Skip to content

Commit 287f3ab

Browse files
bratpiorkabratpiorka
authored
Merge pull request #188 from lukaszstolarczuk/docker
[CI] Add first dockers and trivy workflow
2 parents c860b3a + 59362f1 commit 287f3ab

File tree

5 files changed

+233
-0
lines changed

5 files changed

+233
-0
lines changed

‎.github/docker/README.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Content
2+
3+
Dockerfiles and scripts placed in this directory are intended to be used as
4+
development process vehicles and part of continuous integration process.
5+
6+
Images built out of those recipes may be used with Docker or podman as
7+
development environment. If you want to use below instructions with `podman`,
8+
simply replace word `docker` with `podman`.
9+
10+
# How to build docker image
11+
12+
To build docker image on local machine enter the root dir of the repository and execute:
13+
14+
```sh
15+
docker build -t ur:ubuntu-22.04 -f .github/docker/ubuntu-22.04.Dockerfile .
16+
```
17+
18+
To set any build time variable (e.g., an optional ARG from docker recipe), add to the command (after `build`), e.g.:
19+
20+
```sh
21+
--build-arg TEST_DEPS=""
22+
```
23+
24+
One other example of using these extra build arguments are proxy settings. They are required for accessing network
25+
(e.g., to download dependencies within docker), if a host is using a proxy server. Example usage:
26+
27+
```sh
28+
--build-arg https_proxy=http://proxy.com:port --build-arg http_proxy=http://proxy.com:port
29+
```
30+
31+
# How to use docker image
32+
33+
To run docker container (using the previously built image) execute:
34+
35+
```sh
36+
docker run --shm-size=4G -v /your/workspace/path/:/opt/workspace:z -w /opt/workspace/ -it ur:ubuntu-22.04 /bin/bash
37+
```
38+
39+
To set (or override) any docker environment variable, add to the command (after `run`):
40+
41+
```sh
42+
-e ENV_VARIABLE=VALUE
43+
```
44+
45+
To start as a non-root user (created within our Dockerfiles), add to the command (after `run`):
46+
47+
```sh
48+
--user test_user
49+
```
50+
51+
If you want to run a docker container using your specific user, please follow up, e.g.,
52+
with [this article](https://jtreminio.com/blog/running-docker-containers-as-current-host-user/).

‎.github/docker/ubuntu-20.04.Dockerfile

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# Under the Apache License v2.0 with LLVM Exceptions. See LICENSE.TXT.
3+
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
4+
5+
#
6+
# Dockerfile - a 'recipe' for Docker to build an image of ubuntu-based
7+
# environment for building the Unified Memory Framework project.
8+
#
9+
10+
# Pull base image ("20.04")
11+
FROM registry.hub.docker.com/library/ubuntu@sha256:f2034e7195f61334e6caff6ecf2e965f92d11e888309065da85ff50c617732b8
12+
13+
# Set environment variables
14+
ENV OS ubuntu
15+
ENV OS_VER 20.04
16+
ENV NOTTY 1
17+
ENV DEBIAN_FRONTEND noninteractive
18+
19+
# Base development packages
20+
ARG BASE_DEPS="\
21+
build-essential \
22+
cmake \
23+
git"
24+
25+
# UMF's dependencies
26+
ARG UMF_DEPS="\
27+
libjemalloc-dev \
28+
libhwloc-dev \
29+
libtbb-dev"
30+
31+
# Dependencies for tests (optional)
32+
ARG TEST_DEPS="\
33+
libnuma-dev"
34+
35+
# Miscellaneous for our builds/CI (optional)
36+
ARG MISC_DEPS="\
37+
clang \
38+
g++-7 \
39+
python3-pip \
40+
sudo \
41+
whois"
42+
43+
# Update and install required packages
44+
RUN apt-get update \
45+
&& apt-get install -y --no-install-recommends \
46+
${BASE_DEPS} \
47+
${UMF_DEPS} \
48+
${TEST_DEPS} \
49+
${MISC_DEPS} \
50+
&& rm -rf /var/lib/apt/lists/* \
51+
&& apt-get clean all
52+
53+
# Prepare a dir (accessible by anyone)
54+
RUN mkdir --mode 777 /opt/umf/
55+
56+
# Additional dependencies (installed via pip)
57+
COPY third_party/requirements.txt /opt/umf/requirements.txt
58+
RUN pip3 install --no-cache-dir -r /opt/umf/requirements.txt
59+
60+
# Add a new (non-root) 'test_user'
61+
ENV USER test_user
62+
ENV USERPASS pass
63+
RUN useradd -m "${USER}" -g sudo -p "$(mkpasswd ${USERPASS})"

‎.github/docker/ubuntu-22.04.Dockerfile

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# Under the Apache License v2.0 with LLVM Exceptions. See LICENSE.TXT.
3+
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
4+
5+
#
6+
# Dockerfile - a 'recipe' for Docker to build an image of ubuntu-based
7+
# environment for building the Unified Memory Framework project.
8+
#
9+
10+
# Pull base image ("22.04")
11+
FROM registry.hub.docker.com/library/ubuntu@sha256:e6173d4dc55e76b87c4af8db8821b1feae4146dd47341e4d431118c7dd060a74
12+
13+
# Set environment variables
14+
ENV OS ubuntu
15+
ENV OS_VER 22.04
16+
ENV NOTTY 1
17+
ENV DEBIAN_FRONTEND noninteractive
18+
19+
# Base development packages
20+
ARG BASE_DEPS="\
21+
build-essential \
22+
cmake \
23+
git"
24+
25+
# UMF's dependencies
26+
ARG UMF_DEPS="\
27+
libjemalloc-dev \
28+
libhwloc-dev \
29+
libtbb-dev"
30+
31+
# Dependencies for tests (optional)
32+
ARG TEST_DEPS="\
33+
libnuma-dev"
34+
35+
# Miscellaneous for our builds/CI (optional)
36+
ARG MISC_DEPS="\
37+
clang \
38+
python3-pip \
39+
sudo \
40+
whois"
41+
42+
# Update and install required packages
43+
RUN apt-get update \
44+
&& apt-get install -y --no-install-recommends \
45+
${BASE_DEPS} \
46+
${UMF_DEPS} \
47+
${TEST_DEPS} \
48+
${MISC_DEPS} \
49+
&& rm -rf /var/lib/apt/lists/* \
50+
&& apt-get clean all
51+
52+
# Prepare a dir (accessible by anyone)
53+
RUN mkdir --mode 777 /opt/umf/
54+
55+
# Additional dependencies (installed via pip)
56+
COPY third_party/requirements.txt /opt/umf/requirements.txt
57+
RUN pip3 install --no-cache-dir -r /opt/umf/requirements.txt
58+
59+
# Add a new (non-root) 'test_user'
60+
ENV USER test_user
61+
ENV USERPASS pass
62+
RUN useradd -m "${USER}" -g sudo -p "$(mkpasswd ${USERPASS})"

‎.github/workflows/trivy.yml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Runs linter for Docker files
2+
name: Trivy
3+
4+
# Due to lower score on Scorecard we're running this separately from
5+
# "PR/push" workflow. For some reason permissions weren't properly set
6+
# or recognized (by Scorecard). If Scorecard changes its behavior we can
7+
# use 'workflow_call' trigger.
8+
on:
9+
push:
10+
pull_request:
11+
paths:
12+
- '.github/docker/*Dockerfile'
13+
- '.github/workflows/trivy.yml'
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
17+
cancel-in-progress: true
18+
19+
permissions:
20+
contents: read
21+
22+
jobs:
23+
trivy:
24+
name: Trivy
25+
runs-on: ubuntu-latest
26+
permissions:
27+
security-events: write
28+
29+
steps:
30+
- name: Clone the git repo
31+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
32+
33+
- name: Run Trivy
34+
uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef # v0.17.0
35+
with:
36+
scan-type: 'config'
37+
hide-progress: false
38+
format: 'sarif'
39+
output: 'trivy-results.sarif'
40+
exit-code: 1 # Fail if issue found
41+
# See .trivyignore file with suppressions
42+
43+
- name: Upload results
44+
uses: github/codeql-action/upload-sarif@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
45+
with:
46+
sarif_file: 'trivy-results.sarif'

‎.trivyignore

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Docs: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#trivyignore
2+
3+
# In docker files:
4+
# non-root user is always created within docker, but we switch it only in CI workflows;
5+
# not enforcing non-root user makes it easier for developers to use their own users in local container
6+
AVD-DS-0002
7+
8+
# In docker files:
9+
# HEALTHCHECK is not required for development, nor in CI (failed docker = failed CI)
10+
AVD-DS-0026

0 commit comments

Comments
 (0)