Skip to content

Commit bcffe32

Browse files
longsleeplongsleep
committedAug 10, 2016
Add Dockerfiles to build minimal Docker
To reduce the Docker image size a seperate build Dockerfile is introduced. This Docker image produces a tarball of the released and compiled software which can when be piped into the Dockerfile.run build process. The result is a minimal image only containing Spreed WebRTC and the gear to run OpenSSL. First create the builder image: ``` docker build -t spreed-webrtc-builder -f Dockerfile.build . ``` Next run the builder container, piping its output into the creation of the runner container: ``` docker run --rm spreed-webrtc-builder | docker build -t spreed-webrtc -f Dockerfile.run - ``` Afterwards run the container like this: ``` docker run --rm --name my-spreed-webrtc -p 8080:8080 -p 8443:8443 \ -v `pwd`:/srv/extra -i -t spreed-webrtc ```
·
v0.29.7v0.27.2
1 parent 31260c3 commit bcffe32

File tree

4 files changed

+213
-40
lines changed

4 files changed

+213
-40
lines changed
 

‎Dockerfile

+20-40
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Spreed WebRTC server in Docker
1+
# Spreed WebRTC server in Docker (for development)
22
#
33
# This Dockerfile creates a container which runs Spreed WebRTC as found in the
44
# current folder. It is intended for development.
@@ -21,8 +21,8 @@
2121
# when running the docker container as with `-c` parameter like this:
2222
#
2323
# ```
24-
# docker run --rm --name my-spreed-webrtc -p 8080:8080 \
25-
# -v `pwd`:/srv/extra -i -t spreed-webrtc` \
24+
# docker run --rm --name my-spreed-webrtc -p 8080:8080 -p 8443:8443 \
25+
# -v `pwd`:/srv/extra -i -t spreed-webrtc \
2626
# -c /srv/extra/server.conf
2727
# ```
2828
#
@@ -45,49 +45,29 @@ ENV DEBIAN_FRONTEND noninteractive
4545

4646
# Base build dependencies.
4747
RUN apt-get update && apt-get install -qy \
48-
golang nodejs build-essential git automake autoconf
48+
golang \
49+
nodejs \
50+
build-essential \
51+
git \
52+
automake \
53+
autoconf
4954

5055
# Add and build Spreed WebRTC server.
5156
ADD . /srv/spreed-webrtc
5257
WORKDIR /srv/spreed-webrtc
53-
RUN ./autogen.sh && ./configure && make pristine && make get && make
58+
RUN ./autogen.sh && \
59+
./configure && \
60+
make pristine && \
61+
make get && \
62+
make
5463

55-
# Create entrypoint script.
56-
RUN echo '\n\
57-
set -e\n\
58-
if [ "$NEWCERT" = "1" -o ! -e /srv/cert.pem ]; then\n\
59-
echo "Creating new self signed TLS certificate ..."\n\
60-
rm -f /srv/privkey.pem\n\
61-
rm -f /srv/cert.pem\n\
62-
openssl ecparam -genkey -name secp384r1 -out /srv/privkey.pem\n\
63-
openssl req -new -x509 -key /srv/privkey.pem \\\n\
64-
-out /srv/cert.pem -days 3650 \\\n\
65-
-subj /CN=spreed-webrtc \\\n\
66-
-config /etc/ssl/openssl.cnf \\\n\
67-
-sha256 -extensions v3_req\n\
64+
# Add runtime dependencies.
65+
RUN apt-get update && apt-get install -qy \
66+
bsdmainutils \
67+
openssl
6868

69-
fi\n\
70-
echo "TLS certificate:"\n\
71-
openssl x509 -in /srv/cert.pem -text\n\
72-
if [ "$NEWSECRETS" = "1" -o ! -e /srv/secrets.conf ]; then\n\
73-
echo "Creating new server secrets ..."\n\
74-
rm -f /srv/secrets.conf.tmp\n\
75-
echo "SESSION_SECRET=$(openssl rand -hex 32)" >>/srv/secrets.conf.tmp\n\
76-
echo "ENCRYPTION_SECRET=$(openssl rand -hex 32)" >>/srv/secrets.conf.tmp\n\
77-
echo "SERVER_TOKEN=$(openssl rand -hex 32)" >>/srv/secrets.conf.tmp\n\
78-
echo "SHARED_SECRET=$(openssl rand -hex 32)" >>/srv/secrets.conf.tmp\n\
79-
. /srv/secrets.conf.tmp\n\
80-
sed -i -e "s/sessionSecret =.*/sessionSecret = $SESSION_SECRET/" /srv/spreed-webrtc/default.conf\n\
81-
sed -i -e "s/encryptionSecret =.*/encryptionSecret = $ENCRYPTION_SECRET/" /srv/spreed-webrtc/default.conf\n\
82-
sed -i -e "s/serverToken =.*/serverToken = $SERVER_TOKEN/" /srv/spreed-webrtc/default.conf\n\
83-
sed -i -e "s/;sharedsecret_secret =.*/sharedsecret_secret = $SHARED_SECRET/" /srv/spreed-webrtc/default.conf\n\
84-
mv /srv/secrets.conf.tmp /srv/secrets.conf\n\
85-
fi\n\
86-
echo "Server secrets:"\n\
87-
cat /srv/secrets.conf\n\
88-
echo "Staring Spreed WebRTC server ..."\n\
89-
exec /srv/spreed-webrtc/spreed-webrtc-server "$@"\n'\
90-
>> /srv/entrypoint.sh
69+
# Add entrypoint.
70+
COPY scripts/docker_entrypoint.sh /srv/entrypoint.sh
9171

9272
# Create default config file.
9373
RUN cp -v /srv/spreed-webrtc/server.conf.in /srv/spreed-webrtc/default.conf && \

‎Dockerfile.build

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Spreed WebRTC server Docker builder
2+
#
3+
# This Dockerfile creates a container which builds Spreed WebRTC as found in the
4+
# current folder, and creates a tarball which can be piped into another Docker
5+
# container for creating minimal sized Docker containers.
6+
#
7+
# First create the builder image:
8+
#
9+
# ```
10+
# docker build -t spreed-webrtc-builder -f Dockerfile.build .
11+
# ```
12+
# Next run the builder container, piping its output into the creation of the
13+
# runner container. This creates a minimal size Docker image which can be used
14+
# to run Spreed WebRTC in production.
15+
#
16+
# ```
17+
# docker run --rm spreed-webrtc-builder | docker build -t spreed-webrtc -f Dockerfile.run -
18+
# ```
19+
20+
FROM ubuntu:xenial
21+
MAINTAINER Simon Eisenmann <simon@struktur.de>
22+
23+
# Set locale.
24+
RUN locale-gen --no-purge en_US.UTF-8
25+
ENV LC_ALL en_US.UTF-8
26+
27+
ENV DEBIAN_FRONTEND noninteractive
28+
29+
# Base build dependencies.
30+
RUN apt-get update && apt-get install -qy \
31+
golang \
32+
nodejs \
33+
build-essential \
34+
git \
35+
automake \
36+
autoconf
37+
38+
# Add and build Spreed WebRTC server.
39+
ADD . /srv/spreed-webrtc
40+
WORKDIR /srv/spreed-webrtc
41+
RUN mkdir -p /usr/share/gocode/src
42+
RUN ./autogen.sh && \
43+
./configure && \
44+
make pristine && \
45+
make get && \
46+
make tarball
47+
RUN rm /srv/spreed-webrtc/dist_*/*.tar.gz
48+
RUN mv /srv/spreed-webrtc/dist_*/spreed-webrtc-* /srv/spreed-webrtc/dist
49+
50+
# Add gear required by Dockerfile.run.
51+
COPY Dockerfile.run /
52+
COPY scripts/docker_entrypoint.sh /
53+
54+
# Running this image produces a tarball suitable to be piped into another
55+
# Docker build command.
56+
CMD tar -cf - -C / Dockerfile.run docker_entrypoint.sh /srv/spreed-webrtc/dist

‎Dockerfile.run

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Spreed WebRTC server in minimal Docker (for production)
2+
#
3+
# This Dockerfile creates a container which builds Spreed WebRTC as piped in
4+
# on stdin using another Docker container defined in `Dockerfile.build`.
5+
#
6+
# First create the builder image:
7+
#
8+
# ```
9+
# docker build -t spreed-webrtc-builder -f Dockerfile.build .
10+
# ```
11+
#
12+
# Next run the builder container, piping its output into the creation of the
13+
# runner container:
14+
#
15+
# ```
16+
# docker run --rm spreed-webrtc-builder | docker build -t spreed-webrtc -f Dockerfile.run -
17+
# ```
18+
#
19+
# image. Afterwards run the container like this:
20+
#
21+
# ```
22+
# docker run --rm --name my-spreed-webrtc -p 8080:8080 -p 8443:8443 \
23+
# -v `pwd`:/srv/extra -i -t spreed-webrtc
24+
# ```
25+
#
26+
# Now you can either use a frontend proxy like Nginx to provide TLS to Spreed
27+
# WebRTC and even run it in production like that from the Docker container, or
28+
# for easy development testing, the container also provides a TLS listener with
29+
# a self-signed certificate on port 8443.
30+
#
31+
# To use custom configuration, use the `server.conf.in` file as template and
32+
# remove the listeners from [http] and [https] sections. Then provide that file
33+
# when running the docker container as with `-c` parameter like this:
34+
#
35+
# ```
36+
# docker run --rm --name my-spreed-webrtc -p 8080:8080 -p 8443:8443 \
37+
# -v `pwd`:/srv/extra -i -t spreed-webrtc \
38+
# -c /srv/extra/server.conf
39+
# ```
40+
#
41+
# And last, this container checks environment variables NEWCERT and NEWSECRETS,
42+
# on startup. Set those to `1` to regenerate the corresponding values on start.
43+
# The current certificate and secrets are printed before startup so you can use
44+
# them easily for other services. Of course, if you want to have persistent cert
45+
# and secrets, the container needs to be persistent in the first place, so no
46+
# `--rm` parameter in the example from above in that case.
47+
#
48+
49+
FROM frolvlad/alpine-glibc:alpine-3.3_glibc-2.23
50+
MAINTAINER Simon Eisenmann <simon@struktur.de>
51+
52+
ENV LANG=C.UTF-8
53+
54+
# Add dependencies.
55+
RUN apk add --no-cache \
56+
openssl
57+
58+
# Add Spreed WebRTC as provided by Dockerfile.run.
59+
COPY srv/ /srv
60+
61+
# Move around stuff from tarball to their expected locations.
62+
RUN mv /srv/spreed-webrtc/dist/loader/* /srv/spreed-webrtc && \
63+
mv /srv/spreed-webrtc/dist/www/html /srv/spreed-webrtc && \
64+
mv /srv/spreed-webrtc/dist/www/static /srv/spreed-webrtc
65+
66+
# Add entrypoint.
67+
COPY docker_entrypoint.sh /srv/entrypoint.sh
68+
69+
# Create default config.
70+
RUN cp -v /srv/spreed-webrtc/server.conf.in /srv/spreed-webrtc/default.conf && \
71+
sed -i 's|listen = 127.0.0.1:8080|listen = 0.0.0.0:8080|' /srv/spreed-webrtc/default.conf && \
72+
sed -i 's|;root = .*|root = /srv/spreed-webrtc|' /srv/spreed-webrtc/default.conf && \
73+
sed -i 's|;listen = 127.0.0.1:8443|listen = 0.0.0.0:8443|' /srv/spreed-webrtc/default.conf && \
74+
sed -i 's|;certificate = .*|certificate = /srv/cert.pem|' /srv/spreed-webrtc/default.conf && \
75+
sed -i 's|;key = .*|key = /srv/privkey.pem|' /srv/spreed-webrtc/default.conf && \
76+
touch /etc/spreed-webrtc-server.conf
77+
78+
# Cleanup.
79+
RUN rm -rf /tmp/* /var/cache/apk/*
80+
81+
# Add mount point for extra things.
82+
RUN mkdir /srv/extra
83+
VOLUME /srv/extra
84+
85+
# Tell about our service.
86+
EXPOSE 8080
87+
EXPOSE 8443
88+
89+
# Define entry point with default command.
90+
ENTRYPOINT ["/bin/sh", "/srv/entrypoint.sh", "-dc", "/srv/spreed-webrtc/default.conf"]
91+
CMD ["-c", "/etc/spreed-webrtc-server.conf"]

‎scripts/docker_entrypoint.sh

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/sh
2+
set -e
3+
4+
randomhex() {
5+
local size="$1"
6+
if [ -z "${size}" ]; then
7+
size=32
8+
fi
9+
local val=$(hexdump -e '4/4 "%08x"' -n${size} /dev/random)
10+
echo ${val}
11+
}
12+
13+
if [ "$NEWCERT" = "1" -o ! -s /srv/cert.pem ]; then
14+
echo "Creating new self signed TLS certificate ..."
15+
rm -f /srv/privkey.pem
16+
rm -f /srv/cert.pem
17+
openssl ecparam -genkey -name secp384r1 -out /srv/privkey.pem
18+
openssl req -new -x509 -key /srv/privkey.pem \
19+
-out /srv/cert.pem -days 3650 \
20+
-subj /CN=spreed-webrtc \
21+
-config /etc/ssl/openssl.cnf \
22+
-sha256 -extensions v3_req
23+
24+
fi
25+
echo "TLS certificate:"
26+
openssl x509 -in /srv/cert.pem -text
27+
28+
if [ "$NEWSECRETS" = "1" -o ! -s /srv/secrets.conf ]; then
29+
echo "Creating new server secrets ..."
30+
rm -f /srv/secrets.conf.tmp
31+
echo "SESSION_SECRET=$(randomhex 32)" >>/srv/secrets.conf.tmp
32+
echo "ENCRYPTION_SECRET=$(randomhex 32)" >>/srv/secrets.conf.tmp
33+
echo "SERVER_TOKEN=$(randomhex 32)" >>/srv/secrets.conf.tmp
34+
echo "SHARED_SECRET=$(randomhex 32)" >>/srv/secrets.conf.tmp
35+
. /srv/secrets.conf.tmp
36+
sed -i -e "s/sessionSecret =.*/sessionSecret = $SESSION_SECRET/" /srv/spreed-webrtc/default.conf
37+
sed -i -e "s/encryptionSecret =.*/encryptionSecret = $ENCRYPTION_SECRET/" /srv/spreed-webrtc/default.conf
38+
sed -i -e "s/serverToken =.*/serverToken = $SERVER_TOKEN/" /srv/spreed-webrtc/default.conf
39+
sed -i -e "s/;sharedsecret_secret =.*/sharedsecret_secret = $SHARED_SECRET/" /srv/spreed-webrtc/default.conf
40+
mv /srv/secrets.conf.tmp /srv/secrets.conf
41+
fi
42+
echo "Server secrets:"
43+
cat /srv/secrets.conf
44+
45+
echo "Staring Spreed WebRTC server ..."
46+
exec /srv/spreed-webrtc/spreed-webrtc-server "$@"

0 commit comments

Comments
 (0)
Please sign in to comment.