From 81db831eb05b6a188f3d26bbecfa848dcef0167d Mon Sep 17 00:00:00 2001 From: kezhenxu94 Date: Mon, 7 Aug 2023 10:29:21 +0800 Subject: [PATCH] Revert "Change base image from `eclipse-temurin:x-jre` to `eclipse-temurin:x-jre-alpine` to reduce CVE exposure surface (#11181)" (#11182) This reverts commit 2719c7db18a925474ccb0ecb2572be03013ae191. --- .github/workflows/publish-docker.yaml | 2 +- .github/workflows/skywalking.yaml | 2 +- docker/data-generator/Dockerfile | 2 +- docker/oap/Dockerfile | 7 ++----- docker/ui/Dockerfile | 6 ++---- docker/ui/docker-entrypoint.sh | 3 ++- docs/en/changes/changes.md | 1 - test/e2e-v2/cases/simple/ssl/docker-compose.yml | 5 ----- test/e2e-v2/cases/storage/storage-cases.yaml | 2 +- test/e2e-v2/script/docker-compose/base-compose.yml | 3 +-- test/e2e-v2/script/prepare/setup-oap/download-mysql.sh | 4 ++-- 11 files changed, 13 insertions(+), 24 deletions(-) diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml index 8c247741eb..78f6cceefd 100644 --- a/.github/workflows/publish-docker.yaml +++ b/.github/workflows/publish-docker.yaml @@ -76,7 +76,7 @@ jobs: uses: docker/setup-buildx-action@v1 - name: Build and push docker images based on Java 17 env: - SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre-alpine + SW_OAP_BASE_IMAGE: eclipse-temurin:17-jre TAG: ${{ env.TAG }}-java17 run: make build.all docker.push - name: Build and push docker images diff --git a/.github/workflows/skywalking.yaml b/.github/workflows/skywalking.yaml index 16f942a563..2491ceecbd 100644 --- a/.github/workflows/skywalking.yaml +++ b/.github/workflows/skywalking.yaml @@ -211,7 +211,7 @@ jobs: java-version: ${{ matrix.java-version }} - name: Build and save docker images env: - SW_OAP_BASE_IMAGE: eclipse-temurin:${{ matrix.java-version }}-jre-alpine + SW_OAP_BASE_IMAGE: eclipse-temurin:${{ matrix.java-version }}-jre run: | make docker.all || make docker.all docker save -o docker-images-skywalking-oap.tar skywalking/oap:latest diff --git a/docker/data-generator/Dockerfile b/docker/data-generator/Dockerfile index 0519bd24b4..aa0d14ab40 100644 --- a/docker/data-generator/Dockerfile +++ b/docker/data-generator/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_IMAGE='eclipse-temurin:11-jre-alpine' +ARG BASE_IMAGE='eclipse-temurin:11-jre' ARG SKYWALKING_CLI_VERSION diff --git a/docker/oap/Dockerfile b/docker/oap/Dockerfile index ecb33e59f4..aa0d14ab40 100644 --- a/docker/oap/Dockerfile +++ b/docker/oap/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG BASE_IMAGE='eclipse-temurin:11-jre-alpine' +ARG BASE_IMAGE='eclipse-temurin:11-jre' ARG SKYWALKING_CLI_VERSION @@ -35,9 +35,6 @@ ARG DIST COPY "$DIST" . RUN set -ex; \ - apk update; \ - apk add libc6-compat; \ - apk add gcompat; \ tar -xzf "$DIST" --strip 1; \ rm -rf "$DIST"; \ rm -rf "config/log4j2.xml"; \ @@ -56,4 +53,4 @@ RUN mkdir ext-config; \ EXPOSE 12800 11800 1234 -ENTRYPOINT ["sh", "docker-entrypoint.sh"] +ENTRYPOINT ["bash", "docker-entrypoint.sh"] diff --git a/docker/ui/Dockerfile b/docker/ui/Dockerfile index 91d86d0b7b..da31815e8c 100644 --- a/docker/ui/Dockerfile +++ b/docker/ui/Dockerfile @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM eclipse-temurin:11-jre-alpine +FROM eclipse-temurin:11-jre ENV JAVA_OPTS=" -Xms256M " \ SW_OAP_ADDRESS="http://127.0.0.1:12800" \ @@ -26,8 +26,6 @@ ARG DIST COPY "$DIST" . RUN tar -xzf "$DIST" --strip 1; \ - apk update; \ - apk add libc6-compat; \ rm -rf "$DIST"; \ rm -rf "config"; \ rm -rf "bin"; \ @@ -39,4 +37,4 @@ COPY log4j2.xml webapp/ EXPOSE 8080 -ENTRYPOINT ["sh", "docker-entrypoint.sh"] +ENTRYPOINT ["bash", "docker-entrypoint.sh"] diff --git a/docker/ui/docker-entrypoint.sh b/docker/ui/docker-entrypoint.sh index faf4d57c46..19bab89a00 100755 --- a/docker/ui/docker-entrypoint.sh +++ b/docker/ui/docker-entrypoint.sh @@ -1,4 +1,3 @@ -#!/bin/sh # Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information @@ -15,6 +14,8 @@ # See the License for the specific language governing permissions and # limitations under the License. +#!/bin/bash + set -e exec java ${JAVA_OPTS} -cp webapp/skywalking-webapp.jar:webapp org.apache.skywalking.oap.server.webapp.ApplicationStartUp "$@" diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md index d1d13f220c..acf3c708d7 100644 --- a/docs/en/changes/changes.md +++ b/docs/en/changes/changes.md @@ -4,7 +4,6 @@ * Bump up Guava to 32.0.1 to avoid the lib listed as vulnerable due to CVE-2020-8908. This API is never used. * Maven artifact `skywalking-log-recevier-plugin` is renamed to `skywalking-log-receiver-plugin`. -* Change base image from `eclipse-temurin:11-jre` to `eclipse-temurin:11-jre-alpine` to reduce CVE exposure surface. #### OAP Server diff --git a/test/e2e-v2/cases/simple/ssl/docker-compose.yml b/test/e2e-v2/cases/simple/ssl/docker-compose.yml index a2d37cacef..1cc94a6f8c 100644 --- a/test/e2e-v2/cases/simple/ssl/docker-compose.yml +++ b/test/e2e-v2/cases/simple/ssl/docker-compose.yml @@ -29,11 +29,6 @@ services: SW_CORE_GRPC_SSL_TRUSTED_CA_PATH: /skywalking/certs/ca.crt ports: - 12800 - healthcheck: - test: ["CMD", "/skywalking/bin/swctl", "health", "--grpcTLS"] - interval: 5s - timeout: 60s - retries: 120 provider: extends: diff --git a/test/e2e-v2/cases/storage/storage-cases.yaml b/test/e2e-v2/cases/storage/storage-cases.yaml index bc6ee29cb1..2e7d968753 100644 --- a/test/e2e-v2/cases/storage/storage-cases.yaml +++ b/test/e2e-v2/cases/storage/storage-cases.yaml @@ -149,7 +149,7 @@ cases: - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql metrics top --name endpoint_cpm --service-name e2e-service-provider 5 expected: expected/metrics-top-endpoint.yml # native event: event list - - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql event list --type=normal + - query: swctl --display yaml --base-url=http://${oap_host}:${oap_12800}/graphql event list expected: expected/event-list.yml - query: | diff --git a/test/e2e-v2/script/docker-compose/base-compose.yml b/test/e2e-v2/script/docker-compose/base-compose.yml index dd35466f8e..1a78645d3e 100644 --- a/test/e2e-v2/script/docker-compose/base-compose.yml +++ b/test/e2e-v2/script/docker-compose/base-compose.yml @@ -34,12 +34,11 @@ services: SW_JDBC_URL: jdbc:mysql://mysql:3306/swtest?allowMultiQueries=true SW_STORAGE_INFLUXDB_URL: http://influxdb:8086 SW_STORAGE_BANYANDB_HOST: "banyandb" - SW_HEALTH_CHECKER: default SW_CONFIG_ETCD_PERIOD: 1 SW_CONFIG_ETCD_ENDPOINTS: http://etcd:2379 SW_CLUSTER_ETCD_ENDPOINTS: http://etcd:2379 healthcheck: - test: ["CMD", "/skywalking/bin/swctl", "health"] + test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/127.0.0.1/11800"] interval: 5s timeout: 60s retries: 120 diff --git a/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh b/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh index 689c48cebe..7ffd5e8760 100755 --- a/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh +++ b/test/e2e-v2/script/prepare/setup-oap/download-mysql.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env sh +#!/usr/bin/env bash # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with @@ -23,7 +23,7 @@ MYSQL_DRIVER="mysql-connector-java-8.0.13.jar" # ensure the curl command been installed if ! command -v curl &> /dev/null; then - apk add curl + apt update -y && apt install -y curl fi if ! curl -Lo "${LIB_HOME}/${MYSQL_DRIVER}" ${MYSQL_URL}; then