@cryptotaxi247 / netdata-1 / commits / a3ada6049

Added numerous improvements to our Docker image. (#10308)

* Initial cleanup of Docker entrypoint script. * Add linting for our Docker files. * Fix warnings reported by hadolint. * Add support for automatic claiming on startup. * Optimize Docker image structure. This shuffles some things around in the Docker image to cut down on the total number of layers and make the image more caching friendly, which will cut down on overall time required to both initially pull the image and time spent pulling updated versions of the image. It also shrinks the image size by about 2MB.

Austin S. Hemmelgarn committed Dec 9, 2020 at 07:18 UTC a3ada604962b126b20c86a41e8aac5ca451b8a33
3 files changed +54 -26
.github/workflows/review.yml
+21
@@ -5,6 +5,7 @@ on:
5 pull_request:
6 env:
7 run_eslint: 0
8 + run_hadolint: 0
9 run_shellcheck: 0
10 run_yamllint: 0
11 jobs:
@@ -29,6 +30,26 @@ jobs:
30 reporter: github-pr-check
31 eslint_flags: '.'
32
33 + hadolint:
34 + name: hadolint
35 + runs-on: ubuntu-latest
36 + steps:
37 + - name: Git clone repository
38 + uses: actions/checkout@v2
39 + with:
40 + fetch-depth: 0
41 + - name: Check files
42 + run: |
43 + if git diff --name-only origin/${{ github.base_ref }} HEAD | grep -Eq '*Dockerfile*' ; then
44 + echo 'run_hadolint=1' >> $GITHUB_ENV
45 + fi
46 + - name: Run hadolint
47 + if: env.run_hadolint == 1
48 + uses: reviewdog/action-hadolint@v1
49 + with:
50 + github_token: ${{ secrets.GITHUB_TOKEN }}
51 + reporter: github-pr-check
52 +
53 shellcheck:
54 name: shellcheck
55 runs-on: ubuntu-latest
packaging/docker/Dockerfile
+23 -22
@@ -28,7 +28,7 @@ WORKDIR /opt/netdata.git
28 RUN chmod +x netdata-installer.sh && \
29 cp -rp /deps/* /usr/local/ && \
30 ./netdata-installer.sh --dont-wait --dont-start-it ${EXTRA_INSTALL_OPTS} \
31 - $([ "$RELEASE_CHANNEL" = stable ] && echo --stable-channel)
31 + "$([ "$RELEASE_CHANNEL" = stable ] && echo --stable-channel)"
32
33 # files to one directory
34 RUN mkdir -p /app/usr/sbin/ \
@@ -49,6 +49,7 @@ RUN mkdir -p /app/usr/sbin/ \
49 mv /usr/sbin/netdata-claim.sh /app/usr/sbin/ && \
50 mv /usr/sbin/netdatacli /app/usr/sbin/ && \
51 mv packaging/docker/run.sh /app/usr/sbin/ && \
52 + mv packaging/docker/health.sh /app/usr/sbin/ && \
53 cp -rp /deps/* /app/usr/local/ && \
54 chmod +x /app/usr/sbin/run.sh
55
@@ -57,12 +58,6 @@ ARG ARCH
58 # This image contains preinstalled dependecies
59 FROM netdata/base:${ARCH}
60
60 -# Copy files over
61 -RUN mkdir -p /opt/src
62 -COPY --from=builder /app /
63 -COPY --from=builder /wheels /wheels
64 -COPY packaging/docker/health.sh /health.sh
65 -
61 # Configure system
62 ARG NETDATA_UID=201
63 ARG NETDATA_GID=201
@@ -70,17 +65,28 @@ ENV DOCKER_GRP netdata
65 ENV DOCKER_USR netdata
66 # If DO_NOT_TRACK is set, it will disable anonymous stats collection and reporting
67 #ENV DO_NOT_TRACK=1
73 -RUN \
68 +
69 +# Copy files over
70 +RUN mkdir -p /opt/src /var/log/netdata && \
71 + # Link log files to stdout
72 + ln -sf /dev/stdout /var/log/netdata/access.log && \
73 + ln -sf /dev/stdout /var/log/netdata/debug.log && \
74 + ln -sf /dev/stderr /var/log/netdata/error.log && \
75 # fping from alpine apk is on a different location. Moving it.
75 - mv /usr/sbin/fping /usr/local/bin/fping && \
76 + ln -snf /usr/sbin/fping /usr/local/bin/fping && \
77 chmod 4755 /usr/local/bin/fping && \
77 - mkdir -p /var/log/netdata && \
78 # Add netdata user
79 addgroup -g ${NETDATA_GID} -S "${DOCKER_GRP}" && \
80 - adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}" && \
81 - # Apply the permissions as described in
82 - # https://docs.netdata.cloud/docs/netdata-security/#netdata-directories, but own everything by root group due to https://github.com/netdata/netdata/pull/6543
83 - chown -R root:root \
80 + adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}"
81 +
82 +# Long-term this should leverage BuildKit’s mount option.
83 +COPY --from=builder /wheels /wheels
84 +COPY --from=builder /app /
85 +
86 +# Apply the permissions as described in
87 +# https://docs.netdata.cloud/docs/netdata-security/#netdata-directories, but own everything by root group due to https://github.com/netdata/netdata/pull/6543
88 +# hadolint ignore=DL3013
89 +RUN chown -R root:root \
90 /etc/netdata \
91 /usr/share/netdata \
92 /usr/libexec/netdata && \
@@ -99,17 +105,12 @@ RUN \
105 # Group write permissions due to: https://github.com/netdata/netdata/pull/6543
106 find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
107 find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
102 - # Link log files to stdout
103 - ln -sf /dev/stdout /var/log/netdata/access.log && \
104 - ln -sf /dev/stdout /var/log/netdata/debug.log && \
105 - ln -sf /dev/stderr /var/log/netdata/error.log
106 -
107 -# Install any Python wheels
108 -RUN pip install /wheels/*
108 + pip --no-cache-dir install /wheels/* && \
109 + rm -rf /wheels
110
111 ENV NETDATA_LISTENER_PORT 19999
112 EXPOSE $NETDATA_LISTENER_PORT
113
114 ENTRYPOINT ["/usr/sbin/run.sh"]
115
115 -HEALTHCHECK --interval=60s --timeout=10s --retries=3 CMD /health.sh
116 +HEALTHCHECK --interval=60s --timeout=10s --retries=3 CMD /usr/sbin/health.sh
packaging/docker/run.sh
+10 -4
@@ -2,16 +2,17 @@
2 #
3 # Entry point script for netdata
4 #
5 -# Copyright: SPDX-License-Identifier: GPL-3.0-or-later
5 +# Copyright: 2018 and later Netdata Inc.
6 +# SPDX-License-Identifier: GPL-3.0-or-later
7 #
8 # Author : Pavlos Emm. Katsoulakis <paul@netdata.cloud>
9 +# Author : Austin S. Hemmelgarn <austin@netdata.cloud>
10 set -e
11
12 if [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] || [ -n "$DO_NOT_TRACK" ]; then
13 touch /etc/netdata/.opt-out-from-anonymous-statistics
14 fi
15
14 -echo "Netdata entrypoint script starting"
16 if [ -n "${PGID}" ]; then
17 echo "Creating docker group ${PGID}"
18 addgroup -g "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
@@ -19,6 +20,11 @@ if [ -n "${PGID}" ]; then
20 usermod -a -G "${PGID}" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
21 fi
22
22 -exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"
23 +if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /var/lib/netdata/claim.d/claimed_id ]; then
24 + /usr/sbin/netdata-claim.sh -token "${NETDATA_CLAIM_TOKEN}" \
25 + -url "${NETDATA_CLAIM_URL}" \
26 + ${NETDATA_CLAIM_ROOMS:+-rooms "${NETDATA_CLAIM_ROOMS}"} \
27 + ${NETDATA_CLAIM_PROXY:+-proxy "${NETDATA_CLAIM_PROXY}"}
28 +fi
29
24 -echo "Netdata entrypoint script, completed!"
30 +exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"