Removeed Polyverse Polymorphic Linux from Docker builds. (#8802)
* Removeed Polyverse Polymorphic Linux from Docker images. It ends up using roughly 140MB of extra space, only works for 64-bit x86, and the benefits for a majority of our users range from questionale to completely non-existent. * Update docs and add runtime support for Polyverse.
Austin S. Hemmelgarn committed
May 19, 2020 at 15:11 UTC
9511af410de5e47f9e1fd7a0718dd98d82d6edb4
3 files changed
+12
-17
packaging/docker/Dockerfile
-11
@@ -57,17 +57,6 @@ ARG ARCH
57
# This image contains preinstalled dependecies
58
FROM netdata/base:${ARCH}
59
60
-# Conditional subscription to Polyverse's Polymorphic Linux repositories
61
-RUN if [ "$(uname -m)" == "x86_64" ]; then \
62
- apk update && apk upgrade; \
63
- curl https://sh.polyverse.io | sh -s install gcxce5byVQbtRz0iwfGkozZwy support+netdata@polyverse.io; \
64
- if [ $? -eq 0 ]; then \
65
- apk update && \
66
- apk upgrade --available --no-cache && \
67
- sed -in 's/^#//g' /etc/apk/repositories; \
68
- fi \
69
- fi
70
-
60
# Copy files over
61
RUN mkdir -p /opt/src
62
COPY --from=builder /app /
packaging/docker/README.md
+4
-3
@@ -36,9 +36,10 @@ documentation](https://docs.docker.com/engine/reference/builder/#understand-how-
36
37
### Package scrambling in runtime (x86_64 only)
38
39
-Our x86_64 Docker images use [Polymorphic Polyverse Linux package scrambling](https://polyverse.io/how-it-works/). For
40
-increased security, you can enable rescrambling of Netdata packages during runtime by setting the environment variable
41
-`RESCRAMBLE=true` while starting Netdata with a Docker container.
39
+Our x86_64 Docker images provide support for using [Polymorphic Polyverse
40
+Linux package scrambling](https://polyverse.io/how-it-works/) to protect
41
+against buffer overflow errors. To activate this, set the environemnt
42
+variable `RESCRAMBLE=true` while starting Netdata with a Docker container.
43
44
## Run the Agent with the Docker command
45
packaging/docker/run.sh
+8
-3
@@ -12,9 +12,14 @@ if [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] || [ -n "$DO_NOT_TRACK" ]; then
12
fi
13
14
echo "Netdata entrypoint script starting"
15
-if [ ${RESCRAMBLE+x} ]; then
16
- echo "Reinstalling all packages to get the latest Polymorphic Linux scramble"
17
- apk upgrade --update-cache --available
15
+if [ ${RESCRAMBLE+x} ] && [ "$(uname -m)" == "x86_64" ]; then
16
+ echo "Injecting packages from Polymorphic Linux"
17
+ apk update && apk upgrade
18
+ curl https://sh.polyverse.io | sh -s install gcxce5byVQbtRz0iwfGkozZwy support+netdata@polyverse.io
19
+ # shellcheck disable=SC2181
20
+ if [ $? -eq 0 ]; then
21
+ apk update && apk upgrade --available --no-cache && sed -in 's/^#//g' /etc/apk/repositories
22
+ fi
23
fi
24
25
if [ -n "${PGID}" ]; then