mirror
/
s3proxy
kopia lustrzana https://github.com/gaul/s3proxy
1
0
Forkuj 0
Kod Zgłoszenia Packages Projekty Wydania Wiki Aktywność
s3proxy/Dockerfile

50 wiersze
1.4 KiB
Docker
Czysty Bezpośredni odnośnik Zwykły widok Historia

#637 use full names for base images
2024-05-23 12:41:20 +00:00
FROM docker.io/library/eclipse-temurin:17-jre
update depcrecated image, fix minor Label change Java is deprecated as the state: "This image is officially deprecated in favor of the openjdk image, and will receive no further updates after 2016-12-31 (Dec 31, 2016). Please adjust your usage accordingly." I adjusted it to the corresponding 7-alpine-jre tag from openjdk https://hub.docker.com/_/openjdk/ the MAINTAINER instruction is deprecated as of Docker Version: 1.13.0 https://docs.docker.com/engine/deprecated/#maintainer-in-dockerfile all the best
2018-04-20 09:01:09 +00:00
LABEL maintainer="Andrew Gaul <andrew@gaul.org>"
Update Dockerfile to use multistage building.
2017-06-01 08:53:02 +00:00
WORKDIR /opt/s3proxy
Docker: Use dumb-init as init system PID 1 is special in Linux kernels; do not start the `java` process as PID 1. Instead, use dumb-init [1] as the init system and start it at PID 1. This is generally done for two main reasons [1]: - Signal handling When k8s terminates a Pod, it sends a SIGTERM to PID 1 in the containers. When a non-PID-1 process receives SIGTERM and it does not register a SIGTERM handler, the kernel will fall back to the default behavior for a SIGTERM signal: killing the process. However, this is not the case for PID 1; the kernel does not fallback to killing the PID 1 process if no SIGTERM handler is registered. This means that the SIGTERM will have no effect on the process. k8s will wait for `terminationGracePeriodSeconds` (default: 30 seconds) and only then SIGKILL the process (having wasted 30 seconds where nothing useful was happening). With `Java` as PID 1 though, I don't run into this issue. Even though s3Proxy does not register a SIGTERM handler, it seems like the JVM does react to the SIGTERM and immediately kills s3Proxy. Still, let's use dumb-init as a best-practice. Init-systems like dumb-init take the responsibliity for properly registering signal handlers and passing signals to children processes correctly. - Orphaned processes Any running process that becomes an orphan (parent process dies) is adopted by PID 1. This means PID 1 is responsible for cleaning up (reaping) the orphan process after it has terminated (become zombie /defunct) However, Java as PID 1 will not know about these zombie processes and will not reap them. Using dumb-init will reap such processes. This is a non-breaking change; users of the docker image do not need any action on their part. [1] https://engineeringblog.yelp.com/2016/01/dumb-init-an-init-for-docker.html [2] https://daveiscoding.hashnode.dev/why-do-you-need-an-init-process-inside-your-docker-container-pid-1
2025-03-06 16:15:55 +00:00
RUN apt-get update && \
apt-get install -y dumb-init && \
rm -rf /var/lib/apt/lists/*
Combine COPY directives to elide a layer
2016-11-04 02:24:11 +00:00
COPY \
ci: Enhancements to CI and release fixes #408 fixes #423 This PR makes several changes to the CI* Adds PR lint to ensure conventional commit syntax is used for all PRs Uses semantic-release tool to review commit log on branch and generate version numbers Publishes containers (non pr) to ghcr.io Publishes release containers to hub.docker.com Completes common tags (versions, sha-1 and ref) on all branches Notes Unable to test actually publishing containers to dockerhub however this was taken from a similar working project.
2022-06-29 18:10:04 +00:00
target/s3proxy \
src/main/resources/run-docker-container.sh \
Combine COPY directives to elide a layer
2016-11-04 02:24:11 +00:00
/opt/s3proxy/
Provide Dockerfile Fixes #120.
2016-02-07 06:47:37 +00:00
ENV \
LOG_LEVEL="info" \
Default to AWS V2 or V4 authentication
2017-08-17 00:48:09 +00:00
S3PROXY_AUTHORIZATION="aws-v2-or-v4" \
support custom s3 proxy endpoint in docker
2020-12-27 18:26:03 +00:00
S3PROXY_ENDPOINT="http://0.0.0.0:80" \
Provide Dockerfile Fixes #120.
2016-02-07 06:47:37 +00:00
S3PROXY_IDENTITY="local-identity" \
S3PROXY_CREDENTIAL="local-credential" \
use the old env var used for virtual host
2021-01-09 13:16:41 +00:00
S3PROXY_VIRTUALHOST="" \
Configure Keystore through environment variables
2023-04-18 15:29:31 +00:00
S3PROXY_KEYSTORE_PATH="keystore.jks" \
Fix variable typo
2023-04-18 16:43:48 +00:00
S3PROXY_KEYSTORE_PASSWORD="password" \
Added Docker environment variable "S3PROXY_CORS_ALLOW_ALL" refs issues #142 refs Pull #144 The default value is false
2017-02-16 19:35:20 +00:00
S3PROXY_CORS_ALLOW_ALL="false" \
Basic CORS support This commit adds a globally configurable CORS support. Note that this differs from AWS per-bucket support.
2018-12-21 22:19:50 +00:00
S3PROXY_CORS_ALLOW_ORIGINS="" \
S3PROXY_CORS_ALLOW_METHODS="" \
S3PROXY_CORS_ALLOW_HEADERS="" \
Add Access-Control-Allow-Credentials header Fixes #415
2023-09-26 11:38:22 +00:00
S3PROXY_CORS_ALLOW_CREDENTIAL="" \
Allow Docker environment to ignore unknown headers
2017-08-17 00:47:24 +00:00
S3PROXY_IGNORE_UNKNOWN_HEADERS="false" \
Support for transparent encryption Co-authored-by: Florin Peter <Florin-Alexandru.Peter@t-systems.com>
2022-03-26 13:05:08 +00:00
S3PROXY_ENCRYPTED_BLOBSTORE="" \
S3PROXY_ENCRYPTED_BLOBSTORE_PASSWORD="" \
S3PROXY_ENCRYPTED_BLOBSTORE_SALT="" \
Support S3PROXY_READ_ONLY_BLOBSTORE Docker env var
2023-09-27 03:21:14 +00:00
S3PROXY_READ_ONLY_BLOBSTORE="false" \
Change Docker storage backend to filesystem-nio2
2025-01-29 02:42:59 +00:00
JCLOUDS_PROVIDER="filesystem-nio2" \
Provide Dockerfile Fixes #120.
2016-02-07 06:47:37 +00:00
JCLOUDS_ENDPOINT="" \
Use JCLOUDS_ENDPOINT and JCLOUDS_REGION in run-docker-container.sh
2017-03-30 13:23:05 +00:00
JCLOUDS_REGION="" \
feat: allow setting property jclouds.regions when running in docker
2018-05-29 20:05:34 +00:00
JCLOUDS_REGIONS="us-east-1" \
Provide Dockerfile Fixes #120.
2016-02-07 06:47:37 +00:00
JCLOUDS_IDENTITY="remote-identity" \
Keystone v3 support with properties
2018-10-25 08:51:15 +00:00
JCLOUDS_CREDENTIAL="remote-credential" \
JCLOUDS_KEYSTONE_VERSION="" \
JCLOUDS_KEYSTONE_SCOPE="" \
Support configurable base directory for S3Proxy
2022-02-10 00:05:10 +00:00
JCLOUDS_KEYSTONE_PROJECT_DOMAIN_NAME="" \
JCLOUDS_FILESYSTEM_BASEDIR="/data"
Provide Dockerfile Fixes #120.
2016-02-07 06:47:37 +00:00
Expose 443 port for TLS/secure endpoint feature
2023-04-21 13:37:06 +00:00
EXPOSE 80 443
Docker: Use dumb-init as init system PID 1 is special in Linux kernels; do not start the `java` process as PID 1. Instead, use dumb-init [1] as the init system and start it at PID 1. This is generally done for two main reasons [1]: - Signal handling When k8s terminates a Pod, it sends a SIGTERM to PID 1 in the containers. When a non-PID-1 process receives SIGTERM and it does not register a SIGTERM handler, the kernel will fall back to the default behavior for a SIGTERM signal: killing the process. However, this is not the case for PID 1; the kernel does not fallback to killing the PID 1 process if no SIGTERM handler is registered. This means that the SIGTERM will have no effect on the process. k8s will wait for `terminationGracePeriodSeconds` (default: 30 seconds) and only then SIGKILL the process (having wasted 30 seconds where nothing useful was happening). With `Java` as PID 1 though, I don't run into this issue. Even though s3Proxy does not register a SIGTERM handler, it seems like the JVM does react to the SIGTERM and immediately kills s3Proxy. Still, let's use dumb-init as a best-practice. Init-systems like dumb-init take the responsibliity for properly registering signal handlers and passing signals to children processes correctly. - Orphaned processes Any running process that becomes an orphan (parent process dies) is adopted by PID 1. This means PID 1 is responsible for cleaning up (reaping) the orphan process after it has terminated (become zombie /defunct) However, Java as PID 1 will not know about these zombie processes and will not reap them. Using dumb-init will reap such processes. This is a non-breaking change; users of the docker image do not need any action on their part. [1] https://engineeringblog.yelp.com/2016/01/dumb-init-an-init-for-docker.html [2] https://daveiscoding.hashnode.dev/why-do-you-need-an-init-process-inside-your-docker-container-pid-1
2025-03-06 16:15:55 +00:00
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
CMD ["/opt/s3proxy/run-docker-container.sh"]