Update Dockerfiles with hadolint and actions

.github/workflows/docker-master.yml → .github/.old/docker-master.yml

@@ -20,17 +20,17 @@ jobs:
     steps:
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       -
         name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -43,7 +43,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       -
         name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v5
         with:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/docker-build.yml

@@ -0,0 +1,80 @@
+name: Build and push ckan-docker image from PR Merge
+
+on:
+  pull_request:
+    types:
+        - closed
+    branches:
+        - master
+        - 'ckan-*.*.*'
+        - '!dev/ckan-*.*.*'
+        - '!feature/*'
+        - '!fix/*'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  TAG: ghcr.io/${{ github.repository }}:${{ github.head_ref }}
+  CONTEXT: .
+  BRANCH: ${{ github.head_ref }}
+  DOCKERFILE_PATH: /ckan
+  DOCKERFILE: Dockerfile
+
+jobs:
+  docker:
+    name: runner/build-docker-push:${{ github.head_ref }}
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
+
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.documentation=https://github.com/${{ github.repository }}/blob/${{ env.BRANCH }}/README.md
+            org.opencontainers.image.version=${{ env.BRANCH }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          tags: ${{ env.TAG }}
+          labels: ${{ steps.meta.outputs.labels }}
+          context: ${{ env.CONTEXT }}
+          file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+      - name: Linting Dockerfile with hadolint in GH Actions
+        uses: hadolint/[email protected]
+        with:
+          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+      - name: Run Trivy container image vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH }}
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

.github/workflows/docker-pr.yml

@@ -0,0 +1,89 @@
+name: Test ckan-docker images (PR)
+
+on:
+  pull_request:
+    branches:
+        - master
+        - 'ckan-*.*.*'
+        - '!dev/ckan-*.*.*'
+        - '!feature/*'
+        - '!fix/*'
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ckan-docker-spatial
+    CONTEXT: .
+    BRANCH: ${{ github.head_ref }}
+    DOCKERFILE_PATH: /ckan
+    DOCKERFILE: Dockerfile
+    HADOLINT_VERSION: 2.12.0
+
+jobs:
+  docker:
+    name: runner/test-docker-pr:${{ github.head_ref }}
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      -  name: NGINX build
+         uses: docker/build-push-action@v5
+         with:
+            context: ./nginx
+            file: ./nginx/Dockerfile
+            push: false
+            tags: mjanez/ckan-docker-nginx:test-build-only
+
+      -  name: Apache HTTP Server build
+         uses: docker/build-push-action@v5
+         with:
+            context: ./apache
+            file: ./apache/Dockerfile
+            push: false
+            tags: mjanez/ckan-docker-apache:test-build-only
+
+      -  name: PostgreSQL build
+         uses: docker/build-push-action@v5
+         with:
+              context: ./postgresql
+              file: ./postgresql/Dockerfile
+              push: false
+              tags: mjanez/ckan-docker-postgresql:test-build-only
+
+      -  name: Solr build
+         uses: docker/build-push-action@v5
+         with:
+              context: ./solr
+              file: ./solr/Dockerfile
+              push: false
+              tags: mjanez/ckan-docker-solr:test-build-only
+
+      -  name: ckan-pycsw build
+         uses: docker/build-push-action@v4
+         with:
+              context: ./ckan-pycsw
+              file: ./ckan-pycsw/Dockerfile
+              push: false
+              tags: mjanez/ckan-docker-pycsw:test-build-only
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Linting Dockerfiles and annotate code inline in the github PR viewer
+        id: hadolint
+        uses: jbergstroem/[email protected]
+        with:
+          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }} ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}.ghcr
+          version: ${{ env.HADOLINT_VERSION }}
+          annotate: true
+          error_level: -1

ckan/Dockerfile

@@ -1,11 +1,15 @@
 FROM ghcr.io/mjanez/ckan-base-spatial:ckan-2.9.9
+LABEL maintainer="[email protected]"
 
 # Set up environment variables
-ENV APP_DIR=/srv/app \
-    TZ=UTC
+ENV APP_DIR=/srv/app
+ENV TZ=UTC
+
+# Set working directory
+WORKDIR ${APP_DIR}
 
 # requirements.txt files fixed until next releases
-COPY req_fixes ${APP_DIR}/req_fixes
+COPY req_fixes req_fixes
 
 # Extensions
 ### XLoader - 1.0.1 ###
@@ -19,46 +23,46 @@
 ### PDFView - 0.0.8 ###
 ### Scheming DCAT - v2.0.0 (GeoDCAT-AP/NTI-RISP extended version) ###
 ### SPARQL Interface - 2.0.1 ###
 RUN echo ${TZ} > /etc/timezone && \
     if ! [ /usr/share/zoneinfo/${TZ} -ef /etc/localtime ]; then cp /usr/share/zoneinfo/${TZ} /etc/localtime ; fi && \
     # Install CKAN extensions
     echo "ckan/ckanext-xloader" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-xloader && \ 
-    pip3 install -r ${APP_DIR}/src/ckanext-xloader/requirements.txt && \
-    pip3 install -U requests[security] && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-xloader && \ 
+    pip3 install --no-cache-dir -r ${APP_DIR}/src/ckanext-xloader/requirements.txt && \
+    pip3 install --no-cache-dir -U requests[security] && \
     echo "ckan/ckanext-harvest" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-harvest && \
-    pip3 install -r ${APP_DIR}/src/ckanext-harvest/pip-requirements.txt && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-harvest && \
+    pip3 install --no-cache-dir -r ${APP_DIR}/src/ckanext-harvest/pip-requirements.txt && \
     echo "ckan/ckanext-geoview" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-geoview && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-geoview && \
     echo "ckan/ckanext-spatial" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-spatial && \
-    pip3 install -r ${APP_DIR}/req_fixes/ckanext-spatial_requirements.txt && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-spatial && \
+    pip3 install --no-cache-dir -r ${APP_DIR}/req_fixes/ckanext-spatial_requirements.txt && \
     echo "mjanez/ckanext-dcat (GeoDCAT-AP extended version)" && \
-    pip3 install -e git+https://github.com/mjanez/[email protected]#egg=ckanext-dcat && \
-    pip3 install -r ${APP_DIR}/src/ckanext-dcat/requirements.txt && \
+    pip3 install --no-cache-dir -e git+https://github.com/mjanez/[email protected]#egg=ckanext-dcat && \
+    pip3 install --no-cache-dir -r ${APP_DIR}/src/ckanext-dcat/requirements.txt && \
     echo "ckan/ckanext-scheming" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-scheming && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-scheming && \
     echo "mjanez/ckanext-resourcedictionary" && \
-    pip3 install -e git+https://github.com/mjanez/[email protected]#egg=ckanext-resourcedictionary && \
+    pip3 install --no-cache-dir -e git+https://github.com/mjanez/[email protected]#egg=ckanext-resourcedictionary && \
     echo "ckan/ckanext-pages" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-pages && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-pages && \
     echo "ckan/ckanext-pdfview" && \
-    pip3 install -e git+https://github.com/ckan/[email protected]#egg=ckanext-pdfview && \
+    pip3 install --no-cache-dir -e git+https://github.com/ckan/[email protected]#egg=ckanext-pdfview && \
     echo "mjanez/ckanext-scheming_dcat" && \
-    pip3 install -e git+https://github.com/mjanez/[email protected]#egg=ckanext_scheming_dcat && \
-    pip3 install -r https://raw.githubusercontent.com/mjanez/ckanext-scheming_dcat/v2.0.0/requirements.txt
+    pip3 install --no-cache-dir -e git+https://github.com/mjanez/[email protected]#egg=ckanext_scheming_dcat && \
+    pip3 install --no-cache-dir -r https://raw.githubusercontent.com/mjanez/ckanext-scheming_dcat/v2.0.0/requirements.txt
 
 # Used to configure the container environment by setting environment variables, creating users, running initialization scripts, .etc
 COPY docker-entrypoint.d/* /docker-entrypoint.d/
 
 # Update who.ini with PROXY_CKAN_LOCATION
-COPY setup/who.ini ${APP_DIR}/
+COPY setup/who.ini ./
 
 # Apply any patches needed to CKAN core
-COPY patches ${APP_DIR}/patches
+COPY patches patches
 
 RUN for d in $APP_DIR/patches/*; do \
     if [ -d $d ]; then \
     for f in `ls $d/*.patch | sort -g`; do \
     cd $SRC_DIR/`basename "$d"` && echo "$0: Applying patch $f to $SRC_DIR/`basename $d`"; patch -p1 < "$f" ; \
@@ -66,4 +70,4 @@
     fi ; \
     done
 
-CMD $APP_DIR/start_ckan.sh
+CMD ["/bin/sh", "-c", "$APP_DIR/start_ckan.sh"]

ckan/Dockerfile.dev

@@ -1,9 +1,13 @@
 FROM ghcr.io/mjanez/ckan-base-spatial:ckan-2.9.9-dev
+LABEL maintainer="[email protected]"
 
 # Set up environment variables
-ENV APP_DIR=/srv/app \
-    TZ=UTC \
-    SRC_EXTENSIONS_DIR=/srv/app/src_extensions
+ENV APP_DIR=/srv/app
+ENV TZ=UTC
+ENV SRC_EXTENSIONS_DIR=/srv/app/src_extensions
+
+# Set working directory
+WORKDIR ${APP_DIR}
 
 RUN echo ${TZ} > /etc/timezone && \
     set -ex && apk --no-cache add sudo && \
@@ -47,23 +51,29 @@ RUN echo ${TZ} > /etc/timezone && \
 # to get them mounted in this image at runtime
 
 # Used to configure the container environment by setting environment variables, creating users, running initialization scripts, .etc
-COPY docker-entrypoint.d/* /docker-entrypoint.d/
+COPY docker-entrypoint.d/* docker-entrypoint.d/
 
 # Update who.ini with PROXY_CKAN_LOCATION
-COPY setup/who.ini ${APP_DIR}/
+COPY setup/who.ini ./
 
 # Override start_ckan.sh with DEV sh
-COPY setup/start_ckan_development.sh.override ${APP_DIR}/start_ckan_development.sh
-RUN chmod +x ${APP_DIR}/start_ckan_development.sh
+COPY setup/start_ckan_development.sh.override start_ckan_development.sh
+RUN chmod +x start_ckan_development.sh
 
 # Apply any patches needed to CKAN core or any of the built extensions (not the
-# runtime mounted ones)
-COPY patches ${APP_DIR}/patches
+# runtime mounted ones!)
+COPY patches patches
 
 RUN for d in $APP_DIR/patches/*; do \
     if [ -d $d ]; then \
-    for f in `ls $d/*.patch | sort -g`; do \
-    cd $SRC_DIR/`basename "$d"` && echo "$0: Applying patch $f to $SRC_DIR/`basename $d`"; patch -p1 < "$f" ; \
-    done ; \
+        for f in `ls $d/*.patch | sort -g`; do \
+            if [ -d $SRC_DIR/`basename "$d"` ]; then \
+                cd $SRC_DIR/`basename "$d"` && \
+                echo "$0: Applying patch $f to $SRC_DIR/`basename $d`" && \
+                patch -p1 < "$f" ; \
+            else \
+                echo "$0: Skipping patch $f because directory $SRC_DIR/`basename $d` does not exist. Built the extension: `basename $d`" ; \
+            fi \
+        done ; \
     fi ; \
-    done
+done

ckan/Dockerfile.ghcr

@@ -1,26 +1,30 @@
 FROM ghcr.io/mjanez/ckan-spatial:ckan-2.9.9
+LABEL maintainer="[email protected]"
 
 # Set up environment variables
 ENV APP_DIR=/srv/app
 ENV TZ=UTC
-RUN echo ${TZ} > /etc/timezone
+
+# Set working directory
+WORKDIR ${APP_DIR}
 
 # Make sure both files are not exactly the same
-RUN if ! [ /usr/share/zoneinfo/${TZ} -ef /etc/localtime ]; then \
-    cp /usr/share/zoneinfo/${TZ} /etc/localtime ;\
+RUN echo ${TZ} > /etc/timezone && \
+    if ! [ /usr/share/zoneinfo/${TZ} -ef /etc/localtime ]; then \
+        cp /usr/share/zoneinfo/${TZ} /etc/localtime ; \
     fi ;
 
 # Used to configure the container environment by setting environment variables, creating users, running initialization scripts, .etc
-COPY docker-entrypoint.d/* /docker-entrypoint.d/
+COPY docker-entrypoint.d/* docker-entrypoint.d/
 
 # Update who.ini with PROXY_CKAN_LOCATION
-COPY setup/who.ini ${APP_DIR}/
+COPY setup/who.ini ./
 
 # Apply any patches needed to CKAN core
-COPY patches ${APP_DIR}/patches
+COPY patches patches
 
 #  Updated version of the Dockerfile RUN command that skips applying a patch if a reversed or previously applied patch is detected
 RUN for d in $APP_DIR/patches/*; do \
     if [ -d $d ]; then \
         for f in `ls $d/*.patch | sort -g`; do \
             cd $SRC_DIR/`basename "$d"` && \
@@ -34,4 +38,4 @@
     fi ; \
 done
 
-CMD $APP_DIR/start_ckan.sh
+CMD ["/bin/sh", "-c", "$APP_DIR/start_ckan.sh"]