james.maesandClaude Sonnet 5.5
e19feb01a8
Both Dockerfiles copied 0.1.0-SNAPSHOT jars that the reactor no longer produces
(version is ${revision}), so neither built a released version. They now resolve the
released qbit-document-renderer and qqq-remote-renderer-transport (and their runtime
libraries) at an exact, required RENDERER_VERSION / TRANSPORT_VERSION from the
QRun-IO Gitea Maven registry and Maven Central, refusing SNAPSHOT and local
(*forge*) versions. The reviewed hardening is unchanged: digest-pinned
BUILD_IMAGE/JAVA_IMAGE, non-root 65532, read-only-root friendly, Zint built from
vendor/. The reactor build context is no longer needed.
Adds IMAGE-PUBLISH.md (repeatable build/scan/publish steps and the 1.0.0 pins) and
image-pins.sh (prints the gg-forge-cd classpath and SHA256 pins from a published
image). Images for 1.0.0 were built, smoke-tested over mTLS and published to GHCR
under gg-engineering by hand; no workflow publishes images.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
46 lines
2.6 KiB
Docker
46 lines
2.6 KiB
Docker
# Both arguments must be approved immutable image digests; no floating defaults.
|
|
ARG BUILD_IMAGE
|
|
ARG JAVA_IMAGE
|
|
FROM ${BUILD_IMAGE} AS zint-build
|
|
WORKDIR /zint-build
|
|
COPY vendor/ ./
|
|
COPY Dockerfile ./
|
|
# Build dependencies exist only in this discarded stage. Their actual versions,
|
|
# source hash, compiler and CMake invocation are shipped with corresponding source.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends gcc g++ libc6-dev make cmake patch \
|
|
&& sh ./build-zint.sh
|
|
|
|
# The engine and its libraries are the RELEASED artifacts, resolved at the exact RENDERER_VERSION from the QRun-IO
|
|
# Gitea Maven registry and Maven Central (Maven checks each registry checksum). No SNAPSHOT, no local build and no
|
|
# local-cache coordinate: the version is a required build argument with no default.
|
|
# docker build --build-arg BUILD_IMAGE=... --build-arg JAVA_IMAGE=... --build-arg RENDERER_VERSION=1.0.0 renderer/
|
|
FROM ${BUILD_IMAGE} AS release
|
|
ARG RENDERER_VERSION
|
|
WORKDIR /release
|
|
COPY release-image/pom.xml ./pom.xml
|
|
RUN test -n "${RENDERER_VERSION}" && case "${RENDERER_VERSION}" in *SNAPSHOT*|*forge*) echo "RENDERER_VERSION must be a released version" >&2; exit 1;; esac \
|
|
&& mvn -B -Drenderer.version="${RENDERER_VERSION}" -Dmaven.repo.local=/release/.m2 package \
|
|
&& mv "target/lib/qbit-document-renderer-${RENDERER_VERSION}.jar" target/renderer.jar \
|
|
&& test -f target/renderer.jar && ls target/lib
|
|
|
|
FROM ${JAVA_IMAGE}
|
|
# Reviewed runtime family: Temurin 21.0.13+9 on Ubuntu noble. The approved digest
|
|
# contains Ubuntu's patched Brotli and omits the unused Pebble daemon entirely.
|
|
# Refuse an older/different base instead of silently installing mixed packages.
|
|
RUN . /etc/os-release \
|
|
&& test "$ID" = "ubuntu" \
|
|
&& test "$VERSION_ID" = "24.04" \
|
|
&& test "$JAVA_VERSION" = "jdk-21.0.13+9" \
|
|
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge "1.1.0-2ubuntu0.1" \
|
|
&& test ! -e /usr/bin/pebble \
|
|
&& ! command -v pebble
|
|
WORKDIR /renderer
|
|
COPY --from=zint-build /zint-build/build/frontend/zint /usr/local/bin/zint
|
|
COPY --from=zint-build /zint-build/corresponding-source /usr/share/doc/qqq-zint
|
|
# LGPL corresponding source for the vendored OpenHTML module that the released openhtmltopdf-pdfbox jar was built from.
|
|
COPY vendor/openhtml-1.1.105-qqq-p1 /usr/share/doc/qqq-openhtml
|
|
COPY --from=release /release/target/renderer.jar ./renderer.jar
|
|
COPY --from=release /release/target/lib ./lib
|
|
USER 65532:65532
|
|
ENTRYPOINT ["java", "-Xmx256m", "-XX:ActiveProcessorCount=1", "-Djava.awt.headless=true", "-Dpdfbox.fontcache=/tmp", "-jar", "/renderer/renderer.jar"]
|