Skip to content

Commit 1757708

Browse files
ddelnanoddelnano
committed
Add Pixie hydra and kratos images to fix security vulns (upgrade Go and vuln deps)
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 56c9fc7 commit 1757708

3 files changed

Lines changed: 111 additions & 0 deletions

File tree

‎tools/docker/Makefile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,12 @@ LINUX_HEADERS_GS_PATH := gs://pixie-dev-public/linux-headers/$(LINUX_HEADERS_REV
119119
NATS_IMAGE_VERSION := 2.9.25
120120
nats_image_tag := "ghcr.io/pixie-io/nats:$(NATS_IMAGE_VERSION)-scratch"
121121

122+
## Ory image parameters.
123+
KRATOS_IMAGE_VERSION := 1.3.1
124+
kratos_image_tag := "ghcr.io/pixie-io/kratos:$(KRATOS_IMAGE_VERSION)-scratch"
125+
HYDRA_IMAGE_VERSION := 2.3.0
126+
hydra_image_tag := "ghcr.io/pixie-io/hydra:$(HYDRA_IMAGE_VERSION)-scratch"
127+
122128
## Copybara image parameters.
123129
COPYBARA_IMAGE_VERSION := 20210420
124130
copybara_image_tag := "gcr.io/pixie-oss/pixie-dev-public/copybara:$(COPYBARA_IMAGE_VERSION)"
@@ -276,6 +282,24 @@ build_and_upload_nats_image:
276282
-t $(nats_image_tag) \
277283
--push
278284

285+
.PHONY: build_and_upload_kratos_image
286+
build_and_upload_kratos_image:
287+
$(DOCKER) buildx build kratos_image \
288+
--platform linux/amd64,linux/arm64 \
289+
--build-arg=KRATOS_VERSION="v$(KRATOS_IMAGE_VERSION)" \
290+
--build-arg=BUILD_DATE=$(shell date -u +"%Y-%m-%dT%H:%M:%SZ") \
291+
-t $(kratos_image_tag) \
292+
--push
293+
294+
.PHONY: build_and_upload_hydra_image
295+
build_and_upload_hydra_image:
296+
$(DOCKER) buildx build hydra_image \
297+
--platform linux/amd64,linux/arm64 \
298+
--build-arg=HYDRA_VERSION="v$(HYDRA_IMAGE_VERSION)" \
299+
--build-arg=BUILD_DATE=$(shell date -u +"%Y-%m-%dT%H:%M:%SZ") \
300+
-t $(hydra_image_tag) \
301+
--push
302+
279303
.PHONY: build_and_upload_copybara_image
280304
build_and_upload_copybara_image:
281305
$(DOCKER) build copybara -t $(copybara_image_tag)

‎tools/docker/hydra_image/Dockerfile‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
FROM --platform=$BUILDPLATFORM golang:1.24-alpine@sha256:9fadeb603e14f1f3e08bdbec6681fa14446053c498a554f3e57260bf892c487e AS build
2+
3+
ARG TARGETOS TARGETARCH
4+
ARG HYDRA_VERSION
5+
6+
ARG GOOS=$TARGETOS
7+
ARG GOARCH=$TARGETARCH
8+
9+
WORKDIR /src
10+
11+
RUN apk update
12+
RUN apk add git
13+
14+
RUN git clone --depth 1 https://github.com/ory/hydra.git
15+
WORKDIR /src/hydra
16+
RUN git fetch --tags && git checkout $HYDRA_VERSION
17+
18+
ENV GO111MODULE=on
19+
# kratos and hydra require CGO if sqlite is used, but we exclusively use postgres
20+
ENV CGO_ENABLED=0
21+
22+
RUN go mod download
23+
24+
# TODO(ddelnano): Remove once hydra upstream has updated dependencies
25+
RUN go get github.com/golang-jwt/jwt/v5@v5.2.2
26+
RUN go get golang.org/x/oauth2@v0.27.0
27+
RUN go get golang.org/x/crypto@v0.38.0
28+
29+
RUN go build -ldflags="-extldflags=-static" -tags sqlite_omit_load_extension -o /usr/bin/hydra
30+
31+
FROM gcr.io/distroless/static-debian12:nonroot@sha256:627d6c5a23ad24e6bdff827f16c7b60e0289029b0c79e9f7ccd54ae3279fb45f
32+
33+
COPY --from=build /usr/bin/hydra /usr/bin/hydra
34+
35+
EXPOSE 4444 4445
36+
37+
ENTRYPOINT ["hydra"]
38+
CMD ["serve", "all"]

‎tools/docker/kratos_image/Dockerfile‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
FROM --platform=$BUILDPLATFORM golang:1.24-alpine@sha256:9fadeb603e14f1f3e08bdbec6681fa14446053c498a554f3e57260bf892c487e AS build
2+
3+
ARG TARGETOS TARGETARCH
4+
ARG KRATOS_VERSION
5+
6+
ARG GOOS=$TARGETOS
7+
ARG GOARCH=$TARGETARCH
8+
9+
WORKDIR /src
10+
11+
RUN apk update
12+
RUN apk add git
13+
14+
RUN git clone --depth 1 https://github.com/ory/kratos.git
15+
WORKDIR /src/kratos
16+
RUN git fetch --tags && git checkout $KRATOS_VERSION
17+
18+
# The hydra and kratos migrations attempt to create the same table.
19+
# Kratos's migration only creates the table while hydra's migration creates the table
20+
# and inserts a row. Therefore, we replace kratos's problematic version with empty placeholders
21+
# to avoid a conflict. Removing the problematic migration file prior to module initialization and
22+
# compilation did not work.
23+
RUN for file in persistence/sql/migrations/sql/20150100000001000000_networks.*.sql; do echo "-- Migration disabled to avoid conflict with hydra" > "$file"; done
24+
25+
ENV GO111MODULE=on
26+
# kratos and hydra require CGO if sqlite is used, but we exclusively use postgres
27+
ENV CGO_ENABLED=0
28+
29+
RUN go mod download
30+
31+
# TODO(ddelnano): Remove once kratos upstream has updated dependencies
32+
RUN go get github.com/golang-jwt/jwt/v4@v4.5.2
33+
RUN go get github.com/golang-jwt/jwt/v5@v5.2.2
34+
RUN go get golang.org/x/crypto@v0.35.0
35+
RUN go get golang.org/x/oauth2@v0.27.0
36+
37+
ARG BUILD_DATE
38+
39+
RUN go build \
40+
-ldflags="-X 'github.com/ory/kratos/driver/config.Version=${KRATOS_VERSION}' -X 'github.com/ory/kratos/driver/config.Date=${BUILD_DATE}' -X 'github.com/ory/kratos/driver/config.Commit=$(git rev-parse HEAD)'" \
41+
-o /usr/bin/kratos
42+
43+
FROM gcr.io/distroless/static-debian12:nonroot@sha256:627d6c5a23ad24e6bdff827f16c7b60e0289029b0c79e9f7ccd54ae3279fb45f
44+
45+
COPY --from=build /usr/bin/kratos /usr/bin/kratos
46+
EXPOSE 4433 4434
47+
48+
ENTRYPOINT ["kratos"]
49+
CMD ["serve"]

0 commit comments

Comments
 (0)