POC of Wolfi-based image flavor

docker/Makefile

@@ -16,7 +16,7 @@ else
  ARCHITECTURE := $(shell uname -m)
 endif
 
-IMAGE_FLAVORS ?= oss full ubi8
+IMAGE_FLAVORS ?= oss full ubi8 wolfi
 DEFAULT_IMAGE_FLAVOR ?= full
 
 IMAGE_TAG := $(ELASTIC_REGISTRY)/logstash/logstash
@@ -54,6 +54,15 @@ build-from-local-ubi8-artifacts: dockerfile env2yaml
  (docker kill $(HTTPD); false);
  -docker kill $(HTTPD)
 
+build-from-local-wolfi-artifacts: dockerfile
+ docker run --rm -d --name=$(HTTPD) \
+ -p 8000:8000 --expose=8000 -v $(ARTIFACTS_DIR):/mnt \
+ python:3 bash -c 'cd /mnt && python3 -m http.server'
+ timeout 120 bash -c 'until curl -s localhost:8000 > /dev/null; do sleep 1; done'
+ docker build --network=host -t $(IMAGE_TAG)-wolfi:$(VERSION_TAG) -f $(ARTIFACTS_DIR)/Dockerfile-wolfi data/logstash || \
+ (docker kill $(HTTPD); false);
+ -docker kill $(HTTPD)
+
 COPY_FILES := $(ARTIFACTS_DIR)/docker/config/pipelines.yml $(ARTIFACTS_DIR)/docker/config/logstash-oss.yml $(ARTIFACTS_DIR)/docker/config/logstash-full.yml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties $(ARTIFACTS_DIR)/docker/config/log4j2.properties
 COPY_FILES += $(ARTIFACTS_DIR)/docker/pipeline/default.conf $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint
@@ -109,7 +118,7 @@ ironbank_docker_paths:
  mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/vendor
  mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
 
-public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_ubi8 public-dockerfiles_ironbank
+public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_ubi8 public-dockerfiles_wolfi public-dockerfiles_ironbank
 
 public-dockerfiles_full: templates/Dockerfile.erb docker_paths $(COPY_FILES)
  ../vendor/jruby/bin/jruby -S erb -T "-"\
@@ -153,6 +162,20 @@ public-dockerfiles_ubi8: templates/Dockerfile.erb docker_paths $(COPY_FILES)
  cp $(ARTIFACTS_DIR)/Dockerfile-ubi8 Dockerfile && \
  tar -zcf ../logstash-ubi8-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline
 
+public-dockerfiles_wolfi: templates/Dockerfile.erb docker_paths $(COPY_FILES)
+ ../vendor/jruby/bin/jruby -S erb -T "-"\
+ created_date="${BUILD_DATE}" \
+ elastic_version="${ELASTIC_VERSION}" \
+ arch="${ARCHITECTURE}" \
+ version_tag="${VERSION_TAG}" \
+ release="${RELEASE}" \
+ image_flavor="wolfi" \
+ local_artifacts="false" \
+ templates/Dockerfile.erb > "${ARTIFACTS_DIR}/Dockerfile-wolfi" && \
+ cd $(ARTIFACTS_DIR)/docker && \
+ cp $(ARTIFACTS_DIR)/Dockerfile-wolfi Dockerfile && \
+ tar -zcf ../logstash-wolfi-$(VERSION_TAG)-docker-build-context.tar.gz Dockerfile bin config env2yaml pipeline
+
 public-dockerfiles_ironbank: templates/hardening_manifest.yaml.erb templates/Dockerfile.erb ironbank_docker_paths $(COPY_IRONBANK_FILES)
  ../vendor/jruby/bin/jruby -S erb -T "-"\
  elastic_version="${ELASTIC_VERSION}" \

docker/templates/Dockerfile.erb

@@ -1,4 +1,16 @@
 # This Dockerfile was generated from templates/Dockerfile.erb
+<% if image_flavor == 'wolfi' -%>
+FROM docker.elastic.co/wolfi/go:1-dev as builder-env2yaml
+
+COPY env2yaml/env2yaml.go /tmp/go/src/env2yaml/env2yaml.go
+COPY env2yaml/go.mod /tmp/go/src/env2yaml/go.mod
+COPY env2yaml/go.sum /tmp/go/src/env2yaml/go.sum
+
+WORKDIR /tmp/go/src/env2yaml
+
+RUN go build
+<% end -%>
+
 <% if image_flavor == 'ironbank' -%>
 <%# Start image_flavor 'ironbank' %>
 ARG BASE_REGISTRY=registry1.dso.mil
@@ -58,7 +70,7 @@ RUN dnf -y upgrade && \
  rm /tmp/logstash.tar.gz
 <%# End image_flavor 'ironbank' %>
 <% else -%>
-<%# Start image_flavor 'full', oss', 'ubi8' %>
+<%# Start image_flavor 'full', oss', 'ubi8', 'wolfi' %>
  <% if local_artifacts == 'false' -%>
  <% url_root = 'https://artifacts.elastic.co/downloads/logstash' -%>
  <% else -%>
@@ -77,6 +89,12 @@ RUN dnf -y upgrade && \
  <% arch_command = 'uname -m' -%>
  # Minimal distributions do not ship with en language packs.
  <% locale = 'C.UTF-8' -%>
+ <% elsif image_flavor == 'wolfi' %>
+ <% base_image = 'docker.elastic.co/wolfi/chainguard-base' -%>
+ <% package_manager = 'apk' -%>
+ <% arch_command = 'uname -m' -%>
+ # Minimal distributions do not ship with en language packs.
+ <% locale = 'C.UTF-8' -%>
  <% else -%>
  <% base_image = 'ubuntu:20.04' -%>
  <% package_manager = 'apt-get' -%>
@@ -87,27 +105,31 @@ RUN dnf -y upgrade && \
 FROM <%= base_image %>
 
 RUN for iter in {1..10}; do \
-<% if image_flavor == 'full' || image_flavor == 'oss' -%>
- export DEBIAN_FRONTEND=noninteractive && \
-<% end -%>
-<%= package_manager %> update -y && \
-<%= package_manager %> upgrade -y && \
-<%= package_manager %> install -y procps findutils tar gzip && \
-<% if image_flavor == 'ubi8' -%>
- <%= package_manager %> install -y openssl && \
-<% end -%>
-<% if image_flavor == 'ubi8' -%>
- <%= package_manager %> install -y which shadow-utils && \
+<% if image_flavor == 'wolfi' %>
+ <%= package_manager %> add --no-cache curl bash && \
 <% else -%>
- <%= package_manager %> install -y locales && \
-<% end -%>
-<% if image_flavor != 'ubi9' -%>
- <%= package_manager %> install -y curl && \
-<% end -%>
-<%= package_manager %> clean all && \
-<% if image_flavor == 'full' || image_flavor == 'oss' -%>
- locale-gen 'en_US.UTF-8' && \
- <%= package_manager %> clean metadata && \
+ <% if image_flavor == 'full' || image_flavor == 'oss' -%>
+ export DEBIAN_FRONTEND=noninteractive && \
+ <% end -%>
+ <%= package_manager %> update -y && \
+ <%= package_manager %> upgrade -y && \
+ <%= package_manager %> install -y procps findutils tar gzip && \
+ <% if image_flavor == 'ubi8' -%>
+ <%= package_manager %> install -y openssl && \
+ <% end -%>
+ <% if image_flavor == 'ubi8' -%>
+ <%= package_manager %> install -y which shadow-utils && \
+ <% else -%>
+ <%= package_manager %> install -y locales && \
+ <% end -%>
+ <% if image_flavor != 'ubi9' -%>
+ <%= package_manager %> install -y curl && \
+ <% end -%>
+ <%= package_manager %> clean all && \
+ <% if image_flavor == 'full' || image_flavor == 'oss' -%>
+ locale-gen 'en_US.UTF-8' && \
+ <%= package_manager %> clean metadata && \
+ <% end -%>
 <% end -%>
 exit_code=0 && break || exit_code=$? && \
 echo "packaging error: retry $iter in 10s" && \
@@ -119,8 +141,19 @@ sleep 10; done; \
 (exit $exit_code)
 
 # Provide a non-root user to run the process.
+<% if image_flavor == 'wolfi' -%>
+RUN addgroup -g 1000 logstash && \
+ adduser -u 10000 -G logstash \
+ --disabled-password \
+ --gecos "" \
+ --home "/usr/share/logstash" \
+ --shell "/sbin/nologin" \
+ --no-create-home \
+ logstash
+<% else -%>
 RUN groupadd --gid 1000 logstash && \
  adduser --uid 1000 --gid 1000 --home /usr/share/logstash --no-create-home logstash
+<% end -%>
 
 # Add Logstash itself.
 RUN curl -Lo - <%= url_root %>/<%= tarball %> | \
@@ -148,12 +181,15 @@ ENV PATH=/usr/share/logstash/bin:$PATH
 <% end -%>
 COPY config/pipelines.yml config/log4j2.properties config/log4j2.file.properties config/
 COPY pipeline/default.conf pipeline/logstash.conf
-COPY env2yaml/env2yaml-amd64 env2yaml/env2yaml-arm64 env2yaml/
 
 RUN chown --recursive logstash:root config/ pipeline/
 # Ensure Logstash gets the correct locale by default.
 ENV LANG=<%= locale %> LC_ALL=<%= locale %>
 
+<% if image_flavor == 'wolfi' -%>
+COPY --from=builder-env2yaml /tmp/go/src/env2yaml/env2yaml /usr/local/bin/env2yaml
+<% else -%>
+COPY env2yaml/env2yaml-amd64 env2yaml/env2yaml-arm64 env2yaml/
 # Copy over the appropriate env2yaml artifact
 RUN env2yamlarch="$(<%= arch_command %>)"; \
  case "${env2yamlarch}" in \
@@ -165,13 +201,15 @@ RUN env2yamlarch="$(<%= arch_command %>)"; \
  ;; \
  *) echo >&2 "error: unsupported architecture '$env2yamlarch'"; exit 1 ;; \
  esac; \
+ mkdir -p /usr/local/bin; \
  cp env2yaml/env2yaml-${env2yamlarch} /usr/local/bin/env2yaml; \
  rm -rf env2yaml
+<% end -%>
 # Place the startup wrapper script.
 COPY bin/docker-entrypoint /usr/local/bin/
 
 RUN chmod 0755 /usr/local/bin/docker-entrypoint
-<%# End image_flavor 'full', oss', 'ubi8' %>
+<%# End image_flavor 'full', oss', 'ubi8', 'wolfi' %>
 <% end -%>
 
 USER 1000

rakelib/artifacts.rake

@@ -136,7 +136,7 @@ namespace "artifact" do
 
  desc "Generate rpm, deb, tar and zip artifacts"
  task "all" => ["prepare", "build"]
- task "docker_only" => ["prepare", "build_docker_full", "build_docker_oss", "build_docker_ubi8"]
+ task "docker_only" => ["prepare", "build_docker_full", "build_docker_oss", "build_docker_ubi8", "build_docker_wolfi"]
 
  desc "Build all (jdk bundled and not) tar.gz and zip of default logstash plugins with all dependencies"
  task "archives" => ["prepare", "generate_build_metadata"] do
@@ -313,12 +313,19 @@ namespace "artifact" do
  build_docker('ubi8')
  end
 
+ desc "Build wolfi docker image"
+ task "docker_wolfi" => %w(prepare generate_build_metadata archives) do
+ puts("[docker_wolfi] Building Wolfi docker image")
+ build_docker('wolfi')
+ end
+
  desc "Generate Dockerfiles for full and oss images"
  task "dockerfiles" => ["prepare", "generate_build_metadata"] do
  puts("[dockerfiles] Building Dockerfiles")
  build_dockerfile('oss')
  build_dockerfile('full')
  build_dockerfile('ubi8')
+ build_dockerfile('wolfi')
  build_dockerfile('ironbank')
  end
 
@@ -340,6 +347,12 @@ namespace "artifact" do
  build_dockerfile('ubi8')
  end
 
+ desc "Generate Dockerfile for wolfi images"
+ task "dockerfile_wolfi" => ["prepare", "generate_build_metadata"] do
+ puts("[dockerfiles] Building wolfi Dockerfiles")
+ build_dockerfile('wolfi')
+ end
+
  desc "Generate build context for ironbank"
  task "dockerfile_ironbank" => ["prepare", "generate_build_metadata"] do
  puts("[dockerfiles] Building ironbank Dockerfiles")
@@ -356,6 +369,7 @@ namespace "artifact" do
  unless ENV['SKIP_DOCKER'] == "1"
  Rake::Task["artifact:docker"].invoke
  Rake::Task["artifact:docker_ubi8"].invoke
+ Rake::Task["artifact:docker_wolfi"].invoke
  Rake::Task["artifact:dockerfiles"].invoke
  Rake::Task["artifact:docker_oss"].invoke
  end
@@ -380,6 +394,11 @@ namespace "artifact" do
  Rake::Task["artifact:dockerfile_ubi8"].invoke
  end
 
+ task "build_docker_wolfi" => [:generate_build_metadata] do
+ Rake::Task["artifact:docker_wolfi"].invoke
+ Rake::Task["artifact:dockerfile_wolfi"].invoke
+ end
+
  task "generate_build_metadata" do
  require 'time'
  require 'tempfile'