diff --git a/.circleci/config.yml b/.circleci/config.yml index 79b6b2c..a951951 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -23,11 +23,9 @@ jobs: command: make build - run: name: Goss tests - command: make test - - run: - name: Close Xserver connections - command: 'xhost -local:' - when: always + command: | + eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv) + make test workflows: version: 2 diff --git a/.dive-ci b/.dive-ci new file mode 100644 index 0000000..fbf21bf --- /dev/null +++ b/.dive-ci @@ -0,0 +1,13 @@ +rules: + # If the efficiency is measured below X%, mark as failed. + # Expressed as a ratio between 0-1. + lowestEfficiency: 0.95 + + # If the amount of wasted space is at least X or larger than X, mark as failed. + # Expressed in B, KB, MB, and GB. + highestWastedBytes: 36MB + + # If the amount of wasted space makes up for X% or more of the image, mark as failed. + # Note: the base image layer is NOT included in the total image size. + # Expressed as a ratio between 0-1; fails if the threshold is met or crossed. + highestUserWastedPercent: 0.20 diff --git a/.dockerignore b/.dockerignore index 078df40..bcf63b1 100644 --- a/.dockerignore +++ b/.dockerignore @@ -2,5 +2,6 @@ .circleci .gitmodules .hadolint.yaml +.dive-ci .pre-commit-config.yaml Makefile diff --git a/Dockerfile b/Dockerfile index e7dd4f9..6557943 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,6 @@ # Cannot use alpine because it uses musl instead of glibc and musl doesn't have "backtrace" # https://github.com/openalpr/openalpr/issues/566#issuecomment-348205549 -FROM ubuntu:20.04 -LABEL Name="artis3n/pgmodeler" -LABEL Version="0.1.0" -LABEL maintainer="Artis3n " +FROM ubuntu:20.04 as compiler ARG INSTALLATION_ROOT=/app ARG QMAKE_PATH=/usr/bin/qmake @@ -13,6 +10,7 @@ ARG TERM=xterm RUN apt-get update \ && apt-get -y install --no-install-recommends build-essential libpq-dev libqt5svg5-dev libxml2 libxml2-dev pkg-config qt5-default qttools5-dev \ # Slim down layer size + # Not strictly necessary since this is a multi-stage build but hadolint would complain && apt-get autoremove -y \ && apt-get autoclean -y \ # Remove apt-get cache from the layer to reduce container size @@ -22,10 +20,6 @@ RUN apt-get update \ COPY ./pgmodeler /pgmodeler COPY ./plugins /pgmodeler/plugins -# Set up non-root user -RUN groupadd -g 1000 modeler \ - && useradd -m -l -u 1000 -g modeler modeler - WORKDIR /pgmodeler RUN mkdir /app \ # Add persistence folder for project work @@ -41,11 +35,30 @@ RUN mkdir /app \ pgmodeler.pro \ # Compile PgModeler - will take about 20 minutes && make \ - && make install \ - # Clean up source code after compilation succeeds - # We no longer need it in the container - && rm -rf /pgmodeler \ - # Make modeler user owner of the compiled app + && make install + +# Now that the image is compiled, we can remove most of the image size bloat +FROM ubuntu:20.04 +LABEL Name="artis3n/pgmodeler" +LABEL Version="1.2.0" +LABEL maintainer="Artis3n " + +ARG DEBIAN_FRONTEND=noninteractive +ARG TERM=xterm + +RUN apt-get update \ + && apt-get -y install --no-install-recommends libpq-dev libqt5svg5-dev libxml2 qt5-default \ + # Slim down layer size + && apt-get autoremove -y \ + && apt-get autoclean -y \ + # Remove apt-get cache from the layer to reduce container size + && rm -rf /var/lib/apt/lists/* + +COPY --from=compiler /app /app + +# Set up non-root user +RUN groupadd -g 1000 modeler \ + && useradd -m -u 1000 -g modeler modeler \ && chown -R modeler:modeler /app USER modeler diff --git a/goss.yaml b/goss.yaml index 454d2be..f11dfd8 100644 --- a/goss.yaml +++ b/goss.yaml @@ -1,18 +1,28 @@ +user: + modeler: + exists: true + uid: 1000 + gid: 1000 + groups: + - modeler + home: /home/modeler + file: /pgmodeler: + exists: false + /app: exists: true filetype: directory - size: 0 + owner: modeler + group: modeler /app/pgmodeler: exists: true filetype: file owner: modeler group: modeler + # Don't test owner/group on a mounted volume, will cause issues depending on the host /app/savedwork: exists: true - filetype: directory - owner: modeler - group: modeler /app/savedwork/exist.txt: exists: true filetype: file