Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release-1.24] fix: CVE-2024-38428 remove wget to close vuln, reduce image size #1572

Merged
merged 1 commit into from
Sep 4, 2024
Merged

[release-1.24] fix: CVE-2024-38428 remove wget to close vuln, reduce image size #1572

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 46 additions & 31 deletions pkg/blobplugin/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,47 @@
# See the License for the specific language governing permissions and
# limitations under the License.

FROM registry.k8s.io/build-image/debian-base:bookworm-v1.0.3

ARG ARCH=amd64

FROM registry.k8s.io/build-image/debian-base:bookworm-v1.0.3 AS base

FROM base AS builder

ARG ARCH

RUN apt update \
&& apt install -y curl

# install aznfs
ARG aznfsVer=2.0.7
ARG anzfsArch=x86_64
RUN if [ "$ARCH" = "arm64" ]; then \
anzfsArch="arm64"; \
fi
RUN curl -Ls https://github.com/Azure/AZNFS-mount/releases/download/${aznfsVer}/aznfs-${aznfsVer}-1.${anzfsArch}.tar.gz | tar xvzf - -C / --keep-directory-symlink

# install azcopy
RUN curl -Ls https://azcopyvnext.azureedge.net/releases/release-10.26.0-20240731/azcopy_linux_${ARCH}_10.26.0.tar.gz \
| tar xvzf - --strip-components=1 -C /usr/local/bin/ --wildcards "*/azcopy"

# download blobfuse deb
RUN mkdir /blobfuse-proxy/
RUN curl -Lso /blobfuse-proxy/packages-microsoft-prod-18.04.deb https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb
RUN curl -Lso /blobfuse-proxy/packages-microsoft-prod-22.04.deb https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb
FROM base

ARG ARCH
ARG binary=./_output/${ARCH}/blobplugin
COPY ${binary} /blobplugin

RUN mkdir /blobfuse-proxy/
COPY --from=builder --chown=root:root /opt/microsoft/aznfs /opt/microsoft/aznfs
COPY --from=builder --chown=root:root /sbin/mount.aznfs /sbin/mount.aznfs
COPY --from=builder --chown=root:root /usr/sbin/aznfswatchdog /usr/sbin/aznfswatchdog
COPY --from=builder --chown=root:root /usr/local/bin/azcopy /usr/local/bin/azcopy
COPY --from=builder --chown=root:root /blobfuse-proxy /blobfuse-proxy

# packages that are only needed by aznfs: procps conntrack iptables bind9-host iproute2 bash netcat sysvinit-utils.
RUN apt update && apt upgrade -y && apt-mark unhold libcap2 && clean-install ca-certificates uuid-dev util-linux mount udev e2fsprogs nfs-common netbase procps conntrack iptables bind9-host iproute2 bash netcat-traditional sysvinit-utils kmod

COPY ./pkg/blobfuse-proxy/init.sh /blobfuse-proxy/
COPY ./pkg/blobfuse-proxy/install-proxy.sh /blobfuse-proxy/
Expand All @@ -27,37 +61,18 @@ COPY ./pkg/blobfuse-proxy/blobfuse-proxy.service /blobfuse-proxy/
COPY ./_output/${ARCH}/blobfuse-proxy /blobfuse-proxy/

RUN chmod +x /blobfuse-proxy/init.sh && \
chmod +x /blobfuse-proxy/install-proxy-rhcos.sh && \
chmod +x /blobfuse-proxy/install-proxy.sh && \
chmod +x /blobfuse-proxy/blobfuse-proxy.service && \
chmod +x /blobfuse-proxy/blobfuse-proxy

# packages that are only needed by aznfs: procps conntrack iptables bind9-host iproute2 bash netcat sysvinit-utils.
RUN apt update && apt upgrade -y && apt-mark unhold libcap2 && clean-install ca-certificates uuid-dev util-linux mount udev wget e2fsprogs nfs-common netbase procps conntrack iptables bind9-host iproute2 bash netcat-traditional sysvinit-utils kmod
chmod +x /blobfuse-proxy/install-proxy-rhcos.sh && \
chmod +x /blobfuse-proxy/install-proxy.sh && \
chmod +x /blobfuse-proxy/blobfuse-proxy.service && \
chmod +x /blobfuse-proxy/blobfuse-proxy

# install aznfs
ARG aznfsVer=2.0.7
RUN if [ "$ARCH" = "amd64" ] ; then \
wget -O aznfs.tar.gz https://github.com/Azure/AZNFS-mount/releases/download/${aznfsVer}/aznfs-${aznfsVer}-1.x86_64.tar.gz; \
else \
wget -O aznfs.tar.gz https://github.com/Azure/AZNFS-mount/releases/download/${aznfsVer}/aznfs-${aznfsVer}-1.arm64.tar.gz;fi
RUN tar xvzf aznfs.tar.gz -C / --keep-directory-symlink && rm aznfs.tar.gz
clean-install libcurl4-gnutls-dev \
&& dpkg -i /blobfuse-proxy/packages-microsoft-prod-18.04.deb \
&& rm /blobfuse-proxy/packages-microsoft-prod-18.04.deb \
&& apt update \
&& apt install -y blobfuse blobfuse2 fuse; fi

# install azcopy
ARG azcopyURL=https://azcopyvnext.azureedge.net/releases/release-10.26.0-20240731/azcopy_linux_amd64_10.26.0.tar.gz
RUN if [ "$ARCH" == "arm64" ] ; then \
azcopyURL=https://azcopyvnext.azureedge.net/releases/release-10.26.0-20240731/azcopy_linux_arm64_10.26.0.tar.gz; fi
RUN wget -O azcopy.tar.gz ${azcopyURL} && \
tar xvzf azcopy.tar.gz -C . && rm azcopy.tar.gz && \
mv ./azcopy_linux_$ARCH_*/azcopy /usr/local/bin/azcopy && \
rm -rf ./azcopy_linux_$ARCH_*
RUN chmod +x /usr/local/bin/azcopy

RUN if [ "$ARCH" = "amd64" ] ; then \
clean-install libcurl4-gnutls-dev && \
wget -O /blobfuse-proxy/packages-microsoft-prod-22.04.deb https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb && \
wget -O /blobfuse-proxy/packages-microsoft-prod-18.04.deb https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb && \
dpkg -i /blobfuse-proxy/packages-microsoft-prod-18.04.deb && apt update && apt install blobfuse blobfuse2 fuse -y && apt remove wget -y; fi
LABEL maintainers="andyzhangx"
LABEL description="Azure Blob Storage CSI driver"

Expand Down
Loading