Skip to content

Commit a3c318a

Browse files
reachfhreachfh
committed
Sync
1 parent 5bad09f commit a3c318a

3 files changed

Lines changed: 161 additions & 3 deletions

File tree

‎deploy/debian.Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -428,9 +428,9 @@ RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
428428
# wget and jq are used to get ECS metadata
429429
# We prefer wget over curl, as it is part of busybox
430430
# curl is used to upload packages to GitHub, and is generally useful
431-
curl \
432-
jq \
433-
wget \
431+
# curl \
432+
# jq \
433+
# wget \
434434
# tini is a minimal init which will reap zombie processes
435435
# https://github.com/krallin/tini
436436
# tini \

‎deploy/distroless.Dockerfile‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,7 @@ RUN --mount=type=secret,id=oban_license_key --mount=type=secret,id=oban_key_fing
292292

293293
# Run deps.get with optional authentication to access private repos
294294
RUN --mount=type=ssh --mount=type=secret,id=access_token \
295+
--mount=type=cache,id=hex-cache,target=/app/.hex,sharing=locked \
295296
# Access private repos using ssh identity
296297
# https://docs.docker.com/engine/reference/commandline/buildx_build/#ssh
297298
# https://stackoverflow.com/questions/73263731/dockerfile-run-mount-type-ssh-doesnt-seem-to-work
@@ -380,6 +381,94 @@ RUN if ! grep -q nonroot /etc/passwd; then \
380381
useradd -l -u 65532 -g nonroot -d /app -s /usr/sbin/nologin nonroot ; \
381382
rm -f /var/log/lastlog ; rm -f /var/log/faillog ; fi
382383

384+
RUN set -exu ; \
385+
rm -f /etc/apt/apt.conf.d/docker-clean ; \
386+
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache ; \
387+
echo 'Acquire::CompressionTypes::Order:: "gz";' > /etc/apt/apt.conf.d/99use-gzip-compression
388+
389+
ARG SNAPSHOT_VER
390+
ARG SNAPSHOT_NAME
391+
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
392+
--mount=type=cache,id=apt-lib,target=/var/lib/apt,sharing=locked \
393+
--mount=type=cache,id=debconf,target=/var/cache/debconf,sharing=locked \
394+
if test -n "$SNAPSHOT_VER" ; then \
395+
set -exu ; \
396+
apt-get update -qq ; \
397+
DEBIAN_FRONTEND=noninteractive \
398+
apt-get -y install -y -qq --no-install-recommends \
399+
ca-certificates \
400+
; \
401+
echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/${SNAPSHOT_VER} ${SNAPSHOT_NAME} main" > /etc/apt/sources.list ; \
402+
echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/${SNAPSHOT_VER} ${SNAPSHOT_NAME}-security main" >> /etc/apt/sources.list ; \
403+
echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/${SNAPSHOT_VER} ${SNAPSHOT_NAME}-updates main" >> /etc/apt/sources.list ; \
404+
fi ; \
405+
truncate -s 0 /var/log/apt/* ; \
406+
truncate -s 0 /var/log/dpkg.log
407+
408+
ARG RUNTIME_PACKAGES
409+
410+
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
411+
--mount=type=cache,id=apt-lib,target=/var/lib/apt,sharing=locked \
412+
--mount=type=cache,id=debconf,target=/var/cache/debconf,sharing=locked \
413+
set -exu ; \
414+
apt-get update -qq ; \
415+
DEBIAN_FRONTEND=noninteractive \
416+
# Tools needed to run tests
417+
apt-get -y install -y -qq --no-install-recommends \
418+
git \
419+
; \
420+
# Runtime dependencies for the app
421+
apt-get -y install -y -qq --no-install-recommends \
422+
# Enable installation of packages over https
423+
# apt-transport-https \
424+
# Libraries used by hexpm
425+
# Enable the app to make outbound SSL calls.
426+
ca-certificates \
427+
# libodbc1 \
428+
# libsctp1 \
429+
netbase \
430+
# wget and jq are used to get ECS metadata
431+
# We prefer wget over curl, as it is part of busybox
432+
# curl is used to upload packages to GitHub, and is generally useful
433+
# curl \
434+
# jq \
435+
# wget \
436+
# tini is a minimal init which will reap zombie processes
437+
# https://github.com/krallin/tini
438+
# tini \
439+
# bind-utils \
440+
# Minimal libs needed by Erlang VM
441+
# libncursesw6 \
442+
libtinfo6 \
443+
# Additional libs
444+
libssl3 \
445+
libstdc++6 \
446+
libgcc-s1 \
447+
$RUNTIME_PACKAGES \
448+
; \
449+
# Remove packages installed temporarily. Removes everything related to
450+
# packages, including the configuration files, and packages
451+
# automatically installed because a package required them but, with the
452+
# other packages removed, are no longer needed.
453+
# apt-get purge -y --auto-remove curl ; \
454+
# https://www.networkworld.com/article/3453032/cleaning-up-with-apt-get.html
455+
# https://manpages.ubuntu.com/manpages/jammy/man8/apt-get.8.html
456+
# Delete local repository of retrieved package files in /var/cache/apt/archives
457+
# This is handled automatically by /etc/apt/apt.conf.d/docker-clean
458+
# Use this if not running --mount=type=cache.
459+
# apt-get clean ; \
460+
# Delete info on installed packages. This saves some space, but it can
461+
# be useful to have them as a record of what was installed, e.g., for auditing.
462+
# rm -rf /var/lib/dpkg ; \
463+
# Delete debconf data files to save some space
464+
# rm -rf /var/cache/debconf ; \
465+
# Delete index of available files from apt-get update
466+
# Use this if not running --mount=type=cache.
467+
# rm -rf /var/lib/apt/lists/*
468+
# Clear logs of installed packages
469+
truncate -s 0 /var/log/apt/* ; \
470+
truncate -s 0 /var/log/dpkg.log
471+
383472
COPY --link --from=build-os-deps /usr/lib/locale/locale-archive /usr/lib/locale/
384473

385474
ARG LANG

‎deploy/ubuntu.Dockerfile‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,7 @@ RUN --mount=type=secret,id=oban_license_key --mount=type=secret,id=oban_key_fing
264264

265265
# Run deps.get with optional authentication to access private repos
266266
RUN --mount=type=ssh --mount=type=secret,id=access_token \
267+
--mount=type=cache,id=hex-cache,target=/app/.hex,sharing=locked \
267268
# Access private repos using ssh identity
268269
# https://docs.docker.com/engine/reference/commandline/buildx_build/#ssh
269270
# https://stackoverflow.com/questions/73263731/dockerfile-run-mount-type-ssh-doesnt-seem-to-work
@@ -352,6 +353,74 @@ RUN if ! grep -q nonroot /etc/passwd; then \
352353
useradd -l -u 65532 -g nonroot -d /app -s /usr/sbin/nologin nonroot ; \
353354
rm -f /var/log/lastlog ; rm -f /var/log/faillog ; fi
354355

356+
RUN set -exu ; \
357+
rm -f /etc/apt/apt.conf.d/docker-clean ; \
358+
echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache ; \
359+
echo 'Acquire::CompressionTypes::Order:: "gz";' > /etc/apt/apt.conf.d/99use-gzip-compression
360+
ARG RUNTIME_PACKAGES
361+
362+
RUN --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
363+
--mount=type=cache,id=apt-lib,target=/var/lib/apt,sharing=locked \
364+
--mount=type=cache,id=debconf,target=/var/cache/debconf,sharing=locked \
365+
set -exu ; \
366+
apt-get update -qq ; \
367+
DEBIAN_FRONTEND=noninteractive \
368+
# Tools needed to run tests
369+
apt-get -y install -y -qq --no-install-recommends \
370+
git \
371+
; \
372+
# Runtime dependencies for the app
373+
apt-get -y install -y -qq --no-install-recommends \
374+
# Enable installation of packages over https
375+
# apt-transport-https \
376+
# Libraries used by hexpm
377+
# Enable the app to make outbound SSL calls.
378+
ca-certificates \
379+
# libodbc1 \
380+
# libsctp1 \
381+
netbase \
382+
# wget and jq are used to get ECS metadata
383+
# We prefer wget over curl, as it is part of busybox
384+
# curl is used to upload packages to GitHub, and is generally useful
385+
# curl \
386+
# jq \
387+
# wget \
388+
# tini is a minimal init which will reap zombie processes
389+
# https://github.com/krallin/tini
390+
# tini \
391+
# bind-utils \
392+
# Minimal libs needed by Erlang VM
393+
# libncursesw6 \
394+
libtinfo6 \
395+
# Additional libs
396+
libssl3 \
397+
libstdc++6 \
398+
libgcc-s1 \
399+
$RUNTIME_PACKAGES \
400+
; \
401+
# Remove packages installed temporarily. Removes everything related to
402+
# packages, including the configuration files, and packages
403+
# automatically installed because a package required them but, with the
404+
# other packages removed, are no longer needed.
405+
# apt-get purge -y --auto-remove curl ; \
406+
# https://www.networkworld.com/article/3453032/cleaning-up-with-apt-get.html
407+
# https://manpages.ubuntu.com/manpages/jammy/man8/apt-get.8.html
408+
# Delete local repository of retrieved package files in /var/cache/apt/archives
409+
# This is handled automatically by /etc/apt/apt.conf.d/docker-clean
410+
# Use this if not running --mount=type=cache.
411+
# apt-get clean ; \
412+
# Delete info on installed packages. This saves some space, but it can
413+
# be useful to have them as a record of what was installed, e.g., for auditing.
414+
# rm -rf /var/lib/dpkg ; \
415+
# Delete debconf data files to save some space
416+
# rm -rf /var/cache/debconf ; \
417+
# Delete index of available files from apt-get update
418+
# Use this if not running --mount=type=cache.
419+
# rm -rf /var/lib/apt/lists/*
420+
# Clear logs of installed packages
421+
truncate -s 0 /var/log/apt/* ; \
422+
truncate -s 0 /var/log/dpkg.log
423+
355424
COPY --link --from=build-os-deps /usr/lib/locale/locale-archive /usr/lib/locale/
356425

357426
ARG LANG

0 commit comments

Comments
 (0)