240db4e2a7
Some checks failed
Server CI / Postgres (shard 0) (push) Has been skipped
Server CI / Postgres (shard 3) (push) Has been skipped
BuildEnv Docker Image / build-image (push) Failing after 4s
BuildEnv Docker Image / build-image-fips (push) Failing after 4s
Migration Review & Release Notes / Generate migration review & release notes (push) Failing after 3s
Server CI / Build Environment (push) Failing after 3s
Server CI / Postgres (shard 1) (push) Has been skipped
Tools CI / check-style (mattermost-govet) (push) Failing after 4s
Server CI / Postgres (shard 2) (push) Has been skipped
Tools CI / check-style (mmgotool) (push) Failing after 3s
Server CI / Elasticsearch v8 Compatibility (push) Has been skipped
Server CI / OpenSearch v2 Compatibility (push) Has been skipped
Server CI / Postgres FIPS (shard 0) (push) Has been skipped
Tools CI / Test (mattermost-govet) (push) Failing after 3s
Server CI / Postgres FIPS (shard 1) (push) Has been skipped
Server CI / Postgres FIPS (shard 2) (push) Has been skipped
Tools CI / Test (mmgotool) (push) Failing after 3s
Server CI / Postgres FIPS (shard 3) (push) Has been skipped
Server CI / Run mmctl tests (push) Has been skipped
Server CI / Run mmctl tests (FIPS) (push) Has been skipped
Server CI / Merge Postgres Test Results (push) Has been skipped
Server CI / Merge Postgres FIPS Test Results (push) Has been skipped
Server CI / Check backport migrations (push) Has been skipped
Server CI / Check generated files (push) Has been skipped
Server CI / check-style (push) Has been skipped
Server CI / Vet API (push) Has been skipped
Server CI / Build mattermost server app (push) Has been skipped
Server CI / Server CI Complete (push) Failing after 2s
Server CI / Server CI Artifacts (push) Has been skipped
Server CI / Sentry Upload (push) Has been skipped
Server CI / Server CI Report (push) Failing after 5m1s
Server CI Nightly Race / Race Detector (push) Has been skipped
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Webapp CI Cache Warm / Warm Webapp node_modules Cache (push) Has been cancelled
E2E CI Cache Warm / Warm E2E npm Registry Cache (push) Has been cancelled
API / build (push) Has been cancelled
Web App CI / check-types (push) Has been cancelled
Web App CI / check-lint (push) Has been cancelled
Web App CI / check-i18n (push) Has been cancelled
Web App CI / check-external-links (push) Has been cancelled
Web App CI / test (platform) (push) Has been cancelled
Web App CI / test (mattermost-redux) (push) Has been cancelled
Web App CI / test (channels shard 1/4) (push) Has been cancelled
Web App CI / test (channels shard 2/4) (push) Has been cancelled
Web App CI / test (channels shard 3/4) (push) Has been cancelled
Web App CI / test (channels shard 4/4) (push) Has been cancelled
Web App CI / upload-coverage (push) Has been cancelled
Web App CI / build (push) Has been cancelled
YAML Lint / yamllint (push) Has been cancelled
Push mirrored docker images / cd/Push mirrored docker images (push) Has been cancelled
docs-cd / Build and deploy docs (push) Has been cancelled
Docs CI / build (push) Has been cancelled
E2E Cache Warm: Cypress deps / Warm Cypress deps cache (push) Has been cancelled
Scorecards supply-chain security / Scorecard analysis (push) Has been cancelled
Server CI Weekly / Postgres FIPS (push) Has been skipped
Server CI Weekly / Run mmctl tests (FIPS) (push) Has been skipped
Server CI Weekly / Postgres with binary parameters (push) Has been skipped
Server CI Weekly / Build Environment (push) Failing after 1s
Server CI Cache Warm / Warm Go Module and Build Cache (push) Failing after 2s
Server CI Nightly Race / Build Environment (push) Failing after 1s
92 lines
3.5 KiB
Docker
92 lines
3.5 KiB
Docker
# First stage - FIPS dev image with dependencies for building
|
|
FROM cgr.dev/mattermost.com/glibc-openssl-fips:16-dev@sha256:e971e3eb6b5ffd227e17d0fa7944e3430d3e8e24e9587d5488a833139629ab0f AS builder
|
|
# Setting bash as our shell, and enabling pipefail option
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
|
|
# Build Arguments
|
|
ARG PUID=2000
|
|
ARG PGID=2000
|
|
# MM_PACKAGE build arguments controls which version of mattermost to install, defaults to latest stable enterprise
|
|
# e.g. https://releases.mattermost.com/9.7.1/mattermost-9.7.1-linux-amd64.tar.gz
|
|
ARG MM_PACKAGE="https://latest.mattermost.com/mattermost-enterprise-linux"
|
|
|
|
# Install needed packages and indirect dependencies
|
|
USER 0:0
|
|
RUN apk add \
|
|
curl \
|
|
ca-certificates \
|
|
mailcap \
|
|
unrtf \
|
|
wv \
|
|
poppler-utils \
|
|
tzdata
|
|
|
|
# Set mattermost group/user and download Mattermost
|
|
RUN mkdir -p /mattermost/data /mattermost/plugins /mattermost/client/plugins \
|
|
&& addgroup -g ${PGID} mattermost \
|
|
&& adduser -D -u ${PUID} -G mattermost -g "" -s /bin/sh -h /mattermost mattermost \
|
|
&& curl -L $MM_PACKAGE | tar -xvz \
|
|
&& chown -R mattermost:mattermost /mattermost /mattermost/data /mattermost/plugins /mattermost/client/plugins
|
|
|
|
# Create PostgreSQL client SSL directory structure for ssl_mode=require
|
|
RUN mkdir -p /mattermost/.postgresql \
|
|
&& chmod 700 /mattermost/.postgresql
|
|
|
|
# Create /var/tmp directory needed for local socket files
|
|
RUN mkdir -p /var/tmp \
|
|
&& chmod 755 /var/tmp
|
|
|
|
# Final stage using FIPS runtime image
|
|
FROM cgr.dev/mattermost.com/glibc-openssl-fips:16@sha256:a636adba740bb6a53e55c14f7deb979802bcff2203f4aaecfe6f1d159cdfe3a1
|
|
|
|
# Some ENV variables
|
|
ENV PATH="/mattermost/bin:${PATH}"
|
|
ENV MM_SERVICESETTINGS_ENABLELOCALMODE="true"
|
|
ENV MM_INSTALL_TYPE="docker"
|
|
|
|
# Copy over metadata files needed by runtime
|
|
COPY --from=builder /etc/mime.types /etc
|
|
|
|
# Copy CA certificates for SSL/TLS validation with proper ownership
|
|
COPY --from=builder --chown=2000:2000 /etc/ssl/certs /etc/ssl/certs
|
|
|
|
# Copy document processing utilities and necessary support files
|
|
COPY --from=builder /usr/bin/pdftotext /usr/bin/pdftotext
|
|
COPY --from=builder /usr/bin/wvText /usr/bin/wvText
|
|
COPY --from=builder /usr/bin/wvWare /usr/bin/wvWare
|
|
COPY --from=builder /usr/bin/unrtf /usr/bin/unrtf
|
|
COPY --from=builder /usr/share/wv /usr/share/wv
|
|
|
|
# Copy necessary libraries for document processing utilities
|
|
COPY --from=builder /usr/lib/libpoppler.so* /usr/lib/
|
|
COPY --from=builder /usr/lib/libfreetype.so* /usr/lib/
|
|
COPY --from=builder /usr/lib/libpng16.so* /usr/lib/
|
|
COPY --from=builder /usr/lib/libwv.so* /usr/lib/
|
|
COPY --from=builder /usr/lib/libfontconfig.so* /usr/lib/
|
|
|
|
# Copy mattermost from builder stage
|
|
COPY --from=builder --chown=2000:2000 /mattermost /mattermost
|
|
|
|
# Copy group and passwd files including mattermost user
|
|
COPY --from=builder /etc/passwd /etc/passwd
|
|
COPY --from=builder /etc/group /etc/group
|
|
|
|
# Copy /var/tmp directory needed for local socket files
|
|
COPY --from=builder --chown=2000:2000 /var/tmp /var/tmp
|
|
|
|
# We should refrain from running as privileged user
|
|
USER mattermost
|
|
|
|
# Healthcheck to make sure container is ready - using mmctl instead of curl for distroless compatibility
|
|
HEALTHCHECK --interval=30s --timeout=10s \
|
|
CMD ["/mattermost/bin/mmctl", "system", "status", "--local"]
|
|
|
|
# Configure entrypoint and command with proper permissions
|
|
WORKDIR /mattermost
|
|
CMD ["/mattermost/bin/mattermost"]
|
|
|
|
EXPOSE 8065 8067 8074
|
|
|
|
# Declare volumes for mount point directories
|
|
VOLUME ["/mattermost/data", "/mattermost/logs", "/mattermost/config", "/mattermost/plugins", "/mattermost/client/plugins"]
|