From d761f63ca6c39b2de0c7e6c0bcbc4f8de7bace2d Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Mon, 5 Aug 2019 23:38:12 +0800 Subject: [PATCH 1/6] Quote var & function output shell scripts in Dockerfile --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1a1325f..43b9205 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ RUN set -x && \ useradd -g _unbound -s /etc -d /dev/null _unbound && \ ./configure --prefix=/opt/unbound --with-pthreads \ --with-username=_unbound --with-libevent --enable-event-api && \ - make -j$(getconf _NPROCESSORS_ONLN) install && \ + make -j"$(getconf _NPROCESSORS_ONLN)" install && \ mv /opt/unbound/etc/unbound/unbound.conf /opt/unbound/etc/unbound/unbound.conf.example && \ apk del --purge $BUILD_DEPS && \ rm -fr /opt/unbound/share/man && \ @@ -38,7 +38,7 @@ RUN set -x && \ git clone --depth=1 --branch stable "$LIBSODIUM_GIT_URL" && \ cd libsodium && \ env CFLAGS=-Ofast ./configure --disable-dependency-tracking && \ - make -j$(getconf _NPROCESSORS_ONLN) check && make -j$(getconf _NPROCESSORS_ONLN) install && \ + make -j"$(getconf _NPROCESSORS_ONLN)" check && make -j"$(getconf _NPROCESSORS_ONLN)" install && \ ldconfig /usr/local/lib && \ apk del --purge $BUILD_DEPS && \ rm -fr /tmp/* /var/tmp/* @@ -52,7 +52,7 @@ RUN set -x && \ apk add --no-cache $BUILD_DEPS && \ mkdir -p /tmp/src && \ cd /tmp/src && \ - git clone --depth=1 --branch=${DNSCRYPT_WRAPPER_GIT_BRANCH} ${DNSCRYPT_WRAPPER_GIT_URL} && \ + git clone --depth=1 --branch="${DNSCRYPT_WRAPPER_GIT_BRANCH}" "${DNSCRYPT_WRAPPER_GIT_URL}" && \ cd dnscrypt-wrapper && \ sed -i 's##"/tmp/queue.h"#' compat.h && \ sed -i 's#HAVE_BACKTRACE#NO_BACKTRACE#' compat.h && \ @@ -61,9 +61,9 @@ RUN set -x && \ useradd -g _dnscrypt-wrapper -s /etc -d /opt/dnscrypt-wrapper/empty _dnscrypt-wrapper && \ groupadd _dnscrypt-signer && \ useradd -g _dnscrypt-signer -G _dnscrypt-wrapper -s /etc -d /dev/null _dnscrypt-signer && \ - make -j$(getconf _NPROCESSORS_ONLN) configure && \ + make -j"$(getconf _NPROCESSORS_ONLN)" configure && \ env CFLAGS=-Ofast ./configure --prefix=/opt/dnscrypt-wrapper && \ - make -j$(getconf _NPROCESSORS_ONLN) install && \ + make -j"$(getconf _NPROCESSORS_ONLN)" install && \ apk del --purge $BUILD_DEPS && \ rm -fr /tmp/* /var/tmp/* From f2ffba78a332bcaef69575c04afff283d5f89ecb Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Mon, 5 Aug 2019 23:44:31 +0800 Subject: [PATCH 2/6] Set `-x` option in SHELL command in Dockerfile Intead of running `set -x` in the RUN commands --- Dockerfile | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index 43b9205..1e5280a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,19 +1,18 @@ FROM jedisct1/alpine-runit:latest MAINTAINER Frank Denis +SHELL ["/bin/sh", "-x", "-c"] ENV SERIAL 3 ENV BUILD_DEPS make gcc musl-dev git libevent-dev expat-dev shadow autoconf file openssl-dev byacc linux-headers ENV RUNTIME_DEPS bash util-linux coreutils findutils grep openssl ldns ldns-tools libevent expat libexecinfo coreutils drill ca-certificates -RUN set -x && \ - apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS && \ +RUN apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS && \ update-ca-certificates 2> /dev/null || true ENV UNBOUND_GIT_URL https://github.com/jedisct1/unbound.git ENV UNBOUND_GIT_REVISION 4edb15ba417c78710069a5be8be3a6b5d8bdba9c -RUN set -x && \ - apk add --no-cache $BUILD_DEPS && \ +RUN apk add --no-cache $BUILD_DEPS && \ mkdir -p /tmp/src && \ cd /tmp/src && \ git clone --depth=1000 "$UNBOUND_GIT_URL" && \ @@ -31,8 +30,7 @@ RUN set -x && \ ENV LIBSODIUM_GIT_URL https://github.com/jedisct1/libsodium.git -RUN set -x && \ - apk add --no-cache $BUILD_DEPS && \ +RUN apk add --no-cache $BUILD_DEPS && \ mkdir -p /tmp/src && \ cd /tmp/src && \ git clone --depth=1 --branch stable "$LIBSODIUM_GIT_URL" && \ @@ -48,8 +46,7 @@ ENV DNSCRYPT_WRAPPER_GIT_BRANCH xchacha-stamps COPY queue.h /tmp -RUN set -x && \ - apk add --no-cache $BUILD_DEPS && \ +RUN apk add --no-cache $BUILD_DEPS && \ mkdir -p /tmp/src && \ cd /tmp/src && \ git clone --depth=1 --branch="${DNSCRYPT_WRAPPER_GIT_BRANCH}" "${DNSCRYPT_WRAPPER_GIT_URL}" && \ @@ -67,8 +64,7 @@ RUN set -x && \ apk del --purge $BUILD_DEPS && \ rm -fr /tmp/* /var/tmp/* -RUN set -x && \ - echo rm -rf /tmp/* /var/tmp/* /usr/local/include +RUN echo rm -rf /tmp/* /var/tmp/* /usr/local/include RUN mkdir -p \ /etc/service/unbound \ From bc3b60aef93d24ac3177247251319d8c19a7bcc4 Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Mon, 5 Aug 2019 23:56:18 +0800 Subject: [PATCH 3/6] Simplify Dockerfile with `WORKDIR /tmp` --- Dockerfile | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1e5280a..cb51ad0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,9 +12,9 @@ RUN apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS && \ ENV UNBOUND_GIT_URL https://github.com/jedisct1/unbound.git ENV UNBOUND_GIT_REVISION 4edb15ba417c78710069a5be8be3a6b5d8bdba9c +WORKDIR /tmp + RUN apk add --no-cache $BUILD_DEPS && \ - mkdir -p /tmp/src && \ - cd /tmp/src && \ git clone --depth=1000 "$UNBOUND_GIT_URL" && \ cd unbound && \ git checkout "$UNBOUND_GIT_REVISION" && \ @@ -31,8 +31,6 @@ RUN apk add --no-cache $BUILD_DEPS && \ ENV LIBSODIUM_GIT_URL https://github.com/jedisct1/libsodium.git RUN apk add --no-cache $BUILD_DEPS && \ - mkdir -p /tmp/src && \ - cd /tmp/src && \ git clone --depth=1 --branch stable "$LIBSODIUM_GIT_URL" && \ cd libsodium && \ env CFLAGS=-Ofast ./configure --disable-dependency-tracking && \ @@ -47,8 +45,6 @@ ENV DNSCRYPT_WRAPPER_GIT_BRANCH xchacha-stamps COPY queue.h /tmp RUN apk add --no-cache $BUILD_DEPS && \ - mkdir -p /tmp/src && \ - cd /tmp/src && \ git clone --depth=1 --branch="${DNSCRYPT_WRAPPER_GIT_BRANCH}" "${DNSCRYPT_WRAPPER_GIT_URL}" && \ cd dnscrypt-wrapper && \ sed -i 's##"/tmp/queue.h"#' compat.h && \ From f658223f00d9e686ecb39d10d7a308f2355e7407 Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Mon, 5 Aug 2019 23:56:53 +0800 Subject: [PATCH 4/6] Remove dead code in Dockerfile --- Dockerfile | 2 -- 1 file changed, 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index cb51ad0..6670b9a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -60,8 +60,6 @@ RUN apk add --no-cache $BUILD_DEPS && \ apk del --purge $BUILD_DEPS && \ rm -fr /tmp/* /var/tmp/* -RUN echo rm -rf /tmp/* /var/tmp/* /usr/local/include - RUN mkdir -p \ /etc/service/unbound \ /etc/service/watchdog From 11e4f8620f7441af00687664be54c6f28c7571bf Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Tue, 6 Aug 2019 00:00:22 +0800 Subject: [PATCH 5/6] Separate `CFLAGS=-Ofast` to ENV in Dockerfile --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6670b9a..1eae90f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,6 +3,7 @@ MAINTAINER Frank Denis SHELL ["/bin/sh", "-x", "-c"] ENV SERIAL 3 +ENV CFLAGS=-Ofast ENV BUILD_DEPS make gcc musl-dev git libevent-dev expat-dev shadow autoconf file openssl-dev byacc linux-headers ENV RUNTIME_DEPS bash util-linux coreutils findutils grep openssl ldns ldns-tools libevent expat libexecinfo coreutils drill ca-certificates @@ -33,7 +34,7 @@ ENV LIBSODIUM_GIT_URL https://github.com/jedisct1/libsodium.git RUN apk add --no-cache $BUILD_DEPS && \ git clone --depth=1 --branch stable "$LIBSODIUM_GIT_URL" && \ cd libsodium && \ - env CFLAGS=-Ofast ./configure --disable-dependency-tracking && \ + ./configure --disable-dependency-tracking && \ make -j"$(getconf _NPROCESSORS_ONLN)" check && make -j"$(getconf _NPROCESSORS_ONLN)" install && \ ldconfig /usr/local/lib && \ apk del --purge $BUILD_DEPS && \ @@ -55,7 +56,7 @@ RUN apk add --no-cache $BUILD_DEPS && \ groupadd _dnscrypt-signer && \ useradd -g _dnscrypt-signer -G _dnscrypt-wrapper -s /etc -d /dev/null _dnscrypt-signer && \ make -j"$(getconf _NPROCESSORS_ONLN)" configure && \ - env CFLAGS=-Ofast ./configure --prefix=/opt/dnscrypt-wrapper && \ + ./configure --prefix=/opt/dnscrypt-wrapper && \ make -j"$(getconf _NPROCESSORS_ONLN)" install && \ apk del --purge $BUILD_DEPS && \ rm -fr /tmp/* /var/tmp/* From fee7c88a0432ff80a0e30101392491734823d188 Mon Sep 17 00:00:00 2001 From: Peter Dave Hello Date: Tue, 6 Aug 2019 00:31:00 +0800 Subject: [PATCH 6/6] Separate `update-ca-certificates` in Dockerfile Combine it with apk operation, will cause missing error issues due to the following `|| true`, we should prevent that and let apk fail when it's needed. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1eae90f..0ff383b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,8 +7,8 @@ ENV CFLAGS=-Ofast ENV BUILD_DEPS make gcc musl-dev git libevent-dev expat-dev shadow autoconf file openssl-dev byacc linux-headers ENV RUNTIME_DEPS bash util-linux coreutils findutils grep openssl ldns ldns-tools libevent expat libexecinfo coreutils drill ca-certificates -RUN apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS && \ - update-ca-certificates 2> /dev/null || true +RUN apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS +RUN update-ca-certificates 2> /dev/null || true ENV UNBOUND_GIT_URL https://github.com/jedisct1/unbound.git ENV UNBOUND_GIT_REVISION 4edb15ba417c78710069a5be8be3a6b5d8bdba9c