From 2719c7db18a925474ccb0ecb2572be03013ae191 Mon Sep 17 00:00:00 2001 From: kezhenxu94 Date: Mon, 7 Aug 2023 09:16:20 +0800 Subject: [PATCH] Change base image from `eclipse-temurin:x-jre` to `eclipse-temurin:x-jre-alpine` to reduce CVE exposure surface (#11181) --- .github/workflows/publish-docker.yaml | 2 +- .github/workflows/skywalking.yaml | 2 +- docker/data-generator/Dockerfile | 2 +- docker/oap/Dockerfile | 7 +++++-- docker/ui/Dockerfile | 6 ++++-- docker/ui/docker-entrypoint.sh | 3 +-- docs/en/changes/changes.md | 1 + test/e2e-v2/cases/simple/ssl/docker-compose.yml | 5 +++++ test/e2e-v2/cases/storage/storage-cases.yaml | 2 +- test/e2e-v2/script/docker-compose/base-compose.yml | 3 ++- test/e2e-v2/script/prepare/setup-oap/download-mysql.sh | 4 ++-- 11 files changed, 24 insertions(+), 13 deletions(-) diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml index 78f6cceefd..8c247741eb 100644 --- a/.github/workflows/publish-docker.yaml +++ b/.github/workflows/publish-docker.yaml @@ -76,7 +76,7 @@ jobs: uses: docker/setup-buildx-action@v1 - name: Build and push docker images based on Java 17 env: - SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre + SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre-alpine TAG: ${{ env.TAG }}-java17 run: make build.all docker.push - name: Build and push docker images diff --git a/.github/workflows/skywalking.yaml b/.github/workflows/skywalking.yaml index 2491ceecbd..16f942a563 100644 --- a/.github/workflows/skywalking.yaml +++ b/.github/workflows/skywalking.yaml @@ -211,7 +211,7 @@ jobs: java-version: ${{ matrix.java-version }} - name: Build and save docker images env: - SW_OAP_BASE_IMAGE: eclipse-temurin:${{ matrix.java-version }}-jre + SW_OAP_BASE_IMAGE: eclipse-temurin:${{ matrix.java-version }}-jre-alpine run: | make docker.all || make docker.all docker save -o docker-images-skywalking-oap.tar skywalking/oap:latest diff --git a/docker/data-generator/Dockerfile b/docker/data-generator/Dockerfile index aa0d14ab40..0519bd24b4 100644 --- a/docker/data-generator/Dockerfile +++ b/docker/data-generator/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_IMAGE='eclipse-temurin:11-jre' +ARG BASE_IMAGE='eclipse-temurin:11-jre-alpine' ARG SKYWALKING_CLI_VERSION diff --git a/docker/oap/Dockerfile b/docker/oap/Dockerfile index aa0d14ab40..ecb33e59f4 100644 --- a/docker/oap/Dockerfile +++ b/docker/oap/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_IMAGE='eclipse-temurin:11-jre' +ARG BASE_IMAGE='eclipse-temurin:11-jre-alpine' ARG SKYWALKING_CLI_VERSION @@ -35,6 +35,9 @@ ARG DIST COPY "$DIST" . RUN set -ex; \ + apk update; \ + apk add libc6-compat; \ + apk add gcompat; \ tar -xzf "$DIST" --strip 1; \ rm -rf "$DIST"; \ rm -rf "config/log4j2.xml"; \ @@ -53,4 +56,4 @@ RUN mkdir ext-config; \ EXPOSE 12800 11800 1234 -ENTRYPOINT ["bash", "docker-entrypoint.sh"] +ENTRYPOINT ["sh", "docker-entrypoint.sh"] diff --git a/docker/ui/Dockerfile b/docker/ui/Dockerfile index da31815e8c..91d86d0b7b 100644 --- a/docker/ui/Dockerfile +++ b/docker/ui/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM eclipse-temurin:11-jre +FROM eclipse-temurin:11-jre-alpine ENV JAVA_OPTS=" -Xms256M " \ SW_OAP_ADDRESS="http://127.0.0.1:12800" \ @@ -26,6 +26,8 @@ ARG DIST COPY "$DIST" . RUN tar -xzf "$DIST" --strip 1; \ + apk update; \ + apk add libc6-compat; \ rm -rf "$DIST"; \ rm -rf "config"; \ rm -rf "bin"; \ @@ -37,4 +39,4 @@ COPY log4j2.xml webapp/ EXPOSE 8080 -ENTRYPOINT ["bash", "docker-entrypoint.sh"] +ENTRYPOINT ["sh", "docker-entrypoint.sh"] diff --git a/docker/ui/docker-entrypoint.sh b/docker/ui/docker-entrypoint.sh index 19bab89a00..faf4d57c46 100755 --- a/docker/ui/docker-entrypoint.sh +++ b/docker/ui/docker-entrypoint.sh @@ -1,3 +1,4 @@ +#!/bin/sh # Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information @@ -14,8 +15,6 @@ # See the License for the specific language governing permissions and # limitations under the License. -#!/bin/bash - set -e exec java ${JAVA_OPTS} -cp webapp/skywalking-webapp.jar:webapp org.apache.skywalking.oap.server.webapp.ApplicationStartUp "$@" diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md index acf3c708d7..d1d13f220c 100644 --- a/docs/en/changes/changes.md +++ b/docs/en/changes/changes.md @@ -4,6 +4,7 @@ * Bump up Guava to 32.0.1 to avoid the lib listed as vulnerable due to CVE-2020-8908. This API is never used. * Maven artifact `skywalking-log-recevier-plugin` is renamed to `skywalking-log-receiver-plugin`. +* Change base image from `eclipse-temurin:11-jre` to `eclipse-temurin:11-jre-alpine` to reduce CVE exposure surface. #### OAP Server diff --git a/test/e2e-v2/cases/simple/ssl/docker-compose.yml b/test/e2e-v2/cases/simple/ssl/docker-compose.yml index 1cc94a6f8c..a2d37cacef 100644 --- a/test/e2e-v2/cases/simple/ssl/docker-compose.yml +++ b/test/e2e-v2/cases/simple/ssl/docker-compose.yml @@ -29,6 +29,11 @@ services: SW_CORE_GRPC_SSL_TRUSTED_CA_PATH: /skywalking/certs/ca.crt ports: - 12800 + healthcheck: + test: ["CMD", "/skywalking/bin/swctl", "health", "--grpcTLS"] + interval: 5s + timeout: 60s + retries: 120 provider: extends: diff --git a/test/e2e-v2/cases/storage/storage-cases.yaml b/test/e2e-v2/cases/storage/storage-cases.yaml index 2e7d968753..bc6ee29cb1 100644 --- a/test/e2e-v2/cases/storage/storage-cases.yaml +++ b/test/e2e-v2/cases/storage/storage-cases.yaml @@ -149,7 +149,7 @@ cases: - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql metrics top --name endpoint_cpm --service-name e2e-service-provider 5 expected: expected/metrics-top-endpoint.yml # native event: event list - - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql event list + - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql event list --type=normal expected: expected/event-list.yml - query: | diff --git a/test/e2e-v2/script/docker-compose/base-compose.yml b/test/e2e-v2/script/docker-compose/base-compose.yml index 1a78645d3e..dd35466f8e 100644 --- a/test/e2e-v2/script/docker-compose/base-compose.yml +++ b/test/e2e-v2/script/docker-compose/base-compose.yml @@ -34,11 +34,12 @@ services: SW_JDBC_URL: jdbc:mysql://mysql:3306/swtest?allowMultiQueries=true SW_STORAGE_INFLUXDB_URL: http://influxdb:8086 SW_STORAGE_BANYANDB_HOST: "banyandb" + SW_HEALTH_CHECKER: default SW_CONFIG_ETCD_PERIOD: 1 SW_CONFIG_ETCD_ENDPOINTS: http://etcd:2379 SW_CLUSTER_ETCD_ENDPOINTS: http://etcd:2379 healthcheck: - test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/11800"] + test: ["CMD", "/skywalking/bin/swctl", "health"] interval: 5s timeout: 60s retries: 120 diff --git a/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh b/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh index 7ffd5e8760..689c48cebe 100755 --- a/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh +++ b/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +#!/usr/bin/env sh # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with @@ -23,7 +23,7 @@ MYSQL_DRIVER="mysql-connector-java-8.0.13.jar" # ensure the curl command been installed if ! command -v curl &> /dev/null; then - apt update -y && apt install -y curl + apk add curl fi if ! curl -Lo "${LIB_HOME}/${MYSQL_DRIVER}" ${MYSQL_URL}; then