From edfdda86aeb05dd487b8ca72b8a7f389de48e13f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa?= Date: Sun, 1 Mar 2020 02:38:26 +0100 Subject: [PATCH] Use web vault built by docker autobuild, using the hash to reference the image for extra security --- docker/Dockerfile.j2 | 50 +++++++++-------------- docker/aarch64/mysql/Dockerfile | 24 +++++------ docker/aarch64/sqlite/Dockerfile | 24 +++++------ docker/amd64/mysql/Dockerfile | 24 +++++------ docker/amd64/mysql/Dockerfile.alpine | 23 +++++------ docker/amd64/postgresql/Dockerfile | 24 +++++------ docker/amd64/postgresql/Dockerfile.alpine | 23 +++++------ docker/amd64/sqlite/Dockerfile | 24 +++++------ docker/amd64/sqlite/Dockerfile.alpine | 23 +++++------ docker/armv6/mysql/Dockerfile | 24 +++++------ docker/armv6/sqlite/Dockerfile | 24 +++++------ docker/armv7/mysql/Dockerfile | 24 +++++------ docker/armv7/sqlite/Dockerfile | 24 +++++------ 13 files changed, 139 insertions(+), 196 deletions(-) diff --git a/docker/Dockerfile.j2 b/docker/Dockerfile.j2 index cdf83eeb..ad1e4250 100644 --- a/docker/Dockerfile.j2 +++ b/docker/Dockerfile.j2 @@ -1,16 +1,10 @@ -{{ "# This file was generated using a Jinja2 template." }} -{{ "# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfile's." }} +# This file was generated using a Jinja2 template. +# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfile's. -# Using multistage build: -# https://docs.docker.com/develop/develop-images/multistage-build/ -# https://whitfin.io/speeding-up-rust-docker-builds/ -####################### VAULT BUILD IMAGE ####################### {% set build_stage_base_image = "rust:1.40" %} -{% set vault_stage_base_image = build_stage_base_image %} {% if "alpine" in target_file %} {% set build_stage_base_image = "clux/muslrust:nightly-2019-12-19" %} {% set runtime_stage_base_image = "alpine:3.11" %} -{% set vault_stage_base_image = runtime_stage_base_image %} {% set package_arch_name = "" %} {% elif "amd64" in target_file %} {% set runtime_stage_base_image = "debian:buster-slim" %} @@ -29,29 +23,23 @@ {% if package_arch_name == "" %} {% set package_arch_prefix = "" %} {% endif %} -FROM {{ vault_stage_base_image }} as vault - -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -{% if "alpine" in vault_stage_base_image %} -RUN apk add --no-cache --upgrade curl tar -{% else %} -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color -{% endif %} - -WORKDIR / - -{% if "alpine" in vault_stage_base_image %} -SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] -{% else %} -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] -{% endif %} - -RUN curl -L $URL | tar xz -RUN ls +# Using multistage build: +# https://docs.docker.com/develop/develop-images/multistage-build/ +# https://whitfin.io/speeding-up-rust-docker-builds/ +####################### VAULT BUILD IMAGE ####################### +{% set vault_image_hash = "sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c" %} +{% raw %} +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +{% endraw %} +FROM bitwardenrs/web-vault@{{ vault_image_hash }} as vault ########################## BUILD IMAGE ########################## {% if "musl" in build_stage_base_image %} diff --git a/docker/aarch64/mysql/Dockerfile b/docker/aarch64/mysql/Dockerfile index 14a0cbff..9e2812e8 100644 --- a/docker/aarch64/mysql/Dockerfile +++ b/docker/aarch64/mysql/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/aarch64/sqlite/Dockerfile b/docker/aarch64/sqlite/Dockerfile index 0c2e7dbf..f130faca 100644 --- a/docker/aarch64/sqlite/Dockerfile +++ b/docker/aarch64/sqlite/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/amd64/mysql/Dockerfile b/docker/amd64/mysql/Dockerfile index 6e12db2b..7f47c475 100644 --- a/docker/amd64/mysql/Dockerfile +++ b/docker/amd64/mysql/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/amd64/mysql/Dockerfile.alpine b/docker/amd64/mysql/Dockerfile.alpine index 9bc6a51e..c3fff716 100644 --- a/docker/amd64/mysql/Dockerfile.alpine +++ b/docker/amd64/mysql/Dockerfile.alpine @@ -5,20 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM alpine:3.11 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -RUN apk add --no-cache --upgrade curl tar - -WORKDIR / - -SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # Musl build image for statically compiled binary diff --git a/docker/amd64/postgresql/Dockerfile b/docker/amd64/postgresql/Dockerfile index 8428de9e..8cfa3905 100644 --- a/docker/amd64/postgresql/Dockerfile +++ b/docker/amd64/postgresql/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/amd64/postgresql/Dockerfile.alpine b/docker/amd64/postgresql/Dockerfile.alpine index 12f2e529..c9574c5e 100644 --- a/docker/amd64/postgresql/Dockerfile.alpine +++ b/docker/amd64/postgresql/Dockerfile.alpine @@ -5,20 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM alpine:3.11 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -RUN apk add --no-cache --upgrade curl tar - -WORKDIR / - -SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # Musl build image for statically compiled binary diff --git a/docker/amd64/sqlite/Dockerfile b/docker/amd64/sqlite/Dockerfile index e120c18e..af2e792c 100644 --- a/docker/amd64/sqlite/Dockerfile +++ b/docker/amd64/sqlite/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/amd64/sqlite/Dockerfile.alpine b/docker/amd64/sqlite/Dockerfile.alpine index 8cd9251e..881b2e58 100644 --- a/docker/amd64/sqlite/Dockerfile.alpine +++ b/docker/amd64/sqlite/Dockerfile.alpine @@ -5,20 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM alpine:3.11 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -RUN apk add --no-cache --upgrade curl tar - -WORKDIR / - -SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # Musl build image for statically compiled binary diff --git a/docker/armv6/mysql/Dockerfile b/docker/armv6/mysql/Dockerfile index d55e12b9..5f815760 100644 --- a/docker/armv6/mysql/Dockerfile +++ b/docker/armv6/mysql/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/armv6/sqlite/Dockerfile b/docker/armv6/sqlite/Dockerfile index ee6b5902..37560904 100644 --- a/docker/armv6/sqlite/Dockerfile +++ b/docker/armv6/sqlite/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/armv7/mysql/Dockerfile b/docker/armv7/mysql/Dockerfile index c486595f..c1183cce 100644 --- a/docker/armv7/mysql/Dockerfile +++ b/docker/armv7/mysql/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because diff --git a/docker/armv7/sqlite/Dockerfile b/docker/armv7/sqlite/Dockerfile index 7cce852d..cfd1dc7d 100644 --- a/docker/armv7/sqlite/Dockerfile +++ b/docker/armv7/sqlite/Dockerfile @@ -5,21 +5,17 @@ # https://docs.docker.com/develop/develop-images/multistage-build/ # https://whitfin.io/speeding-up-rust-docker-builds/ ####################### VAULT BUILD IMAGE ####################### -FROM rust:1.40 as vault -ENV VAULT_VERSION "v2.12.0d" - -ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz" - -# Build time options to avoid dpkg warnings and help with reproducible builds. -ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color - -WORKDIR / - -SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"] - -RUN curl -L $URL | tar xz -RUN ls +# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable. +# It can be viewed in multiple ways: +# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there. +# - From the console, with the following commands: +# docker pull bitwardenrs/web-vault:v2.12.0e +# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e +# +# - To do the opposite, and get the tag from the hash, you can do: +# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c +FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault ########################## BUILD IMAGE ########################## # We need to use the Rust build image, because