Skip to content

Commit ceb9725

Browse files
SamTV12345SamTV12345
committed
ARTEMIS-3042 Add docker multistage build
This adds the possibility to create an artemis image with just the docker build command. First the image is downloaded in an Eclipse Temurin installation and later transferred to an alpine image. Thus, it ensures that only the relevant data is stored in alpine leading to a smaller attack surface.
1 parent eb11b04 commit ceb9725

10 files changed

+515
-129
lines changed

‎artemis-docker/Dockerfile-alpine‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
# ActiveMQ Artemis
19+
20+
ARG CURRENT_VERSION=2.17.0
21+
22+
FROM eclipse-temurin:11-jdk as builder
23+
ARG CURRENT_VERSION
24+
25+
ENV VERSION=$CURRENT_VERSION
26+
27+
RUN apt update -y && apt upgrade -y && apt install curl -y
28+
29+
ADD ./prepare-docker.sh /bin/prepareDocker
30+
WORKDIR /root/artemis-build
31+
COPY docker-run.sh .
32+
RUN bash prepareDocker --from-release --artemis-version ${VERSION}
33+
34+
35+
FROM alpine:latest
36+
37+
ARG CURRENT_VERSION
38+
39+
ENV VERSION=$CURRENT_VERSION
40+
41+
RUN apk --no-cache add openjdk17-jre-headless bash libaio\
42+
--repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
43+
44+
45+
LABEL maintainer="Apache ActiveMQ Team"
46+
# Make sure pipes are considered to determine success, see: https://github.com/hadolint/hadolint/wiki/DL4006
47+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
48+
WORKDIR /opt
49+
50+
ENV ARTEMIS_USER artemis
51+
ENV ARTEMIS_PASSWORD artemis
52+
ENV ANONYMOUS_LOGIN false
53+
ENV EXTRA_ARGS --http-host 0.0.0.0 --relax-jolokia
54+
55+
# add user and group for artemis
56+
RUN addgroup -g 1001 artemis && adduser -u 1002 --ingroup artemis --disabled-password artemis
57+
58+
USER artemis
59+
60+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/ /opt/activemq-artemis
61+
62+
# Web Server
63+
EXPOSE 8161 \
64+
# JMX Exporter
65+
9404 \
66+
# Port for CORE,MQTT,AMQP,HORNETQ,STOMP,OPENWIRE
67+
61616 \
68+
# Port for HORNETQ,STOMP
69+
5445 \
70+
# Port for AMQP
71+
5672 \
72+
# Port for MQTT
73+
1883 \
74+
#Port for STOMP
75+
61613
76+
77+
USER root
78+
79+
RUN mkdir /var/lib/artemis-instance && chown -R artemis.artemis /var/lib/artemis-instance
80+
81+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/docker/docker-run.sh /
82+
83+
USER artemis
84+
85+
# Expose some outstanding folders
86+
VOLUME ["/var/lib/artemis-instance"]
87+
WORKDIR /var/lib/artemis-instance
88+
89+
ENTRYPOINT ["/docker-run.sh"]
90+
CMD ["run"]

‎artemis-docker/Dockerfile-alpine-build‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
# ActiveMQ Artemis
19+
20+
FROM maven:3-eclipse-temurin-11 as builder
21+
22+
23+
RUN apt update -y && apt upgrade -y && apt install curl -y
24+
25+
WORKDIR /root/artemis-build
26+
COPY /artemis-docker/docker-run.sh .
27+
COPY . .
28+
29+
RUN mvn -q clean install -DskipTests -DskipITs -DskipDocs -DskipDocker -DskipDoc
30+
31+
FROM alpine:latest
32+
33+
34+
RUN apk --no-cache add openjdk17-jre-headless bash libaio\
35+
--repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
36+
37+
38+
LABEL maintainer="Apache ActiveMQ Team"
39+
# Make sure pipes are considered to determine success, see: https://github.com/hadolint/hadolint/wiki/DL4006
40+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
41+
WORKDIR /opt
42+
43+
ENV ARTEMIS_USER artemis
44+
ENV ARTEMIS_PASSWORD artemis
45+
ENV ANONYMOUS_LOGIN false
46+
ENV EXTRA_ARGS --http-host 0.0.0.0 --relax-jolokia
47+
48+
# add user and group for artemis
49+
RUN addgroup -g 1001 artemis && adduser -u 1002 --ingroup artemis --disabled-password artemis
50+
51+
USER artemis
52+
53+
COPY --chown=artemis:artemis --from=builder /root/artemis-build/artemis-distribution/target/apache-artemis*-bin/*SNAPSHOT /opt/activemq-artemis/
54+
55+
# Web Server
56+
EXPOSE 8161 \
57+
# JMX Exporter
58+
9404 \
59+
# Port for CORE,MQTT,AMQP,HORNETQ,STOMP,OPENWIRE
60+
61616 \
61+
# Port for HORNETQ,STOMP
62+
5445 \
63+
# Port for AMQP
64+
5672 \
65+
# Port for MQTT
66+
1883 \
67+
#Port for STOMP
68+
61613
69+
70+
USER root
71+
72+
RUN mkdir /var/lib/artemis-instance && chown -R artemis.artemis /var/lib/artemis-instance
73+
74+
COPY --chown=artemis:artemis --from=builder /root/artemis-build/artemis-docker/docker-run.sh /var/lib/artemis-instance/docker-run.sh
75+
76+
USER artemis
77+
78+
# Expose some outstanding folders
79+
VOLUME ["/var/lib/artemis-instance"]
80+
WORKDIR /var/lib/artemis-instance
81+
82+
ENTRYPOINT ["./docker-run.sh"]
83+
CMD ["run"]

‎artemis-docker/Dockerfile-centos7-11‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,29 @@
1717

1818
# ActiveMQ Artemis
1919

20+
ARG CURRENT_VERSION=2.17.0
21+
22+
FROM eclipse-temurin:11-jdk as builder
23+
ARG CURRENT_VERSION
24+
25+
ENV VERSION=$CURRENT_VERSION
26+
27+
RUN apt update -y && apt upgrade -y && apt install curl -y
28+
29+
ADD ./prepare-docker.sh /bin/prepareDocker
30+
WORKDIR /root/artemis-build
31+
COPY docker-run.sh .
32+
RUN bash prepareDocker --from-release --artemis-version ${VERSION}
33+
2034
FROM eclipse-temurin:11-centos7
2135
LABEL maintainer="Apache ActiveMQ Team"
2236
# Make sure pipes are considered to determine success, see: https://github.com/hadolint/hadolint/wiki/DL4006
2337
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
2438
WORKDIR /opt
2539

40+
ARG CURRENT_VERSION
41+
42+
ENV VERSION=$CURRENT_VERSION
2643
ENV ARTEMIS_USER artemis
2744
ENV ARTEMIS_PASSWORD artemis
2845
ENV ANONYMOUS_LOGIN false
@@ -36,7 +53,7 @@ RUN groupadd -g 1001 -r artemis && useradd -r -u 1001 -g artemis artemis \
3653

3754
USER artemis
3855

39-
ADD . /opt/activemq-artemis
56+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/ /opt/activemq-artemis
4057

4158
# Web Server
4259
EXPOSE 8161 \
@@ -57,7 +74,7 @@ USER root
5774

5875
RUN mkdir /var/lib/artemis-instance && chown -R artemis.artemis /var/lib/artemis-instance
5976

60-
COPY ./docker/docker-run.sh /
77+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/docker/docker-run.sh /
6178

6279
USER artemis
6380

‎artemis-docker/Dockerfile-centos7-11-build‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
# ActiveMQ Artemis
19+
20+
FROM maven:3-eclipse-temurin-11 as builder
21+
22+
RUN apt update -y && apt upgrade -y && apt install curl -y
23+
24+
WORKDIR /root/artemis-build
25+
COPY /artemis-docker/docker-run.sh .
26+
COPY . .
27+
28+
RUN mvn -q clean install -DskipTests -DskipITs -DskipDocs -DskipDocker -DskipDoc
29+
30+
FROM eclipse-temurin:11-centos7
31+
LABEL maintainer="Apache ActiveMQ Team"
32+
# Make sure pipes are considered to determine success, see: https://github.com/hadolint/hadolint/wiki/DL4006
33+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
34+
WORKDIR /opt
35+
36+
ENV ARTEMIS_USER artemis
37+
ENV ARTEMIS_PASSWORD artemis
38+
ENV ANONYMOUS_LOGIN false
39+
ENV EXTRA_ARGS --http-host 0.0.0.0 --relax-jolokia
40+
41+
USER root
42+
43+
# add user and group for artemis
44+
RUN groupadd -g 1001 -r artemis && useradd -r -u 1001 -g artemis artemis \
45+
&& yum install -y libaio && yum -y clean all
46+
47+
USER artemis
48+
49+
COPY --chown=artemis:artemis --from=builder /root/artemis-build/artemis-distribution/target/apache-artemis*-bin/*SNAPSHOT /opt/activemq-artemis/
50+
51+
# Web Server
52+
EXPOSE 8161 \
53+
# JMX Exporter
54+
9404 \
55+
# Port for CORE,MQTT,AMQP,HORNETQ,STOMP,OPENWIRE
56+
61616 \
57+
# Port for HORNETQ,STOMP
58+
5445 \
59+
# Port for AMQP
60+
5672 \
61+
# Port for MQTT
62+
1883 \
63+
#Port for STOMP
64+
61613
65+
66+
USER root
67+
68+
RUN mkdir /var/lib/artemis-instance && chown -R artemis.artemis /var/lib/artemis-instance
69+
70+
COPY --chown=artemis:artemis --from=builder /root/artemis-build/artemis-docker/docker-run.sh /var/lib/artemis-instance/docker-run.sh
71+
72+
USER artemis
73+
74+
# Expose some outstanding folders
75+
VOLUME ["/var/lib/artemis-instance"]
76+
WORKDIR /var/lib/artemis-instance
77+
78+
ENTRYPOINT ["./docker-run.sh"]
79+
CMD ["run"]

‎artemis-docker/Dockerfile-ubuntu-11‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,27 @@
1717

1818
# ActiveMQ Artemis
1919

20+
ARG CURRENT_VERSION=2.17.0
21+
22+
FROM eclipse-temurin:11-jdk as builder
23+
ARG CURRENT_VERSION
24+
25+
ENV VERSION=$CURRENT_VERSION
26+
27+
RUN apt update -y && apt upgrade -y && apt install curl -y
28+
29+
ADD ./prepare-docker.sh /bin/prepareDocker
30+
WORKDIR /root/artemis-build
31+
COPY docker-run.sh .
32+
RUN bash prepareDocker --from-release --artemis-version ${VERSION}
33+
2034
FROM eclipse-temurin:11
2135
LABEL maintainer="Apache ActiveMQ Team"
36+
37+
ARG CURRENT_VERSION
38+
39+
ENV VERSION=$CURRENT_VERSION
40+
2241
# Make sure pipes are considered to determine success, see: https://github.com/hadolint/hadolint/wiki/DL4006
2342
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
2443
WORKDIR /opt
@@ -36,7 +55,8 @@ RUN groupadd -g 1001 -r artemis && useradd -r -u 1001 -g artemis artemis \
3655

3756
USER artemis
3857

39-
ADD . /opt/activemq-artemis
58+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/ /opt/activemq-artemis
59+
4060

4161
# Web Server
4262
EXPOSE 8161 \
@@ -57,7 +77,8 @@ USER root
5777

5878
RUN mkdir /var/lib/artemis-instance && chown -R artemis.artemis /var/lib/artemis-instance
5979

60-
COPY ./docker/docker-run.sh /
80+
COPY --from=builder /root/artemis-build/_TMP_/artemis/${VERSION}/docker/docker-run.sh /
81+
6182

6283
USER artemis
6384

0 commit comments

Comments
 (0)