.0 &&\
|
|
go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
|
|
go mod edit -replace github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 &&\
|
|
go mod edit -replace github.com/aws/aws-sdk-go-v2/service/s3=github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3 &&\
|
|
go mod tidy && \
|
|
rm -rf vendor && \
|
|
go mod vendor
|
|
|
|
RUN make GO_REQUIRED_MIN_VERSION:= oc
|
|
|
|
# virtctl build
|
|
WORKDIR /tmp
|
|
RUN git clone https://github.com/kubevirt/kubevirt.git
|
|
WORKDIR /tmp/kubevirt
|
|
RUN go mod edit -go 1.26 &&\
|
|
go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
|
|
go mod edit -replace github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream=github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8 &&\
|
|
go mod edit -replace github.com/aws/aws-sdk-go-v2/service/s3=github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3 &&\
|
|
go work edit -go 1.26 &&\
|
|
go mod tidy &&\
|
|
go work use &&\
|
|
go work vendor &&\
|
|
go build -o virtctl ./cmd/virtctl/
|
|
|
|
# yq build
|
|
WORKDIR /tmp
|
|
RUN git clone --depth 1 --branch v4.44.6 https://github.com/mikefarah/yq.git
|
|
WORKDIR /tmp/yq
|
|
RUN go mod edit -replace golang.org/x/net=golang.org/x/net@v0.38.0 &&\
|
|
go mod edit -replace github.com/moby/spdystream=github.com/moby/spdystream@v0.5.1 &&\
|
|
go mod tidy &&\
|
|
go build -ldflags="-s -w" .
|
|
|
|
FROM fedora:45
|
|
ARG PR_NUMBER
|
|
ARG TAG
|
|
ARG PYTHON_VERSION=3.11
|
|
ENV PYTHON_CMD=python${PYTHON_VERSION}
|
|
RUN groupadd -g 1001 krkn && useradd -m -u 1001 -g krkn krkn
|
|
RUN dnf update -y
|
|
|
|
ENV KUBECONFIG /home/krkn/.kube/config
|
|
|
|
|
|
# This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo
|
|
RUN dnf update && dnf install -y --setopt=install_weak_deps=False \
|
|
git python${PYTHON_VERSION} jq gettext wget which ipmitool openssh-server &&\
|
|
dnf clean all
|
|
|
|
# copy oc, virtctl, yq binaries from oc-build image
|
|
COPY --from=oc-build /tmp/oc/oc /usr/bin/oc
|
|
COPY --from=oc-build /tmp/kubevirt/virtctl /usr/bin/virtctl
|
|
COPY --from=oc-build /tmp/yq/yq /usr/bin/yq
|
|
RUN ln -s /usr/bin/oc /usr/bin/kubectl
|
|
|
|
# krkn build
|
|
RUN git clone https://github.com/krkn-chaos/krkn.git /home/krkn/kraken && \
|
|
mkdir -p /home/krkn/.kube
|
|
|
|
RUN mkdir -p /home/krkn/.ssh && \
|
|
chmod 700 /home/krkn/.ssh
|
|
|
|
WORKDIR /home/krkn/kraken
|
|
|
|
# default behaviour will be to build main
|
|
# if it is a PR trigger the PR itself will be checked out
|
|
RUN if [ -n "$PR_NUMBER" ]; then git fetch origin pull/${PR_NUMBER}/head:pr-${PR_NUMBER} && git checkout pr-${PR_NUMBER};fi
|
|
# if it is a TAG trigger checkout the tag
|
|
RUN if [ -n "$TAG" ]; then git checkout "$TAG";fi
|
|
|
|
RUN ${PYTHON_CMD} -m ensurepip --upgrade --default-pip
|
|
RUN ${PYTHON_CMD} -m pip install --upgrade pip setuptools==81.0.0
|
|
|
|
# removes the the vulnerable versions of setuptools and pip
|
|
RUN rm -rf "$(pip cache dir)"
|
|
RUN rm -rf /tmp/*
|
|
RUN rm -rf /usr/local/lib/${PYTHON_CMD}/ensurepip/_bundled
|
|
RUN ${PYTHON_CMD} -m pip install --no-build-isolation -r requirements.txt
|
|
RUN ${PYTHON_CMD} -m pip install jsonschema
|
|
# Force setuptools==81.0.0 after all deps (some may try to upgrade it to 82+)
|
|
RUN ${PYTHON_CMD} -m pip install --force-reinstall --no-deps setuptools==81.0.0
|
|
|
|
LABEL krknctl.title.global="Krkn Base Image"
|
|
LABEL krknctl.description.global="This is the krkn base image."
|
|
LABEL krknctl.input_fields.global='$KRKNCTL_INPUT'
|
|
|
|
# SSH setup script
|
|
RUN chmod +x /home/krkn/kraken/containers/setup-ssh.sh
|
|
|
|
# Main entrypoint script
|
|
RUN chmod +x /home/krkn/kraken/containers/entrypoint.sh
|
|
|
|
RUN chown -R krkn:krkn /home/krkn && chmod 755 /home/krkn
|
|
USER krkn
|
|
|
|
ENTRYPOINT ["/bin/bash", "/home/krkn/kraken/containers/entrypoint.sh"]
|
|
CMD ["--config=config/config.yaml"]
|