90 lines
2.8 KiB
Plaintext
90 lines
2.8 KiB
Plaintext
# Base Image and Environment Setup
|
|
FROM python:slim
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Package Installation
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
software-properties-common \
|
|
openssh-client \
|
|
sshpass \
|
|
locales \
|
|
bash \
|
|
git \
|
|
curl \
|
|
rsync \
|
|
zsh \
|
|
nano \
|
|
sudo \
|
|
less \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
|
|
&& rm -Rf /usr/share/doc && rm -Rf /usr/share/man
|
|
|
|
# User Creation
|
|
ARG USERNAME=ansible
|
|
ARG USER_UID=1000
|
|
ARG USER_GID=${USER_UID}
|
|
ENV HOME=/home/${USERNAME}
|
|
RUN groupadd --gid "${USER_GID}" "${USERNAME}" \
|
|
&& useradd -s /bin/bash --uid "${USER_UID}" --gid "${USER_GID}" -m "${USERNAME}" \
|
|
&& echo "${USERNAME} ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/"${USERNAME}" \
|
|
&& chmod 0440 /etc/sudoers.d/"${USERNAME}"
|
|
|
|
# Python Package Installation
|
|
RUN pip3 install --no-cache-dir \
|
|
ansible \
|
|
ara \
|
|
hvac \
|
|
dnspython \
|
|
jmespath \
|
|
"hvac[parser]" \
|
|
certifi \
|
|
ansible-lint \
|
|
ansible-modules-hashivault
|
|
|
|
# Multi-Stage Builds (Copying Binaries from other images)
|
|
COPY --from=hashicorp/vault /bin/vault /usr/local/bin/vault
|
|
COPY --from=docker /usr/local/bin/docker /usr/local/bin/docker
|
|
COPY --from=donaldrich/function:container /usr/local/bin/goss /usr/local/bin/goss
|
|
COPY --from=donaldrich/function:task \
|
|
/usr/local/bin/tusk /usr/local/bin/tusk \
|
|
/usr/local/bin/task /usr/local/bin/task \
|
|
/usr/local/bin/variant /usr/local/bin/variant
|
|
COPY --from=donaldrich/function:syntax-tools /usr/local/bin/jq /usr/local/bin/jq
|
|
|
|
# Zsh Configuration
|
|
COPY --from=donaldrich/runner:zsh /zsh/ /zsh/
|
|
COPY --from=donaldrich/runner:zsh --chown=ansible:ansible /zsh/.zshrc /home/ansible/.zshrc
|
|
COPY --from=donaldrich/runner:zsh --chown=ansible:ansible /zsh/.nanorc /home/ansible/.nanorc
|
|
|
|
# Environment Variables
|
|
ENV ANSIBLE_GATHERING smart
|
|
ENV ANSIBLE_HOST_KEY_CHECKING false
|
|
ENV ANSIBLE_RETRY_FILES_ENABLED false
|
|
ENV ANSIBLE_FORCE_COLOR true
|
|
ENV GOSS_FMT documentation
|
|
ENV GOSS_COLOR true
|
|
|
|
# Optional ARA API Server configuration (uncomment if needed)
|
|
# ENV ANSIBLE_CALLBACK_PLUGINS="$(python3 -m ara.setup.callback_plugins)"
|
|
# ENV ARA_API_CLIENT="http"
|
|
# ENV ARA_API_SERVER="http://192.168.1.101:8734"
|
|
|
|
# Locale Configuration
|
|
RUN echo "LC_ALL=en_US.UTF-8" >> /etc/environment \
|
|
&& echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen \
|
|
&& echo "LANG=en_US.UTF-8" > /etc/locale.conf \
|
|
&& locale-gen en_US.UTF-8
|
|
|
|
# Copy Local Files into the image
|
|
COPY ./tusk-docker.yml ./tusk.yml
|
|
COPY ./goss.yaml ./goss.yaml
|
|
COPY ./goss2.yaml ./goss2.yaml
|
|
COPY ./Dockerfile ./Dockerfile # Often copied for auditing/debugging within the container
|
|
|
|
# Switch to the non-root user (good practice for security)
|
|
# USER ${USERNAME}
|
|
|
|
# Final validation step (runs tests on the image)
|
|
RUN goss validate |