From 7da97c1088f9aa828529b11b2b20bd6d981b478b Mon Sep 17 00:00:00 2001 From: Will Alexander Date: Thu, 2 Dec 2021 19:33:55 -0800 Subject: [PATCH 1/3] Fix resource_details parameter typo in audit.py This typo caused an error for me when running Cloudmapper. --- shared/audit.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/audit.py b/shared/audit.py index 0154a7020..cd27feb89 100644 --- a/shared/audit.py +++ b/shared/audit.py @@ -574,7 +574,7 @@ def audit_route53(findings, region): region, "FOREIGN_HOSTED_ZONE", hosted_zone, - resource_datails={ + resource_details={ "vpc_id": vpc, "vpc_regions": region_name, }, From 394c1df2efd9bac858fa515adc4ad2201aa964d4 Mon Sep 17 00:00:00 2001 From: Will Alexander Date: Thu, 2 Dec 2021 19:56:11 -0800 Subject: [PATCH 2/3] Ignore ancillary files when copying to Docker image This commit updates the .dockerignore file with some files that are not relevant or useful in the context of a Docker image. This is a somewhat trivial change, but prevents changes to these files from triggering pointless layer rebuilds, and keeps the image's working directory more tidy. .github/: This contains a GitHub issue template, which is obviously not used inside the container. .gitignore: Since we are already ignoring the .git directory, this file will have no effect. .travis.yml: Similarly to .github/, this file is not used inside the container. config.json.demo: We are already ignoring account-data/, so this demo config will not be usable to my understanding. --- .dockerignore | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.dockerignore b/.dockerignore index b0464de10..0bc4df4ac 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,3 +1,5 @@ .git +.gitignore +.travis.yml account-data -docs \ No newline at end of file +config.json.demo \ No newline at end of file From a003414235694ccfe199e14bd33b20052aab1649 Mon Sep 17 00:00:00 2001 From: Will Alexander Date: Thu, 2 Dec 2021 20:42:57 -0800 Subject: [PATCH 3/3] Adjust Docker build to improve caching and reduce size This commit makes some adjustments to the Dockerfile to avoid build cache invalidation where possible, as well as some other more subjective changes that I'll justify but would happily revert. Firstly, I combined the apt-get commands into a single layer which also deletes the package cache files, as shown in the Docker's best practices documentation [1]. Per the same documentation, I separated the list of packages into their own lines, sorted alphabetically, which makes updating the list of packages easier in the future, and makes changes easier to diff. I added an initial COPY of only the requirements.txt file before running `pip install`, followed by a full COPY of all the source files. This means that the requirements will only need to be downloaded, built, and installed when the requirements change, rather than invalidating the cached layer whenever any file is modified. I removed the AWS_DEFAULT_REGION environment variable, as the user should most likely be setting this explicitly anyways. Finally, I removed some of the packages being installed that appeared to not be useful in a Docker container: automake: Installed automatically as a recommended dependency of autoconf. python3.7-dev: The requirements appear to install successfully without this, and since the python Docker image is built from source, I'm not sure if this would even link properly. jq: While jq is useful for parsing the output, users can install it themselves if they need it (and can't just pipe the container output to jq on their local machine). awscli: Similarly to jq, this doesn't appear to be strictly necessary for using cloudmapper. [1] https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#sort-multi-line-arguments --- Dockerfile | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/Dockerfile b/Dockerfile index e47a4ba13..187388624 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,17 +1,15 @@ -FROM python:3.7-slim as cloudmapper - +FROM python:3.7-slim AS cloudmapper LABEL maintainer="https://github.com/0xdabbad00/" LABEL Project="https://github.com/duo-labs/cloudmapper" - EXPOSE 8000 +RUN apt-get update && apt-get install --assume-yes \ + autoconf \ + build-essential \ + libtool \ + python3-tk \ + && rm -rf /var/lib/apt/lists/* WORKDIR /opt/cloudmapper -ENV AWS_DEFAULT_REGION=us-east-1 - -RUN apt-get update -y -RUN apt-get install -y build-essential autoconf automake libtool python3.7-dev python3-tk jq awscli -RUN apt-get install -y bash - -COPY . /opt/cloudmapper -RUN pip install -r requirements.txt - -RUN bash +COPY requirements.txt . +RUN pip install --requirement requirements.txt +COPY . . +CMD ["bash"] \ No newline at end of file