Skip to content

Commit c68a62b

Browse files
TheAuditorToolTheAuditorTool
committed
fix(docker): multi-arch image build (amd64+arm64) -- closes #223
The published Docker image was linux/arm64 only because it was built on an ARM64 host. This caused >60s startup via QEMU emulation on amd64, breaking downstream CI (ZAP scans). Changes: - VMs/buildDockerImage.sh: rewrite to use docker buildx with --platform linux/amd64,linux/arm64 for multi-arch manifest - VMs/Dockerfile: pin ubuntu:22.04, collapse RUN layers, add EXPOSE 8443 and CMD for usability - .github/workflows/docker-publish.yml: add CI workflow for automated multi-arch builds (workflow_dispatch only -- inactive until secrets and triggers are configured) - PR_multi-arch-docker.md: changelog, guide, and activation steps
1 parent b7b159c commit c68a62b

File tree

3 files changed

+117
-38
lines changed

3 files changed

+117
-38
lines changed

‎.github/workflows/docker-publish.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# ------------------------------------------------------------------
2+
# INACTIVE BY DEFAULT -- manual trigger only (workflow_dispatch).
3+
#
4+
# This workflow builds and publishes a multi-architecture Docker image
5+
# (linux/amd64 + linux/arm64) to Docker Hub.
6+
#
7+
# TO ACTIVATE:
8+
# 1. Add two repository secrets (Settings > Secrets and variables > Actions):
9+
# DOCKERHUB_USERNAME - your Docker Hub username
10+
# DOCKERHUB_TOKEN - a Docker Hub access token (not your password)
11+
# 2. Optionally add automatic triggers by uncommenting the lines below:
12+
# push:
13+
# branches: [master]
14+
# paths: ['VMs/Dockerfile']
15+
# release:
16+
# types: [published]
17+
#
18+
# Until you do both steps, this workflow does nothing on its own.
19+
# ------------------------------------------------------------------
20+
21+
name: Docker Publish
22+
23+
on:
24+
workflow_dispatch:
25+
# Uncomment the triggers below when ready to automate:
26+
# push:
27+
# branches: [master]
28+
# paths: ['VMs/Dockerfile']
29+
# release:
30+
# types: [published]
31+
32+
env:
33+
IMAGE_NAME: owasp/benchmark
34+
PLATFORMS: linux/amd64,linux/arm64
35+
36+
jobs:
37+
build-and-push:
38+
runs-on: ubuntu-latest
39+
40+
permissions:
41+
contents: read
42+
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@v4
46+
47+
- name: Set up QEMU (multi-arch emulation)
48+
uses: docker/setup-qemu-action@v3
49+
50+
- name: Set up Docker Buildx
51+
uses: docker/setup-buildx-action@v3
52+
53+
- name: Log in to Docker Hub
54+
uses: docker/login-action@v3
55+
with:
56+
username: ${{ secrets.DOCKERHUB_USERNAME }}
57+
password: ${{ secrets.DOCKERHUB_TOKEN }}
58+
59+
- name: Build and push multi-arch image
60+
uses: docker/build-push-action@v6
61+
with:
62+
context: VMs
63+
file: VMs/Dockerfile
64+
platforms: ${{ env.PLATFORMS }}
65+
push: true
66+
tags: ${{ env.IMAGE_NAME }}:latest

‎VMs/Dockerfile‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,45 @@
11
# This dockerfile builds a container that pulls down and runs the latest version of BenchmarkJava
2-
FROM ubuntu:latest
2+
FROM ubuntu:22.04
33
LABEL org.opencontainers.image.authors="Dave Wichers dave.wichers@owasp.org"
44

5-
RUN apt-get update
6-
RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
7-
RUN apt-get install -q -y \
8-
openjdk-17-jre-headless \
9-
openjdk-17-jdk \
10-
git \
11-
maven \
12-
wget \
13-
iputils-ping \
14-
&& apt-get clean
5+
RUN apt-get update \
6+
&& DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata \
7+
&& apt-get install -q -y \
8+
openjdk-17-jre-headless \
9+
openjdk-17-jdk \
10+
git \
11+
maven \
12+
wget \
13+
iputils-ping \
14+
&& apt-get clean \
15+
&& rm -rf /var/lib/apt/lists/*
1516

1617
RUN mkdir /owasp
1718
WORKDIR /owasp
1819

1920
# Download, build, install Benchmark Utilities required by crawler and scorecard generation
20-
RUN git clone https://github.com/OWASP-Benchmark/BenchmarkUtils.git
21-
WORKDIR /owasp/BenchmarkUtils
22-
RUN mvn install
21+
RUN git clone https://github.com/OWASP-Benchmark/BenchmarkUtils.git \
22+
&& cd BenchmarkUtils \
23+
&& mvn install
2324

2425
# Download, build BenchmarkJava
25-
WORKDIR /owasp
26-
RUN git clone https://github.com/OWASP-Benchmark/BenchmarkJava
27-
28-
# Workaround for security fix for CVE-2022-24765
29-
RUN git config --global --add safe.directory /owasp/BenchmarkJava
26+
RUN git clone https://github.com/OWASP-Benchmark/BenchmarkJava \
27+
&& git config --global --add safe.directory /owasp/BenchmarkJava \
28+
&& cd BenchmarkJava \
29+
&& mvn clean package cargo:install
3030

31-
WORKDIR /owasp/BenchmarkJava
32-
RUN mvn clean package cargo:install
33-
34-
RUN useradd -d /home/bench -m -s /bin/bash bench
35-
RUN echo bench:bench | chpasswd
31+
RUN useradd -d /home/bench -m -s /bin/bash bench \
32+
&& echo bench:bench | chpasswd
3633

3734
RUN chown -R bench /owasp/
3835
ENV PATH=/owasp/BenchmarkJava:$PATH
3936

40-
# start up Benchmark once, for 60 seconds, then kill it, so the additional dependencies required to run it are downloaded/cached in the image as well.
41-
# exit 0 is required to return a 'success' code, otherwise the timeout returns a failure code, causing the Docker build to fail.
37+
# Start up Benchmark once for 60 seconds then kill it, so additional runtime
38+
# dependencies are downloaded and cached in the image.
39+
# exit 0 prevents the timeout return code from failing the Docker build.
4240
WORKDIR /owasp/BenchmarkJava
4341
RUN timeout 60 ./runBenchmark.sh; exit 0
4442

43+
EXPOSE 8443
44+
CMD ["./runBenchmark.sh"]
45+

‎VMs/buildDockerImage.sh‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,28 @@
1-
# Pull in latest version of ubuntu. This builds an image using the OS native to this platform.
2-
docker pull ubuntu:latest
3-
# Remove any ubuntu:<none> image if it was left behind by a new version of ubuntu:latest being pulled
4-
i=$(docker images | grep "ubuntu" | grep "<none" | awk '{print $3}')
5-
if [ "$i" ]
6-
then
7-
docker rmi $i
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
IMAGE="owasp/benchmark"
5+
TAG="latest"
6+
PLATFORMS="linux/amd64,linux/arm64"
7+
BUILDER_NAME="benchmark-multiarch"
8+
9+
# Create (or re-use) a buildx builder that supports multi-platform builds.
10+
if ! docker buildx inspect "$BUILDER_NAME" >/dev/null 2>&1; then
11+
echo "Creating buildx builder: $BUILDER_NAME"
12+
docker buildx create --name "$BUILDER_NAME" --use
13+
else
14+
docker buildx use "$BUILDER_NAME"
815
fi
916

10-
# Since Docker doesn't auto delete anything, just like for the Ubuntu update, delete any existing benchmark:latest image before building a new one
11-
docker image rm benchmark:latest
12-
docker build -t benchmark .
17+
# Build and push a multi-architecture image in one step.
18+
# --push is required because multi-arch manifest lists cannot be loaded into
19+
# the local daemon. The image is pushed directly to Docker Hub.
20+
echo "Building ${IMAGE}:${TAG} for ${PLATFORMS} ..."
21+
docker buildx build \
22+
--platform "$PLATFORMS" \
23+
--tag "${IMAGE}:${TAG}" \
24+
--push \
25+
.
1326

14-
# Once verified/tested, to publish an update to the OWASP Benchmark Docker image, run the following:
15-
# docker push owasp/benchmark:latest
27+
echo "Done. Published ${IMAGE}:${TAG} for ${PLATFORMS}."
1628

0 commit comments

Comments
 (0)