diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml index 0ffd664..f5b9b03 100644 --- a/.github/workflows/build-images.yml +++ b/.github/workflows/build-images.yml @@ -13,14 +13,12 @@ jobs: runs-on: ubuntu-latest strategy: fail-fast: false + max-parallel: 4 matrix: DISTRIB_ID: [ubuntu] - DISTRIB_RELEASE: [16.04, 18.04, 20.04, latest] - PLATFORMS: [linux/amd64, linux/arm64, linux/386] + DISTRIB_RELEASE: [latest, 20.04, 18.04, 16.04] IMAGE_TYPE: [nodejs] - exclude: - - DISTRIB_RELEASE: 20.04 # focal i386 doesn't exists (yet?) - PLATFORMS: linux/386 + NODE_VERSION: ['12'] steps: - uses: actions/checkout@v2 - name: Set up QEMU @@ -46,11 +44,12 @@ jobs: context: . push: ${{ github.event_name != 'pull_request' && github.event_name != 'push' }} file: ./linux/${{ matrix.DISTRIB_ID }}/${{ matrix.IMAGE_TYPE }}/Dockerfile - platforms: ${{ matrix.PLATFORMS }} + platforms: linux/amd64,linux/arm64 tags: ghcr.io/catthehacker/docker-images:${{ matrix.DISTRIB_ID }}-${{ matrix.IMAGE_TYPE }}-${{ matrix.DISTRIB_RELEASE }} build-args: | DISTRIB_ID=${{ matrix.DISTRIB_ID }} DISTRIB_RELEASE=${{ matrix.DISTRIB_RELEASE }} + NODE_VERSION=${{ matrix.NODE_VERSION }} - name: Build and push ${{ matrix.DISTRIB_ID }}-${{ matrix.IMAGE_TYPE }}-latest image id: docker_build_latest uses: docker/build-push-action@v2 @@ -59,8 +58,9 @@ jobs: context: . push: ${{ github.event_name != 'pull_request' && github.event_name != 'push' }} file: ./linux/${{ matrix.DISTRIB_ID }}/${{ matrix.IMAGE_TYPE }}/Dockerfile - platforms: ${{ matrix.PLATFORMS }} + platforms: linux/amd64,linux/arm64 tags: ghcr.io/catthehacker/docker-images:${{ matrix.DISTRIB_ID }}-${{ matrix.IMAGE_TYPE }}-latest build-args: | DISTRIB_ID=${{ matrix.DISTRIB_ID }} DISTRIB_RELEASE=${{ steps.ubuntu_latest.outputs.UBUNTU_LATEST }} + NODE_VERSION=${{ matrix.NODE_VERSION }} diff --git a/linux/ubuntu/nodejs/Dockerfile b/linux/ubuntu/nodejs/Dockerfile index 491b039..315073c 100644 --- a/linux/ubuntu/nodejs/Dockerfile +++ b/linux/ubuntu/nodejs/Dockerfile @@ -2,41 +2,83 @@ ARG DISTRIB_ID=ubuntu ARG DISTRIB_RELEASE=20.04 FROM ${DISTRIB_ID}:${DISTRIB_RELEASE} -# non-root user +# > ARGs before FROM are not accessible +ARG DISTRIB_ID=ubuntu +ARG DISTRIB_RELEASE=20.04 + +# > non-root user ARG RUNNER_USER=runner -# force apt +# > Node version +ARG NODE_VERSION=12 + +# > Force apt to not be interactive/not ask ARG DEBIAN_FRONTEND=noninteractive -# Install dependencies and create non-root user with sudo permissions -RUN apt -yq update && \ - apt -yq upgrade && \ - apt -yq install curl git wget sudo gnupg apt-transport-https openssl && \ - apt -yq install --no-install-recommends lsb-release gawk jq && \ - curl -sSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | sudo apt-key add - && \ - DISTRO="$(lsb_release -s -c)" && \ - echo "deb https://deb.nodesource.com/node_12.x $DISTRO main" | sudo tee /etc/apt/sources.list.d/nodesource.list && \ - echo "deb-src https://deb.nodesource.com/node_12.x $DISTRO main" | sudo tee -a /etc/apt/sources.list.d/nodesource.list && \ +SHELL [ "/bin/bash", "-c" ] + +# > Install base binutils and dependencies, setup environment required for GitHub Actions +RUN set -Eeuxo pipefail && \ + ImageOS=${DISTRIB_ID}$(echo ${DISTRIB_RELEASE} | cut -d'.' -f 1) && \ + echo "IMAGE_OS=$ImageOS" | tee -a /etc/environment && \ + echo "ImageOS=$ImageOS" | tee -a /etc/environment && \ + echo "LSB_RELEASE=${DISTRIB_RELEASE}" | tee -a /etc/environment && \ + AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache && \ + echo "AGENT_TOOLSDIRECTORY=$AGENT_TOOLSDIRECTORY" | tee -a /etc/environment && \ + echo "RUNNER_USER=${RUNNER_USER}" | tee -a /etc/environment && \ + echo "RUNNER_TEMP=/home/${RUNNER_USER}/work/_temp" | tee -a /etc/environment && \ + echo "RUN_TOOL_CACHE=$AGENT_TOOLSDIRECTORY" | tee -a /etc/environment && \ + echo "DEPLOYMENT_BASEPATH=/opt/runner" | tee -a /etc/environment && \ + echo ". /etc/environment" | tee -a /etc/profile && \ + mkdir -p $AGENT_TOOLSDIRECTORY && \ + chown 1000:1000 $AGENT_TOOLSDIRECTORY && \ + chmod 0777 $AGENT_TOOLSDIRECTORY && \ + printf "Build started" && \ apt -yq update && \ - apt -yq upgrade && \ - apt -yq install nodejs && \ + printf "Updated apt lists and upgraded packages\n\n" && \ + apt -yq install --no-install-recommends lsb-release gawk jq curl git wget sudo gnupg-agent ca-certificates software-properties-common apt-transport-https && \ + printf "Installed base utils" + +# > Install Node.JS +RUN set -Eeuxo pipefail && \ + printf "Installing Node.JS" && \ + curl -sSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add - && \ + DISTRO="$(lsb_release -s -c)" && \ + echo "deb https://deb.nodesource.com/node_${NODE_VERSION}.x $DISTRO main" | tee /etc/apt/sources.list.d/nodesource.list && \ + echo "deb-src https://deb.nodesource.com/node_${NODE_VERSION}.x $DISTRO main" | tee -a /etc/apt/sources.list.d/nodesource.list && \ + apt -yq update && \ + apt -yq install --no-install-recommends nodejs="${NODE_VERSION}*" && \ + printf "Installed Node.JS $(node -v)" + +# > Clean up image +RUN set -Eeuxo pipefail && \ + printf "Cleaning image" && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ rm -rf /tmp/* && \ + printf "Cleaned up image" + +# > Create non-root user +RUN set -Eeuxo pipefail && \ + printf "Creating non-root user" && \ groupadd -g 1000 ${RUNNER_USER} && \ useradd -u 1000 -g ${RUNNER_USER} -G sudo -m -s /bin/bash ${RUNNER_USER} && \ sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' && \ sed -i /etc/sudoers -re 's/^root.*/root ALL=(ALL:ALL) NOPASSWD: ALL/g' && \ sed -i /etc/sudoers -re 's/^#includedir.*/## **Removed the include directive** ##"/g' && \ echo "${RUNNER_USER} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \ - echo "Customized the sudoers file for passwordless access to the ${RUNNER_USER} user!" && \ - echo "runner user:"; su - ${RUNNER_USER} -c id + echo "runner user: $(su - ${RUNNER_USER} -c id)" && \ + printf "Created non-root user $(grep ${RUNNER_USER} /etc/passwd)" -# Home repository -LABEL repository="https://github.com/catthehacker/docker-images" +# > Home repository +LABEL org.opencontainers.image.source="https://github.com/CatTheHacker/docker-images" -# Don't run as root, generally not good idea -USER runner +# > Don't run as root, generally not good idea +USER ${RUNNER_USER}:${RUNNER_USER} -# Force bash with environment -ENTRYPOINT [ "/bin/bash", "--login", "-c" ] +SHELL [ "/bin/bash", "--login" ] + +WORKDIR /home/runner + +# > Force bash with environment +ENTRYPOINT [ "/bin/bash", "--login" ]