mirror of
https://github.com/minio/minio.git
synced 2024-12-26 23:25:54 -05:00
3aa3d9cf14
This commit changes the container base image from ubi-minimal to ubi-micro. The docker build process happens now in two stages. The build stage: - downloads the latest CA certificate bundle - downloads MinIO binary (for requested version/os/arch) - downloads MinIO binary signature and verifies it using minisign Then it creates an image based on ubi-micro with just the minio binary was downloaded and verified during the build stage. The build stage is simplified to just verifying the minisign signature. Signed-off-by: Andreas Auernhammer <github@aead.dev>
61 lines
2.5 KiB
Docker
61 lines
2.5 KiB
Docker
FROM golang:1.21-alpine as build
|
|
|
|
ARG TARGETARCH
|
|
ARG RELEASE
|
|
|
|
ENV GOPATH /go
|
|
ENV CGO_ENABLED 0
|
|
|
|
# Install curl and minisign
|
|
RUN apk add -U --no-cache ca-certificates && \
|
|
apk add -U --no-cache curl && \
|
|
go install aead.dev/minisign/cmd/minisign@v0.2.0
|
|
|
|
# Download minio binary and signature file
|
|
RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \
|
|
curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \
|
|
chmod +x /go/bin/minio
|
|
|
|
# Download mc binary and signature file
|
|
RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \
|
|
curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig
|
|
|
|
# Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN"
|
|
RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \
|
|
minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav
|
|
|
|
FROM registry.access.redhat.com/ubi9/ubi-micro:9.2
|
|
|
|
ARG RELEASE
|
|
|
|
LABEL name="MinIO" \
|
|
vendor="MinIO Inc <dev@min.io>" \
|
|
maintainer="MinIO Inc <dev@min.io>" \
|
|
version="${RELEASE}" \
|
|
release="${RELEASE}" \
|
|
summary="MinIO is a High Performance Object Storage, API compatible with Amazon S3 cloud storage service." \
|
|
description="MinIO object storage is fundamentally different. Designed for performance and the S3 API, it is 100% open-source. MinIO is ideal for large, private cloud environments with stringent security requirements and delivers mission-critical availability across a diverse range of workloads."
|
|
|
|
ENV MINIO_ACCESS_KEY_FILE=access_key \
|
|
MINIO_SECRET_KEY_FILE=secret_key \
|
|
MINIO_ROOT_USER_FILE=access_key \
|
|
MINIO_ROOT_PASSWORD_FILE=secret_key \
|
|
MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
|
|
MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
|
|
MINIO_CONFIG_ENV_FILE=config.env \
|
|
MC_CONFIG_DIR=/tmp/.mc
|
|
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
COPY --from=build /go/bin/minio /usr/bin/minio
|
|
COPY --from=build /go/bin/mc /usr/bin/mc
|
|
|
|
COPY CREDITS /licenses/CREDITS
|
|
COPY LICENSE /licenses/LICENSE
|
|
COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
|
|
|
|
EXPOSE 9000
|
|
VOLUME ["/data"]
|
|
|
|
ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
|
|
CMD ["minio"]
|