Skip to content
This repository has been archived by the owner on Apr 17, 2023. It is now read-only.

2.3.0
Compare
Choose a tag to compare
@mssola mssola released this 02 Mar 14:18
· 540 commits to master since this release
2.3.0
This tag was signed with the committer’s verified signature.
mssola Miquel Sabaté Solà
GPG key ID: 96BE8C6FD89D6565
Learn about vigilant mode.
6c05971

Highlight

Security scanning

Portus is now able to scan security vulnerabilities on your Docker images. This is done with different backends, where the stable one is CoreOS Clair. You have to enable the desired backends and then Portus will use them to fetch known security vulnerabilities for your images.

Note: this version of Portus supports Clair v2 specifically (current master branch is not supported).

You can read the blog post for more info.

Commits: 4cd875c2aa9f, d3454cfb84f3, f19094b98737.

Background process

One of the main issues for Portus was that sometimes it took too long to complete certain critical tasks. For this release we have moved these tasks into a separate background process. This background process resides in the bin/background.rb file, and it can be enabled for containerized deployments by setting the PORTUS_BACKGROUND environment variable to true.

The following tasks have been moved into this new process:

  • Security scanning: after testing security scanning more in depth, we noticed that sometimes it could block Portus when showing the main page for repositories. This was the first task moved into this new process. Commit: e0f7d53cb2b2.
  • Registry events: before creating this process, we dealt with incoming registry events in the main Portus process. The problem with this was that after getting a push event, for example, Portus had to fetch manifests, which could take quite some time. This meant that Portus got blocked in some deployments. Now Portus will simply log the event, and then the background process will process it right away (by default this process will check for events every 2 seconds). This task can be disabled as documented here. Commit: 6a4f7d7dca60.
  • Registry synchronization: we have removed the crono process in favor of this new process. Hence, the code that was executed in previous releases by crono has been merged as another task of this new process. Moreover, since it can be quite dangerous, we have added some configuration options: it can be disabled; and it can be tuned with a strategy (from a riskier approach to a safer one). All this has been documented in its documentation page. Commit: ced9b46a9064.

Note on deployment: this new background process has to have access to the same database as the main Portus process.

Anonymous browsing

Portus will now allow anonymous users to search for public images. This is a configurable option which is enabled by default. You can read more about this in the documentation.

Commits: 274c0908a83c, 9d6cc25fd0b4.

OAuth & OpenID Connect support

Portus' authentication logic has been extended to allow OAuth & OpenID Connect. For OAuth you are allowed to login through the following adapters: Google, Github, Gitlab and Bitbucket. Check the config/config.yml file for more info on the exact configurable options.

Commit: 0a5fefdd14d9.

Thanks a lot to Vadim Bauer (@Vad1mo) and Andrei Kislichenko (@andrew2net) for working on this!

API

An effort to design and implement an API for Portus has been started. This is useful for CLI tools like portusctl among other user cases. We do not consider the API to be in a stable state, but it is useful already. We will continue this effort in forthcoming releases. Commits: 2129833f27f0, 28f77d3352ea, 5a9437bba42d, 451e508bd86a, 185f18e98638, a9bdab58d150, 8b42887f83a5, fbe7e8d4ef53, 4a79f222f93b, fbe7e8d4ef53.

Thanks a lot to Vadim Bauer (@Vad1mo) and Andrei Kislichenko (@andrew2net) for working on this!

Puma

The deployment of Portus has been simplified as much as possible. For this reason we have removed a lot of clutter on our official Docker image, and we have embraced best practices for deploying Ruby on Rails applications. For this reason we have set Puma as the web server for Portus.

Commits: 09b722f56221, 9fd61ba7bae0, 6a3b8ca74edb, 2488791f8f54.

Production deployment examples

We provide in the source code examples that illustrate how Portus is intended to be deployed on production. These examples reside in the examples directory. Some observations:

  • As stated above, set the PORTUS_BACKGROUND environment variable to true for the background process.
  • You can set RAILS_SERVE_STATIC_FILES to true if you want Portus to serve the assets directly (e.g. if you don't want a load-balancer like NGinx or HAproxy to do this).
  • Use the new PORTUS_DB_ environment variable prefix instead of the old PORTUS_PRODUCTION_ one for database options. Moreover, in the database you can now specify more options like PORTUS_DB_POOL for stating the DB pool.
  • Portus will complain if you provide old environment variables like PORTUS_PRODUCTION_DATABASE, or if you forgot to specify some relevant environment variables for production like PORTUS_MACHINE_FQDN_VALUE. Commit: 06a405c4f5fd.

Commit: ba7b15ed42d0.

Helm Chart

An official Helm Chart for deploying Portus in a Kubernetes cluster is being developed. It is expected to be released soon after this release.

PostgreSQL support

Some tools like CoreOS Clair require PostgreSQL as their database. When developing support for security scanning we noticed that it was quite redundant to have two different databases running. For this reason, we have added PostgreSQL support, so you can use PostgreSQL for both Portus and Clair.

Commit: af1b8b6ca725.

Upgrade to Ruby 2.5

Some features required an upgrade of Ruby. Since SLE 15 and Tumbleweed will most likely have Ruby 2.5 as their default version, we have anticipated this move. So, now Portus is supported for Ruby 2.5. If you try to run Portus on previous versions, it will error out during initialization (commit: ea02cab5c822).

Commits: a2407506ff5c, d86d46c9313c, 46a5a34fda40.

Improvements and small features

Fixes

  • Add core-js pollyfills, so internet access is not needed. Commit: 02cf5212a28c.
  • Fixed performance problems on the activities page. Commit: b5fd93bd9486.
  • Fixed table pagination. Commit: f05aad9e6183.
  • Fixed some issues on activities. Commit: db553f8d0bcc.
  • Honor external_hostname in token generation. Commit: 802bb89b0ec4.
  • Fixed Vagrant setup. Commit: 6ca35b1bc2e7.
  • Read the TZ env variable to display dates correctly. Commit: e2eed1463aaa.
  • LDAP: avoid clashes on emails. Commit: 1a57f0f7f95b.
  • Fixed icons spacing/positioning. Commit: ab34bf9ebc5b.
  • Fixed team name validation behavior. Commit: 86e72f88b20f.
  • Fixed a render error on the search/index page. Commit: d12306daa47b.
  • Fixed the namespace and team name clashes. Commit: eec31da471a7.
  • Properly check SSL requirements. Commit: a86ec03923f8.
  • Fixed tag name uniqueness validation. Commit: 83478b1911b0.
  • Fixed crash on null author of a tag. Commit: 7f84fbc60307.
  • Update tags by digest when scanning. Commit: 46065607fbc1.
  • Fixed crash when vulnerabilities were not found. Commit: a904cef41cb2.
  • Added some checks on mailer configuration to avoid crashes later on. Commit: c3ba1b50ca31.
  • Catch exceptions on password resets creation. Commit: 9d2ba4748693.
  • Registry Client should probe that the /v2/ path reachable and that we accept 200 responses as well. Commit: 2b0bf59a2601.
  • Upgraded jQuery to 3.x to avoid security issues. Commit: 0505c177f5d2.

CVE

This release includes a fix for CVE-2017-14621. Thanks a lot Ricardo Sánchez for reporting this security issue! Commit: c21dfec24cfc.

Development

Upgrading

In this section we want to detail some things that you might want to take into account when upgrading to 2.3:

  • As explained above, Puma is now the HTTP server being used. Make sure to use the PORTUS_PUMA_TLS_KEY and the PORTUS_PUMA_TLS_CERT environment variables to point puma to the right paths for the certificates. Moreover, if you are not using the official Docker image, you will have to use the PORTUS_PUMA_HOST environment variable to tell Puma where to bind itself (in containerized deployments it will bind by default to 0.0.0.0:3000).
  • The database environment variables have changed the prefix from PORTUS_PRODUCTION_ to PORTUS_DB_. Moreover, you will be able now to provide values for the following items: adapter (set it to postgresql for PostgreSQL support), port, pool and timeout. All these values are prefixed by PORTUS_DB_ as well, so for example, to provide a value for the pool you need to set PORTUS_DB_POOL.

Finally, we are not running migrations automatically anymore as we used to do before. This is now to be done by the administrator by executing (on the Portus context in /srv/Portus or simply as part of a docker exec command):

$ portusctl exec rake db:migrate

For more details on this check the commits 7fdfe9634180 and 1c4d2b6cf0e0.

Deprecations

Some configuration options that were soft-deprecated in 2.2 will now raise a DeprecationError. These are:

  • The expiration time of the JWT token can no longer be expressed as a string with a format: x.minutes. You have to provide now an integer representing the minutes for the jwt_expiration_time configurable option. Users that have not touched this option since the 2.1 times will have to change this.
  • The jwt_expiration_time option was moved to registry.jwt_expiration_time in 2.2. Now, if you continue to provide the former rather than the latter, you'll get a DeprecationError exception.

Besides this, Portus will also raise a DeprecationError during initialization in the case you provided the prefix PORTUS_PRODUCTION_ for database configurable options instead of PORTUS_DB_.

Finally, portusctl as provided by Portus is getting deprecated in favor of openSUSE/portusctl. This new portusctl has been built from scratch for the following reasons:

  • Since 2.3 our main focus is the support containerized deployments. Therefore, portusctl's main task to setup the installation didn't make sense anymore.
  • Moreover, from experience we noticed lots of corner cases where the old portusctl was simply not effective.
  • With the introduction of the API, we wanted to re-purpose the tool to be more similar to tools like kubectl for Kubernetes. That is, a CLI interface to the API that administrators can use with ease.

Packaging

Lots of issues regarding packaging were fixed. We want to highlight the following commits:

  • Do not touch the Gemfile anymore. Commit: bd383fba329b.
  • Change how we build dependencies. Commit: 0970b9903af5.
  • Added bundled JS dependencies in the spec file. Commit: f08803be6fbc.
  • Added a script to compare the gems on git and OBS. Commit: 291d172c12e3.

Contributors for this release

Alexander Block, banuchka, Ben Rexin, Diokuz, Fabian Baumanis, Hart Simha, James Maidment, Jordi Massaguer Pla, Lefnui, Maik Hinrichs, Maximilian Meister, Miquel Sabaté Solà, Ricardo Mateus, Robin Müller, Saurabh Surana, Shammah Chancellor, Soedarsono, Thorsten Schifferdecker, Vadim Bauer, Vítor Avelino.

... and many thanks to everyone that has contributed to Portus by leaving comments, sending emails, submitting issues, providing feedback, etc. Thanks!

Assets 2
Loading