curityio / idsvr-docker

Docker-related files, resources, and information for the Curity Identity Server

Docker-related Files and Info

This repository contains Dockerfiles and other resources that can be used to create Docker images of the Curity Identity Server.

Usage

• Download the linux release from the Curity Developer portal
• Extract the release in the <VERSION> directory of this project
• Run the command VERSION=X.X.X ./build-images.sh $VERSION

This will build the images using the Dockerfile(s) of the specific version locally.

Adding a new version

In order to add a new version, run the following VERSION=X.X.X ./add-release.sh

Image updates

Since the base OS of the images can regularly be patched, the script update-multiplatform-images.sh is run every day to make sure that the images contain the latest security fixes.

The script downloads the releases from Curity's release API, pulls the latest base OS images and rebuilds all the versions. If there is a change in the OS, the docker cache won't be used and the new images will be pushed to Curity's Azure Container Registry.

So, the tag of the form <version>-<os> always contains the latest built image.

Also, the tag <minor>-<os>, i.e 9.0-ubuntu is updated with a new patch version if that exists. So if 9.0.1 is released, the 9.0-<os> tags will point to 9.0.1-<os> tag and after that point only the latest patch for each minor version will be daily updated.

Building a single image

• Download the linux release from the Curity Developer portal
• Extract the release in the VERSION directory of this project
• Run the command docker build -t <image_tag> -f <VERSION>/<DISTRO>/Dockerfile <VERSION>

Customizing the image

The Curity Identity Server is a Java based product and can run in many docker setups.
The default docker image runs as a low privilege 10001 user account (idsvr).
Customers can update this user account and apply their own image policy when required.

Kubernetes Non Root Check

You may need to deploy the docker image and also use the Kubernetes runAsNonRoot security context setting:

spec:
  securityContext:
    runAsNonRoot: true
  containers:
  - name: curity
    image: custom_idsvr:latest

If so, you will need to configure a numeric user ID.
Do so by removing the default user and adding a numeric user and group.
Then change file ownership to that user, which will inherit existing permissions.

FROM curity.azurecr.io/curity/idsvr:latest
USER root

RUN deluser idsvr && \
    groupadd --system --gid 10000 idsvr && \
    useradd  --system --gid idsvr --uid 10001 --shell /bin/bash --create-home idsvr && \
    chown -R 10001 /opt/idsvr
USER 10001

Important

Images after version 9.0.0 already use the user 10001 instead of idsvr which means the runAsNonRoot: true securityContext is allowed by default

Custom image based on the provided images

If you need to install extra tools, you can do so by overlaying our image. In some cases, operation can only run with the root user. In that case it is advisable to switch to the root user, perform the operation that requires more permissions and then switch back to the user of the image

USER root 
...
RUN apt-get install -y curl
...
USER 10001:1000

Also copying resources in the server files, i.e plugins can be done like so:

COPY --chown=10001:10000 custom-plugin.jar /opt/idsvr/usr/share/plugins/custom-plugin-group/

Note

For images before version 9.0.0 use USER idsvr:idsvr

Contributing

Pull requests are welcome. To do so, just fork this repo, and submit a pull request.

License

The software running in the Docker containers produced by the Dockerfiles maintained in this repository is licensed by Curity AB and others. The Docker-related files and resources maintained in this respository are licensed under the Apache 2 license.

More Information

Please visit curity.io for more information about the Curity Identity Server.

Copyright (C) 2019 Curity AB.

idsvr-docker's Issues

You can make images 50% smaller

I managed to halve the size of images by using multi staged build, because the RUN find /opt/idsvr .. layer is copying the entire /opt/idsvr only to change its permissions.
So I created a stage where I do all that stuff and copy it directly into the final stage.
The only constraint is that idsvr user id needs to be same. So I added -u 999

Below example for ubuntu. I got 348 Mb vs 601Mb

FROM ubuntu:18.04 AS idsvr

RUN useradd --system -u 999 idsvr

ARG TARGETARCH
COPY idsvr-{{VERSION}}-${TARGETARCH}/idsvr /opt/idsvr
COPY first-run /opt/idsvr/etc/first-run

RUN find /opt/idsvr -type f -exec chmod a-w {} \; && \
   	chmod -R o-rwx /opt/idsvr && \
   	chown -R idsvr /opt/idsvr && \
   	chgrp -R 0 /opt/idsvr && \
   	chmod -R g+rX /opt/idsvr

FROM ubuntu:18.04
LABEL maintainer="Curity AB <[email protected]>"

EXPOSE 8443
EXPOSE 6749
EXPOSE 4465
EXPOSE 4466

ENV IDSVR_HOME /opt/idsvr
ENV JAVA_HOME $IDSVR_HOME/lib/java/jre
ENV PATH $IDSVR_HOME/bin:$JAVA_HOME/bin:$PATH
WORKDIR $IDSVR_HOME

RUN apt-get update && \
	apt-get upgrade -y && \
	apt-get install -y openssl && \
	apt-get clean && \
	rm -rf /var/lib/apt/lists/* 

RUN useradd --system -u 999 idsvr

COPY --from=idsvr /opt/idsvr /opt/idsvr

USER idsvr:idsvr

CMD ["idsvr"]

Control logging with an environment variable

The images now use the default logging settings which is DEBUG in the 2 main loggers.

Instead, it should be possible to set an environment variable which should change the log level to at leat DEBUG/TRACE/INFO/WARN. This can be handled in the first-run script.

Remove docs from image

The docs are inside the image (usr/share/docs) and is around 30MB. Removing it will slim down the image size significantly

Image runs as root by default

The images run as root, this should be changed for better security