Skip to content

Commit a3bd6e4

Browse files
ruromeroruromero
authored
fix: add missing binaries to container image (#321)
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
1 parent c9a9877 commit a3bd6e4

File tree

2 files changed

+65
-22
lines changed

2 files changed

+65
-22
lines changed

‎docker-image/Dockerfiles/Dockerfile‎

Lines changed: 52 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,41 @@
11
# first stage
2-
FROM registry.access.redhat.com/ubi9/nodejs-20 AS builder
2+
FROM registry.access.redhat.com/ubi9/nodejs-24 AS builder
33

4-
# use privilaged user
4+
# use privileged user
55
USER root
66

7-
# install Java
8-
RUN curl -kL https://download.oracle.com/java/21/archive/jdk-21.0.1_linux-x64_bin.tar.gz -o /tmp/java-package.tar.gz \
9-
&& tar xvzf /tmp/java-package.tar.gz -C /usr/
7+
# install OpenJDK from Adoptium (Eclipse Temurin) - latest JDK 21 LTS
8+
RUN curl -kL "https://api.adoptium.net/v3/binary/latest/21/ga/linux/x64/jdk/hotspot/normal/eclipse" -o /tmp/java-package.tar.gz \
9+
&& tar xvzf /tmp/java-package.tar.gz -C /usr/ \
10+
&& mv /usr/jdk-21* /usr/temurin-21
1011

1112
# install Maven package manager
12-
RUN curl -kL https://archive.apache.org/dist/maven/maven-3/3.9.6/binaries/apache-maven-3.9.6-bin.tar.gz -o /tmp/maven-package.tar.gz \
13+
RUN curl -kL https://archive.apache.org/dist/maven/maven-3/3.9.12/binaries/apache-maven-3.9.12-bin.tar.gz -o /tmp/maven-package.tar.gz \
1314
&& tar xvzf /tmp/maven-package.tar.gz -C /usr/
1415

16+
# install gradle package manager
17+
RUN curl -kL https://services.gradle.org/distributions/gradle-9.2.1-bin.zip -o /tmp/gradle-package.zip \
18+
&& unzip /tmp/gradle-package.zip -d /usr/
19+
1520
# install golang package manager
16-
RUN curl -kL https://go.dev/dl/go1.21.5.linux-amd64.tar.gz -o /tmp/golang-package.tar.gz \
21+
RUN curl -kL https://go.dev/dl/go1.25.5.linux-amd64.tar.gz -o /tmp/golang-package.tar.gz \
1722
&& tar xvzf /tmp/golang-package.tar.gz -C /usr/
1823

24+
# install corepack and package managers (pnpm, yarn) - stage to /usr/local for easy copying
25+
ENV COREPACK_HOME=/usr/local/corepack/cache
26+
RUN npm install -g corepack@latest \
27+
&& corepack enable \
28+
&& corepack prepare pnpm@10.1.0 --activate \
29+
&& corepack prepare yarn@4.9.1 --activate \
30+
&& NPM_PREFIX=$(npm config get prefix) \
31+
&& mkdir -p /usr/local/corepack/bin \
32+
&& cp -rL $NPM_PREFIX/lib/node_modules/corepack/* /usr/local/corepack/ \
33+
&& cp $NPM_PREFIX/bin/pnpm /usr/local/corepack/bin/ \
34+
&& cp $NPM_PREFIX/bin/yarn /usr/local/corepack/bin/ \
35+
&& cp $NPM_PREFIX/bin/yarnpkg /usr/local/corepack/bin/ \
36+
&& cp $NPM_PREFIX/bin/corepack /usr/local/corepack/bin/ \
37+
&& ln -s ../dist/lib /usr/local/corepack/bin/lib
38+
1939
# install jq JSON formating tool
2040
RUN curl -kL https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-linux64 -o /usr/bin/jq
2141

@@ -32,8 +52,9 @@ RUN npm install --production \
3252
&& ln -s /app/dist/src/cli.js /app/node_modules/.bin/trustify-da-javascript-client
3353

3454
# assign executable permissions to all installed binaries
35-
RUN chmod +x /usr/jdk-21.0.1/bin/java \
36-
&& chmod +x /usr/apache-maven-3.9.6/bin/mvn \
55+
RUN chmod +x /usr/temurin-21/bin/java \
56+
&& chmod +x /usr/apache-maven-3.9.12/bin/mvn \
57+
&& chmod +x /usr/gradle-9.2.1/bin/gradle \
3758
&& chmod +x /usr/go/bin/go \
3859
&& chmod +x /usr/bin/jq \
3960
&& chmod +x /app/dist/src/cli.js \
@@ -44,7 +65,7 @@ RUN chmod +x /usr/jdk-21.0.1/bin/java \
4465
USER default
4566

4667
# second stage
47-
FROM registry.access.redhat.com/ubi9/nodejs-20-minimal
68+
FROM registry.access.redhat.com/ubi9/nodejs-24-minimal
4869

4970
# Build arguments for metadata
5071
ARG IMAGE_VERSION
@@ -53,7 +74,7 @@ ARG IMAGE_CREATED
5374

5475
# Open Container Initiative (OCI) metadata labels
5576
LABEL org.opencontainers.image.source=https://github.com/guacsec/trustify-da-javascript-client
56-
LABEL org.opencontainers.image.description="Trustify Dependency Analytics JavaScript Client - Container image for dependency analysis and vulnerability scanning supporting Maven, NPM, Golang, and Python ecosystems"
77+
LABEL org.opencontainers.image.description="Trustify Dependency Analytics JavaScript Client - Container image for dependency analysis and vulnerability scanning supporting Maven, NPM, Golang, Gradle, Pnpm, Yarn, and Python ecosystems"
5778
LABEL org.opencontainers.image.licenses=Apache-2.0
5879
LABEL org.opencontainers.image.title="Trustify Dependency Analytics JavaScript Client"
5980
LABEL org.opencontainers.image.vendor="guacsec"
@@ -70,20 +91,33 @@ ENV TRUSTIFY_DA_PIP_SHOW=''
7091
# indicate whether to use the Minimal version selection (MVS) algorithm to select a set of module versions to use when building Go packages.
7192
ENV TRUSTIFY_DA_GO_MVS_LOGIC_ENABLED='true'
7293

73-
# Copy java executable from the builder stage
74-
COPY --from=builder /usr/jdk-21.0.1/ /usr/jdk-21.0.1/
75-
ENV JAVA_HOME=/usr/jdk-21.0.1
94+
# Copy OpenJDK (Temurin) from the builder stage
95+
COPY --from=builder /usr/temurin-21/ /usr/temurin-21/
96+
ENV JAVA_HOME=/usr/temurin-21
7697

7798
# Copy maven executable from the builder stage
78-
COPY --from=builder /usr/apache-maven-3.9.6/ /usr/apache-maven-3.9.6/
79-
ENV MAVEN_HOME=/usr/apache-maven-3.9.6
99+
COPY --from=builder /usr/apache-maven-3.9.12/ /usr/apache-maven-3.9.12/
100+
ENV MAVEN_HOME=/usr/apache-maven-3.9.12
80101

81102
# Copy golang executable from the builder stage
82103
COPY --from=builder /usr/go/ /usr/go/
83104
ENV GOLANG_HOME=/usr/go
84105

85-
# Update PATH
86-
ENV PATH=$PATH:$JAVA_HOME/bin:$MAVEN_HOME/bin:$GOLANG_HOME/bin:/app/node_modules/.bin
106+
# Copy gradle executable from the builder stage
107+
COPY --from=builder /usr/gradle-9.2.1/ /usr/gradle-9.2.1/
108+
ENV GRADLE_HOME=/usr/gradle-9.2.1
109+
110+
# Copy corepack and package manager binaries from builder stage
111+
COPY --from=builder /usr/local/corepack/ /usr/local/corepack/
112+
ENV COREPACK_HOME=/usr/local/corepack/cache
113+
114+
# Install Python via microdnf (cleanest approach for minimal images)
115+
USER root
116+
RUN microdnf install -y python3 python3-pip && microdnf clean all
117+
USER 1001
118+
119+
# Update PATH (includes corepack bin for pnpm/yarn)
120+
ENV PATH=$PATH:$JAVA_HOME/bin:$MAVEN_HOME/bin:$GOLANG_HOME/bin:$GRADLE_HOME/bin:/usr/local/corepack/bin:/app/node_modules/.bin
87121

88122
# Copy jq executable from the builder stage
89123
COPY --from=builder /usr/bin/jq /usr/bin/jq

‎docker-image/README.md‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,21 @@ Before getting started, ensure that you have one of the following prerequisites
1111

1212
Both Docker and Podman are container runtimes that can be used to build and run the Trustify Dependency Analytics images. You can choose either Docker or Podman based on your preference and the compatibility with your operating system.
1313

14-
## Images generated for Trustify Dependency Analytics Javascript Client
14+
## Image generated for Trustify Dependency Analytics Javascript Client
1515

16-
Ecosystem | Version | IMAGE | TAG |
17-
------------------------------| ------------------------------------------------------------------ | ----------------------------------------------- |-------------------|
18-
Maven, NPM, Golang | mvn 3.9.6, <br>npm 10.2.4, <br>go 1.21.5, <br>python \<any\> | ghcr.io/guacsec/trustify-da-javascript-client | 0.2.4-ea.12 |
16+
ghcr.io/guacsec/trustify-da-javascript-client
1917

18+
See the [GitHub Container Registry](https://github.com/guacsec/trustify-da-javascript-client/pkgs/container/trustify-da-javascript-client)
19+
20+
Ecosystem | Version |
21+
------------------------------| ------------------------------------------------------------------ |
22+
Maven | 3.9.12 |
23+
Gradle | 9.2.1 |
24+
Go | 1.25.5 |
25+
NPM | 10.8.2 |
26+
PNPM | 10.1.0 |
27+
Yarn | 4.9.1 |
28+
Python | 3.9.25 |
2029

2130
## Usage Notes
2231

0 commit comments

Comments
 (0)