563e89099e
This significantly reworks the docker support to provide build a
lightweight non-root distroless container image based on scratch. It
employs a multi-stage build that downloads and builds the latest source
code, compresses the resulting binaries, and then produces the final
image based on scratch that only includes the Decred-specific binaries.
It must be noted that there are some still remaining TODO items in the
documentation as well as the Dockerfile that will need to be handled by
a future commit, but the changes are being submitted now to allow
another contributor to finish up those aspects.
The following is an overview of the changes:
- Removes existing Dockerfile and Dockerfile.alpine
- Introduces a new Dockerfile under contrib/docker with the following
properties:
- Runs as a non-root user
- Uses a static UID:GID of 10000:10000
- Note that using UIDs/GIDs below 10000 for container users is a
security risk on several systems since a hypothetical attack which
allows escalation outside of the container might otherwise
coincide with an existing user's UID or existing group's GID which
has additional permissions
- The image is based on scratch image (aka completely empty) and only
includes the Decred-specific binaries which means there is no shell
or any other binaries available if an attacker were to somehow
manage to find a remote execution vulnerability exploit in a Decred
binary
- Introduces code to build an entrypoint for the image since it is based
on scratch and thus has no shell for that purpose
- Adds contrib/docker/README.md
- Updates README.md in the main directory to account for changes
- There is still outstanding work to be done here and thus has several
TODOs
- Updates contrib/README.md to call out the new addition
|
||
|---|---|---|
| .. | ||
| docker | ||
| services | ||
| dcr_tmux_simnet_setup.sh | ||
| README.md | ||
contrib
Overview
This consists of extra optional tools which may be useful when working with dcrd and related software.
Contents
Example Service Configurations
-
OpenBSD rc.d
Provides an examplerc.dscript for configuring dcrd as a background service on OpenBSD. It also serves as a good starting point for other operating systems that use the rc.d system for service management. -
Service Management Facility
Provides an example XML file for configuring dcrd as a background service on illumos. It also serves as a good starting point for other operating systems that use use SMF for service management. -
systemd
Provides an example service file for configuring dcrd as a background service on operating systems that use systemd for service management.
Simulation Network (--simnet) Preconfigured Environment Setup Script
The dcr_tmux_simnet_setup.sh script provides a
preconfigured simnet environment which facilitates testing with a private test
network where the developer has full control since the difficulty levels are low
enough to generate blocks on demand and the developer owns all of the tickets
and votes on the private network.
The environment will be housed in the $HOME/dcrdsimnetnodes directory by
default. This can be overridden with the DCR_SIMNET_ROOT environment variable
if desired.
See the full Simulation Network Reference for more details.
Building and Running OCI Containers (aka Docker/Podman)
The project does not officially provide container images. However, all of the
necessary files to build your own lightweight non-root container image based on
scratch from the latest source code are available in the docker directory.
See docker/README.md for more details.