This significantly reworks the docker support to provide build a
lightweight non-root distroless container image based on scratch.  It
employs a multi-stage build that downloads and builds the latest source
code, compresses the resulting binaries, and then produces the final
image based on scratch that only includes the Decred-specific binaries.

It must be noted that there are some still remaining TODO items in the
documentation as well as the Dockerfile that will need to be handled by
a future commit, but the changes are being submitted now to allow
another contributor to finish up those aspects.

The following is an overview of the changes:

- Removes existing Dockerfile and Dockerfile.alpine
- Introduces a new Dockerfile under contrib/docker with the following
  properties:
  - Runs as a non-root user
  - Uses a static UID:GID of 10000:10000
    - Note that using UIDs/GIDs below 10000 for container users is a
      security risk on several systems since a hypothetical attack which
      allows escalation outside of the container might otherwise
      coincide with an existing user's UID or existing group's GID which
      has additional permissions
  - The image is based on scratch image (aka completely empty) and only
    includes the Decred-specific binaries which means there is no shell
    or any other binaries available if an attacker were to somehow
    manage to find a remote execution vulnerability exploit in a Decred
    binary
- Introduces code to build an entrypoint for the image since it is based
  on scratch and thus has no shell for that purpose
- Adds contrib/docker/README.md
- Updates README.md in the main directory to account for changes
  - There is still outstanding work to be done here and thus has several
    TODOs
- Updates contrib/README.md to call out the new addition

2021-09-18 13:17:41 -05:00

1.9 KiB

Raw Blame History

contrib

Overview

This consists of extra optional tools which may be useful when working with dcrd and related software.

Example Service Configurations

OpenBSD rc.d
Provides an example rc.d script for configuring dcrd as a background service on OpenBSD. It also serves as a good starting point for other operating systems that use the rc.d system for service management.
Service Management Facility
Provides an example XML file for configuring dcrd as a background service on illumos. It also serves as a good starting point for other operating systems that use use SMF for service management.
systemd
Provides an example service file for configuring dcrd as a background service on operating systems that use systemd for service management.

Simulation Network (--simnet) Preconfigured Environment Setup Script

The dcr_tmux_simnet_setup.sh script provides a preconfigured simnet environment which facilitates testing with a private test network where the developer has full control since the difficulty levels are low enough to generate blocks on demand and the developer owns all of the tickets and votes on the private network.

The environment will be housed in the $HOME/dcrdsimnetnodes directory by default. This can be overridden with the DCR_SIMNET_ROOT environment variable if desired.

See the full Simulation Network Reference for more details.

Building and Running OCI Containers (aka Docker/Podman)

The project does not officially provide container images. However, all of the necessary files to build your own lightweight non-root container image based on scratch from the latest source code are available in the docker directory. See docker/README.md for more details.

1.9 KiB Raw Blame History