ci-utils/Dockerfile at master · psu-libraries/ci-utils · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
FROM ubuntu:25.04 AS base

# Avoid interactive prompts during package installation
ENV DEBIAN_FRONTEND=noninteractive

## Tool versions
ENV YQ_VERSION=v4.48.2
ENV COMPOSE_VERSION=v2.40.3
ENV DOCKER_VERSION=29.0.2
ENV BUILDX_VERSION=v0.30.1
ENV TRIVY_VERSION=0.69.2

## Install base packages
#
# - uuid-runtime provides `uuidgen` (the `uuid` package was invalid)
# - no-install-recommends keeps the image lean
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        git \
        curl \
        uuid-runtime \
        jq \
        ca-certificates \
        openssh-client \
        python3 \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Install Trivy vulnerability scanner
# RUN curl -sSL -o trivy.tar.gz \
#         https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz \
#     && tar -xzvf trivy.tar.gz trivy -C /usr/local/bin \
#     && chmod +x /usr/local/bin/trivy \
#     && rm trivy.tar.gz
RUN curl -sSL -o trivy.tar.gz \
        https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz \
    && tar -xzvf trivy.tar.gz trivy \
    && mv trivy /usr/local/bin/trivy \
    && chmod +x /usr/local/bin/trivy \
    && rm trivy.tar.gz

# Install the Docker CLI
RUN curl -sSLo docker.tgz \
        https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz \
    && tar -xzvf docker.tgz --strip-components=1 -C /usr/local/bin docker/docker \
    && rm docker.tgz

## Install Docker Buildx plugin
RUN mkdir -p ~/.docker/cli-plugins \
    && curl -sSLo buildx \
        https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-amd64 \
    && chmod +x buildx \
    && mv buildx ~/.docker/cli-plugins/docker-buildx

## Install yq for YAML/JSON processing
RUN curl -sSL -o /usr/local/bin/yq \
        https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 \
    && chmod +x /usr/local/bin/yq


## Optionally install standalone Compose binary
# Newer Docker releases bundle the `docker compose` subcommand into the CLI.
# If your CI scripts rely on the old `docker-compose` command, uncomment
# the following lines to install it.
# RUN curl -sSL -o /usr/local/bin/docker-compose \
#        https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-x86_64 \
#    && chmod +x /usr/local/bin/docker-compose

## Copy any custom scripts from the build context
COPY bin/ /usr/local/bin/