Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(docker): harden docker image #394

Open
wants to merge 95 commits into
base: main
Choose a base branch
from
Open

feat(docker): harden docker image #394

wants to merge 95 commits into from

Conversation

hazcod
Copy link

@hazcod hazcod commented Jun 30, 2022

This change removes the alpine docker image with an empty scratch image.
This removes a bunch of attack surface which is unused anyway.
Additionally it adds-in an unprivileged user such that root is no longer used to reduce attack surface.

benbjohnson and others added 30 commits June 14, 2021 15:24
@benbjohnson
Group replica wal segments by index
fc897b4 
This commit changes the replica path format to group segments within
a single index in the same directory. This is to eventually add the
ability to seek to a record on file-based systems without having
to iterate over the records. The DB shadow WAL will also be changed
to this same format to support live replicas.
@benbjohnson
Refactor shadow WAL to use segments
77274ab
@benbjohnson
README
6db0606
@benbjohnson
Update contribution policy
aa2c684
@colin-sitehost @benbjohnson
Replica.Restore fallback to DB.path
cb33d8c 
Per the godoc on Replica.Restore and RestoreOptions.OutputPath,
Replica.db.path should be used when RestoreOptions.OutputPath is empty.

Fixes benbjohnson#233
@benbjohnson
Update CONTRIBUTING & remove pull request template
755f54f
@benbjohnson
README
61c80cb
@benbjohnson
Fix FindMinSnapshotByGeneration() loop ref bug
d09f4ef 
This commit fixes an issue where the reference is taken
on the loop variable rather than the slice element when
computing the minimum snapshot within a generation so
it can cause the wrong snapshot to be chosen.
@mtlynch @benbjohnson
Sort output of snapshots in descending timestamp order
ba6e13b 
By default, the snapshots command seems to output in alphabetical order of hash, which isn't meaningful, as far as I can tell.

This change modifies the order of the command output so that ./litestream snapshots returns snapshots from newest to oldest.
@benbjohnson
Refactor checksum calculation; improve test coverage
531e19e
@benbjohnson
Refactor Restore()
3f0ec9f 
This commit refactors out the complexity of downloading ordered WAL
files in parallel to a type called `WALDownloader`. This makes it
easier to test the restore separately from the download.
@benbjohnson
CLI test coverage
f308e0b
@benbjohnson
Add end-to-end replication/restore testing
84d08f5
@benbjohnson
dependabot.yml
b8536fa
@benbjohnson
Parallelize GitHub Actions
c7aa363
@benbjohnson
Restrict CI jobs
0a6474f
@benbjohnson
Update CI
b8d0495
@dependabot @benbjohnson
Bump github.com/pierrec/lz4/v4 from 4.1.3 to 4.1.12
17831c7 
Bumps [github.com/pierrec/lz4/v4](https://github.com/pierrec/lz4) from 4.1.3 to 4.1.12.
- [Release notes](https://github.com/pierrec/lz4/releases)
- [Commits](pierrec/lz4@v4.1.3...v4.1.12)

---
updated-dependencies:
- dependency-name: github.com/pierrec/lz4/v4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @benbjohnson
Bump github.com/aws/aws-sdk-go from 1.27.0 to 1.42.39
0b533e5 
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.27.0 to 1.42.39.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md)
- [Commits](aws/aws-sdk-go@v1.27.0...v1.42.39)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @benbjohnson
Bump cloud.google.com/go/storage from 1.15.0 to 1.18.2
6c5fb2c 
Bumps [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) from 1.15.0 to 1.18.2.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@pubsub/v1.15.0...storage/v1.18.2)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @benbjohnson
Bump google.golang.org/api from 0.45.0 to 0.65.0
d045b7b 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.45.0 to 0.65.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.45.0...v0.65.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@anacrolix @benbjohnson
Update sqlite 3.36
79b50c6
@benbjohnson
Upgrade azure-storage-blob-go to v0.14.0
90715ef
@benbjohnson
Upgrade shellwords, golang.org/x
500cfd8
@benbjohnson
Upgrade github.com/pkg/sftp@v1.13.4
55c475e
@benbjohnson
Upgrade github.com/prometheus/client_golang@v1.12.0
5d24f91
@benbjohnson
Create codeql-analysis.yml
3911450
@benbjohnson
Update dependabot.yml
8950de8
@dependabot @benbjohnson
Bump github.com/aws/aws-sdk-go from 1.42.39 to 1.42.40
8d759bb 
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.42.39 to 1.42.40.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md)
- [Commits](aws/aws-sdk-go@v1.42.39...v1.42.40)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@benbjohnson
Separate out GitHub Actions
ffaba87
benbjohnson and others added 27 commits March 5, 2022 11:33
@benbjohnson
Prevent double-close for SFTP client
d5792c4
@benbjohnson
Set permission on file replica client on init
00bad43
@benbjohnson
Use database page size in read replication
8d10881
@benbjohnson
Remove CI task for executing long running test runner on each build
6aba416
@benbjohnson
Default upstream path if not specified
4688853
@benbjohnson
Improve http error logging
2c3e28c
@benbjohnson
Allow read replication recovery from last position
4466202
@benbjohnson
Add minimum shadow WAL retention
f53857e
@benbjohnson
Document -addr flag on replicate command
5d394bb
@benbjohnson
Fix release workflow
80f8de4
@benbjohnson
Re-add point-in-time restore
ca07137
@mtlynch @benbjohnson
Add Go code coverage to CI
301e117
@mtlynch @benbjohnson
Fix path to coverage file
6763e92
@mtlynch @benbjohnson
Add a unit test for internal.MD5Hash
88737d7
@benbjohnson
Remove verbose flag from restore docs
7d8b8c6
@hnakamur @benbjohnson
Add two environments for overriding endpoint and region
e6f7c60 
export LITESTREAM_ACCESS_KEY_ID=your_key_id
export LITESTREAM_SECRET_ACCESS_KEY=your_access_key
export LITESTREAM_ENDPOINT=your_endpoint
export LITESTREAM_REGION=your_region
litestream replicate fruits.db s3://mybkt/fruits.db
@hnakamur @benbjohnson
Fix wal internal error log
46597ab
@hnakamur @benbjohnson
Add environment variables for scheme and forcePathStyle
98673c6
@mattn @benbjohnson
Use fsnotify
2c0dce2
@mattn @benbjohnson
Unwatch directory
7d0167f
@benbjohnson
Re-add Fileinfo()
e9dbf83
@mattn @benbjohnson
implement Fileinfo for Windows and non-Windows
4522c7b
@mattn @benbjohnson
Fix build tag
31aa5b3
@ryanrussell @benbjohnson
Improve readability
2acdab0 
Signed-off-by: Ryan Russell <ryanrussell@users.noreply.github.com>
@ryanrussell @benbjohnson
Revert to correct wal_downloader.go
80cd049 
Signed-off-by: Ryan Russell <git@ryanrussell.org>
@hazcod
feat(docker): harden docker image
9f9f4c0
@hazcod
chore: fix build
5124cc4
@benbjohnson
Copy link
Owner

@hazcod Thanks for the PR. I'll have to do some testing with this. Isn't running as root inside Docker typical as the container is already sandboxed?

@hazcod
Copy link
Author

hazcod commented Jul 20, 2022

@benbjohnson It's still a best practice not to, running as root in a container greatly increases the risk of kernel exploitation or container escape. https://dockerlabs.collabnix.com/security/Running-Containers-as-ROOT.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@hazcod @benbjohnson @colin-sitehost @mtlynch @anacrolix @ohthehugemanatee @tniessen @hnakamur @mattn @ryanrussell