@sw-tsdk/connector 3.24.0 → 3.25.0-next.330d718
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/templates/python_310_definition_fips/Dockerfile +25 -9
- package/lib/templates/python_311_definition_fips/Dockerfile +31 -9
- package/lib/templates/python_312_definition_fips/Dockerfile +25 -9
- package/lib/templates/python_313_definition/Dockerfile +38 -0
- package/lib/templates/python_313_definition_fips/Dockerfile +69 -0
- package/lib/templates/python_314_definition/Dockerfile +38 -0
- package/lib/templates/python_314_definition_fips/Dockerfile +69 -0
- package/lib/templates/python_39_definition_fips/Dockerfile +31 -9
- package/package.json +5 -5
|
@@ -1,6 +1,4 @@
|
|
|
1
1
|
# syntax=docker/dockerfile:1.2
|
|
2
|
-
ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest
|
|
3
|
-
|
|
4
2
|
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.10-latest
|
|
5
3
|
|
|
6
4
|
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.10-latest
|
|
@@ -12,8 +10,7 @@ FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
|
12
10
|
USER root
|
|
13
11
|
|
|
14
12
|
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
15
|
-
COPY --from
|
|
16
|
-
COPY --from=${COMPILE_BASE} /usr/local/bin /usr/local/bin
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.10-latest /usr/lib/python3.10/site-packages /usr/lib/python3.10/site-packages
|
|
17
14
|
|
|
18
15
|
# Run compile-time OS package installs and custom scripts
|
|
19
16
|
COPY compile.* /scripts/
|
|
@@ -21,10 +18,17 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
|
|
|
21
18
|
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
22
19
|
|
|
23
20
|
# Run runner-time OS package installs and custom scripts here too,
|
|
24
|
-
# since the final runner FIPS image has no shell
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
25
24
|
COPY runner.* /scripts/
|
|
26
|
-
RUN
|
|
27
|
-
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs && \
|
|
26
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
|
|
27
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
28
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
29
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
30
|
+
RUN mkdir -p /runner-fs && \
|
|
31
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
28
32
|
|
|
29
33
|
RUN rm -rf /scripts
|
|
30
34
|
|
|
@@ -35,19 +39,31 @@ RUN pip install --target /connector-deps -r requirements.txt
|
|
|
35
39
|
|
|
36
40
|
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
37
41
|
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
38
|
-
USER root
|
|
39
42
|
ARG ASSET_KEYS
|
|
40
43
|
ENV ASSET_KEYS=$ASSET_KEYS
|
|
41
44
|
|
|
45
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
46
|
+
COPY --from=builder /runner-os-pkgs /
|
|
47
|
+
|
|
48
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
49
|
+
COPY --from=builder /runner-fs /
|
|
50
|
+
|
|
51
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
52
|
+
# from the builder stage so they are available at runtime.
|
|
53
|
+
COPY --from=builder /usr/lib/python3.10/site-packages /usr/lib/python3.10/site-packages/
|
|
54
|
+
|
|
42
55
|
# Copy only the connector-specific packages into site-packages.
|
|
43
56
|
# The runner's own FIPS Python installation remains intact.
|
|
44
|
-
COPY --from=builder /connector-deps /usr/
|
|
57
|
+
COPY --from=builder /connector-deps /usr/lib/python3.10/site-packages/
|
|
45
58
|
|
|
46
59
|
COPY connector /app
|
|
47
60
|
WORKDIR /app
|
|
61
|
+
USER nonroot
|
|
48
62
|
ENTRYPOINT ["python", "run.py"]
|
|
49
63
|
|
|
50
64
|
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
65
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
66
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
51
67
|
{{#each labels}}
|
|
52
68
|
LABEL {{{@key}}}="{{{this}}}"
|
|
53
69
|
{{/each}}
|
|
@@ -1,6 +1,4 @@
|
|
|
1
1
|
# syntax=docker/dockerfile:1.2
|
|
2
|
-
ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest
|
|
3
|
-
|
|
4
2
|
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.11-latest
|
|
5
3
|
|
|
6
4
|
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.11-latest
|
|
@@ -12,8 +10,7 @@ FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
|
12
10
|
USER root
|
|
13
11
|
|
|
14
12
|
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
15
|
-
COPY --from
|
|
16
|
-
COPY --from=${COMPILE_BASE} /usr/local/bin /usr/local/bin
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.11-latest /usr/lib/python3.11/site-packages /usr/lib/python3.11/site-packages
|
|
17
14
|
|
|
18
15
|
# Run compile-time OS package installs and custom scripts
|
|
19
16
|
COPY compile.* /scripts/
|
|
@@ -21,10 +18,23 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
|
|
|
21
18
|
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
22
19
|
|
|
23
20
|
# Run runner-time OS package installs and custom scripts here too,
|
|
24
|
-
# since the final runner FIPS image has no shell
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
25
24
|
COPY runner.* /scripts/
|
|
26
|
-
RUN
|
|
27
|
-
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs/etc/apk/keys && \
|
|
26
|
+
cp /etc/apk/repositories /runner-os-pkgs/etc/apk/repositories && \
|
|
27
|
+
cp /etc/apk/keys/* /runner-os-pkgs/etc/apk/keys/ && \
|
|
28
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi && \
|
|
29
|
+
rm -rf /runner-os-pkgs/etc/passwd \
|
|
30
|
+
/runner-os-pkgs/etc/group \
|
|
31
|
+
/runner-os-pkgs/etc/shadow \
|
|
32
|
+
/runner-os-pkgs/etc/apk
|
|
33
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
34
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
35
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
36
|
+
RUN mkdir -p /runner-fs && \
|
|
37
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
28
38
|
|
|
29
39
|
RUN rm -rf /scripts
|
|
30
40
|
|
|
@@ -35,19 +45,31 @@ RUN pip install --target /connector-deps -r requirements.txt
|
|
|
35
45
|
|
|
36
46
|
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
37
47
|
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
38
|
-
USER root
|
|
39
48
|
ARG ASSET_KEYS
|
|
40
49
|
ENV ASSET_KEYS=$ASSET_KEYS
|
|
41
50
|
|
|
51
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
52
|
+
COPY --from=builder /runner-os-pkgs /
|
|
53
|
+
|
|
54
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
55
|
+
COPY --from=builder /runner-fs /
|
|
56
|
+
|
|
57
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
58
|
+
# from the builder stage so they are available at runtime.
|
|
59
|
+
COPY --from=builder /usr/lib/python3.11/site-packages /usr/lib/python3.11/site-packages/
|
|
60
|
+
|
|
42
61
|
# Copy only the connector-specific packages into site-packages.
|
|
43
62
|
# The runner's own FIPS Python installation remains intact.
|
|
44
|
-
COPY --from=builder /connector-deps /usr/
|
|
63
|
+
COPY --from=builder /connector-deps /usr/lib/python3.11/site-packages/
|
|
45
64
|
|
|
46
65
|
COPY connector /app
|
|
47
66
|
WORKDIR /app
|
|
67
|
+
USER nonroot
|
|
48
68
|
ENTRYPOINT ["python", "run.py"]
|
|
49
69
|
|
|
50
70
|
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
71
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
72
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
51
73
|
{{#each labels}}
|
|
52
74
|
LABEL {{{@key}}}="{{{this}}}"
|
|
53
75
|
{{/each}}
|
|
@@ -1,6 +1,4 @@
|
|
|
1
1
|
# syntax=docker/dockerfile:1.2
|
|
2
|
-
ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest
|
|
3
|
-
|
|
4
2
|
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.12-latest
|
|
5
3
|
|
|
6
4
|
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.12-latest
|
|
@@ -12,8 +10,7 @@ FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
|
12
10
|
USER root
|
|
13
11
|
|
|
14
12
|
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
15
|
-
COPY --from
|
|
16
|
-
COPY --from=${COMPILE_BASE} /usr/local/bin /usr/local/bin
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.12-latest /usr/lib/python3.12/site-packages /usr/lib/python3.12/site-packages
|
|
17
14
|
|
|
18
15
|
# Run compile-time OS package installs and custom scripts
|
|
19
16
|
COPY compile.* /scripts/
|
|
@@ -21,10 +18,17 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
|
|
|
21
18
|
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
22
19
|
|
|
23
20
|
# Run runner-time OS package installs and custom scripts here too,
|
|
24
|
-
# since the final runner FIPS image has no shell
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
25
24
|
COPY runner.* /scripts/
|
|
26
|
-
RUN
|
|
27
|
-
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs && \
|
|
26
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
|
|
27
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
28
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
29
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
30
|
+
RUN mkdir -p /runner-fs && \
|
|
31
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
28
32
|
|
|
29
33
|
RUN rm -rf /scripts
|
|
30
34
|
|
|
@@ -35,19 +39,31 @@ RUN pip install --target /connector-deps -r requirements.txt
|
|
|
35
39
|
|
|
36
40
|
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
37
41
|
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
38
|
-
USER root
|
|
39
42
|
ARG ASSET_KEYS
|
|
40
43
|
ENV ASSET_KEYS=$ASSET_KEYS
|
|
41
44
|
|
|
45
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
46
|
+
COPY --from=builder /runner-os-pkgs /
|
|
47
|
+
|
|
48
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
49
|
+
COPY --from=builder /runner-fs /
|
|
50
|
+
|
|
51
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
52
|
+
# from the builder stage so they are available at runtime.
|
|
53
|
+
COPY --from=builder /usr/lib/python3.12/site-packages /usr/lib/python3.12/site-packages/
|
|
54
|
+
|
|
42
55
|
# Copy only the connector-specific packages into site-packages.
|
|
43
56
|
# The runner's own FIPS Python installation remains intact.
|
|
44
|
-
COPY --from=builder /connector-deps /usr/
|
|
57
|
+
COPY --from=builder /connector-deps /usr/lib/python3.12/site-packages/
|
|
45
58
|
|
|
46
59
|
COPY connector /app
|
|
47
60
|
WORKDIR /app
|
|
61
|
+
USER nonroot
|
|
48
62
|
ENTRYPOINT ["python", "run.py"]
|
|
49
63
|
|
|
50
64
|
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
65
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
66
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
51
67
|
{{#each labels}}
|
|
52
68
|
LABEL {{{@key}}}="{{{this}}}"
|
|
53
69
|
{{/each}}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# syntax=docker/dockerfile:1.2
|
|
2
|
+
ARG BASE_COMPILE_IMAGE_NAME=quay.io/swimlane/connector-python-compile-definition-base:3.13-latest
|
|
3
|
+
ARG RUNNER_IMAGE_NAME=quay.io/swimlane/connector-python-runner-definition-base:3.13-latest
|
|
4
|
+
ARG RUNTIME_IMAGE=runtime-image
|
|
5
|
+
ARG DEBUG=false
|
|
6
|
+
FROM ${BASE_COMPILE_IMAGE_NAME} AS compile-image
|
|
7
|
+
|
|
8
|
+
COPY compile.* /scripts/
|
|
9
|
+
RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apt-get update && xargs -a /scripts/compile.txt apt-get install -y --no-install-recommends; fi
|
|
10
|
+
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
11
|
+
RUN rm -rf /scripts
|
|
12
|
+
|
|
13
|
+
# Install OS packages
|
|
14
|
+
COPY requirements.txt .
|
|
15
|
+
RUN pip install --user -r requirements.txt
|
|
16
|
+
|
|
17
|
+
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
18
|
+
ARG ASSET_KEYS
|
|
19
|
+
ENV ASSET_KEYS=$ASSET_KEYS
|
|
20
|
+
RUN if [ -z "$DEBUG" ] ; then echo 'DEBUG not enabled' ; else echo 'DEBUG is enabled'; pip install debugpy ; fi
|
|
21
|
+
COPY runner.* /scripts/
|
|
22
|
+
|
|
23
|
+
RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apt-get update && xargs -a /scripts/runner.txt apt-get install -y --no-install-recommends; fi
|
|
24
|
+
RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
|
|
25
|
+
RUN rm -rf /scripts
|
|
26
|
+
|
|
27
|
+
COPY --from=compile-image /root/.local /root/.local
|
|
28
|
+
|
|
29
|
+
ENV PATH=/root/.local/bin:$PATH
|
|
30
|
+
|
|
31
|
+
COPY connector /app
|
|
32
|
+
WORKDIR app/
|
|
33
|
+
ENTRYPOINT ["python", "run.py"]
|
|
34
|
+
|
|
35
|
+
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
36
|
+
{{#each labels}}
|
|
37
|
+
LABEL {{{@key}}}="{{{this}}}"
|
|
38
|
+
{{/each}}
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
# syntax=docker/dockerfile:1.2
|
|
2
|
+
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.13-latest
|
|
3
|
+
|
|
4
|
+
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.13-latest
|
|
5
|
+
ARG RUNTIME_IMAGE=runtime-image
|
|
6
|
+
|
|
7
|
+
# Stage 1: builder — dev image has shell, apk, and pip for all build-time operations.
|
|
8
|
+
# The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
|
|
9
|
+
FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
10
|
+
USER root
|
|
11
|
+
|
|
12
|
+
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.13-latest /usr/lib/python3.13/site-packages /usr/lib/python3.13/site-packages
|
|
14
|
+
|
|
15
|
+
# Run compile-time OS package installs and custom scripts
|
|
16
|
+
COPY compile.* /scripts/
|
|
17
|
+
RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/compile.txt); fi
|
|
18
|
+
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
19
|
+
|
|
20
|
+
# Run runner-time OS package installs and custom scripts here too,
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
24
|
+
COPY runner.* /scripts/
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs && \
|
|
26
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
|
|
27
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
28
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
29
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
30
|
+
RUN mkdir -p /runner-fs && \
|
|
31
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
32
|
+
|
|
33
|
+
RUN rm -rf /scripts
|
|
34
|
+
|
|
35
|
+
# Install connector Python dependencies into an isolated location.
|
|
36
|
+
# This avoids overwriting the runner's FIPS-compliant /usr/local/lib entirely.
|
|
37
|
+
COPY requirements.txt .
|
|
38
|
+
RUN pip install --target /connector-deps -r requirements.txt
|
|
39
|
+
|
|
40
|
+
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
41
|
+
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
42
|
+
ARG ASSET_KEYS
|
|
43
|
+
ENV ASSET_KEYS=$ASSET_KEYS
|
|
44
|
+
|
|
45
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
46
|
+
COPY --from=builder /runner-os-pkgs /
|
|
47
|
+
|
|
48
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
49
|
+
COPY --from=builder /runner-fs /
|
|
50
|
+
|
|
51
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
52
|
+
# from the builder stage so they are available at runtime.
|
|
53
|
+
COPY --from=builder /usr/lib/python3.13/site-packages /usr/lib/python3.13/site-packages/
|
|
54
|
+
|
|
55
|
+
# Copy only the connector-specific packages into site-packages.
|
|
56
|
+
# The runner's own FIPS Python installation remains intact.
|
|
57
|
+
COPY --from=builder /connector-deps /usr/lib/python3.13/site-packages/
|
|
58
|
+
|
|
59
|
+
COPY connector /app
|
|
60
|
+
WORKDIR /app
|
|
61
|
+
USER nonroot
|
|
62
|
+
ENTRYPOINT ["python", "run.py"]
|
|
63
|
+
|
|
64
|
+
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
65
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
66
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
67
|
+
{{#each labels}}
|
|
68
|
+
LABEL {{{@key}}}="{{{this}}}"
|
|
69
|
+
{{/each}}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# syntax=docker/dockerfile:1.2
|
|
2
|
+
ARG BASE_COMPILE_IMAGE_NAME=quay.io/swimlane/connector-python-compile-definition-base:3.14-latest
|
|
3
|
+
ARG RUNNER_IMAGE_NAME=quay.io/swimlane/connector-python-runner-definition-base:3.14-latest
|
|
4
|
+
ARG RUNTIME_IMAGE=runtime-image
|
|
5
|
+
ARG DEBUG=false
|
|
6
|
+
FROM ${BASE_COMPILE_IMAGE_NAME} AS compile-image
|
|
7
|
+
|
|
8
|
+
COPY compile.* /scripts/
|
|
9
|
+
RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apt-get update && xargs -a /scripts/compile.txt apt-get install -y --no-install-recommends; fi
|
|
10
|
+
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
11
|
+
RUN rm -rf /scripts
|
|
12
|
+
|
|
13
|
+
# Install OS packages
|
|
14
|
+
COPY requirements.txt .
|
|
15
|
+
RUN pip install --user -r requirements.txt
|
|
16
|
+
|
|
17
|
+
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
18
|
+
ARG ASSET_KEYS
|
|
19
|
+
ENV ASSET_KEYS=$ASSET_KEYS
|
|
20
|
+
RUN if [ -z "$DEBUG" ] ; then echo 'DEBUG not enabled' ; else echo 'DEBUG is enabled'; pip install debugpy ; fi
|
|
21
|
+
COPY runner.* /scripts/
|
|
22
|
+
|
|
23
|
+
RUN if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apt-get update && xargs -a /scripts/runner.txt apt-get install -y --no-install-recommends; fi
|
|
24
|
+
RUN if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && /scripts/runner.sh; fi
|
|
25
|
+
RUN rm -rf /scripts
|
|
26
|
+
|
|
27
|
+
COPY --from=compile-image /root/.local /root/.local
|
|
28
|
+
|
|
29
|
+
ENV PATH=/root/.local/bin:$PATH
|
|
30
|
+
|
|
31
|
+
COPY connector /app
|
|
32
|
+
WORKDIR app/
|
|
33
|
+
ENTRYPOINT ["python", "run.py"]
|
|
34
|
+
|
|
35
|
+
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
36
|
+
{{#each labels}}
|
|
37
|
+
LABEL {{{@key}}}="{{{this}}}"
|
|
38
|
+
{{/each}}
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
# syntax=docker/dockerfile:1.2
|
|
2
|
+
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.14-latest
|
|
3
|
+
|
|
4
|
+
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.14-latest
|
|
5
|
+
ARG RUNTIME_IMAGE=runtime-image
|
|
6
|
+
|
|
7
|
+
# Stage 1: builder — dev image has shell, apk, and pip for all build-time operations.
|
|
8
|
+
# The final FIPS image is distroless (no shell), so ALL RUN commands must happen here.
|
|
9
|
+
FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
10
|
+
USER root
|
|
11
|
+
|
|
12
|
+
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.14-latest /usr/lib/python3.14/site-packages /usr/lib/python3.14/site-packages
|
|
14
|
+
|
|
15
|
+
# Run compile-time OS package installs and custom scripts
|
|
16
|
+
COPY compile.* /scripts/
|
|
17
|
+
RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $(cat /scripts/compile.txt); fi
|
|
18
|
+
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
19
|
+
|
|
20
|
+
# Run runner-time OS package installs and custom scripts here too,
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
24
|
+
COPY runner.* /scripts/
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs && \
|
|
26
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi
|
|
27
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
28
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
29
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
30
|
+
RUN mkdir -p /runner-fs && \
|
|
31
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
32
|
+
|
|
33
|
+
RUN rm -rf /scripts
|
|
34
|
+
|
|
35
|
+
# Install connector Python dependencies into an isolated location.
|
|
36
|
+
# This avoids overwriting the runner's FIPS-compliant /usr/local/lib entirely.
|
|
37
|
+
COPY requirements.txt .
|
|
38
|
+
RUN pip install --target /connector-deps -r requirements.txt
|
|
39
|
+
|
|
40
|
+
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
41
|
+
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
42
|
+
ARG ASSET_KEYS
|
|
43
|
+
ENV ASSET_KEYS=$ASSET_KEYS
|
|
44
|
+
|
|
45
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
46
|
+
COPY --from=builder /runner-os-pkgs /
|
|
47
|
+
|
|
48
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
49
|
+
COPY --from=builder /runner-fs /
|
|
50
|
+
|
|
51
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
52
|
+
# from the builder stage so they are available at runtime.
|
|
53
|
+
COPY --from=builder /usr/lib/python3.14/site-packages /usr/lib/python3.14/site-packages/
|
|
54
|
+
|
|
55
|
+
# Copy only the connector-specific packages into site-packages.
|
|
56
|
+
# The runner's own FIPS Python installation remains intact.
|
|
57
|
+
COPY --from=builder /connector-deps /usr/lib/python3.14/site-packages/
|
|
58
|
+
|
|
59
|
+
COPY connector /app
|
|
60
|
+
WORKDIR /app
|
|
61
|
+
USER nonroot
|
|
62
|
+
ENTRYPOINT ["python", "run.py"]
|
|
63
|
+
|
|
64
|
+
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
65
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
66
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
67
|
+
{{#each labels}}
|
|
68
|
+
LABEL {{{@key}}}="{{{this}}}"
|
|
69
|
+
{{/each}}
|
|
@@ -1,6 +1,4 @@
|
|
|
1
1
|
# syntax=docker/dockerfile:1.2
|
|
2
|
-
ARG COMPILE_BASE=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest
|
|
3
|
-
|
|
4
2
|
ARG PYTHON_DEV_IMAGE=quay.io/swimlane-connectors/connector-python-dev-definition-base-fips:3.9-latest
|
|
5
3
|
|
|
6
4
|
ARG RUNNER_IMAGE_NAME=quay.io/swimlane-connectors/connector-python-runner-definition-base-fips:3.9-latest
|
|
@@ -12,8 +10,7 @@ FROM ${PYTHON_DEV_IMAGE} AS builder
|
|
|
12
10
|
USER root
|
|
13
11
|
|
|
14
12
|
# Carry over pre-installed swimlane SDK packages from the compile-fips base
|
|
15
|
-
COPY --from
|
|
16
|
-
COPY --from=${COMPILE_BASE} /usr/local/bin /usr/local/bin
|
|
13
|
+
COPY --from=quay.io/swimlane-connectors/connector-python-compile-definition-base-fips:3.9-latest /usr/lib/python3.9/site-packages /usr/lib/python3.9/site-packages
|
|
17
14
|
|
|
18
15
|
# Run compile-time OS package installs and custom scripts
|
|
19
16
|
COPY compile.* /scripts/
|
|
@@ -21,10 +18,23 @@ RUN if [ $(stat -c %s "/scripts/compile.txt") -ne 0 ]; then apk add --no-cache $
|
|
|
21
18
|
RUN if [ $(stat -c %s "/scripts/compile.sh") -ne 0 ]; then chmod +x /scripts/compile.sh && /scripts/compile.sh; fi
|
|
22
19
|
|
|
23
20
|
# Run runner-time OS package installs and custom scripts here too,
|
|
24
|
-
# since the final runner FIPS image has no shell
|
|
21
|
+
# since the final runner FIPS image has no shell.
|
|
22
|
+
# OS packages are installed into an isolated root (/runner-os-pkgs) so they can
|
|
23
|
+
# be selectively copied to the distroless runtime stage without leaking dev toolchain.
|
|
25
24
|
COPY runner.* /scripts/
|
|
26
|
-
RUN
|
|
27
|
-
|
|
25
|
+
RUN mkdir -p /runner-os-pkgs/etc/apk/keys && \
|
|
26
|
+
cp /etc/apk/repositories /runner-os-pkgs/etc/apk/repositories && \
|
|
27
|
+
cp /etc/apk/keys/* /runner-os-pkgs/etc/apk/keys/ && \
|
|
28
|
+
if [ $(stat -c %s "/scripts/runner.txt") -ne 0 ]; then apk add --no-cache --root /runner-os-pkgs --initdb $(cat /scripts/runner.txt); fi && \
|
|
29
|
+
rm -rf /runner-os-pkgs/etc/passwd \
|
|
30
|
+
/runner-os-pkgs/etc/group \
|
|
31
|
+
/runner-os-pkgs/etc/shadow \
|
|
32
|
+
/runner-os-pkgs/etc/apk
|
|
33
|
+
# RUNNER_FS is a staging directory that mirrors the runtime filesystem.
|
|
34
|
+
# runner.sh should write any runtime files (certs, configs, apk packages) under
|
|
35
|
+
# $RUNNER_FS so they are copied to the distroless runtime image correctly.
|
|
36
|
+
RUN mkdir -p /runner-fs && \
|
|
37
|
+
if [ $(stat -c %s "/scripts/runner.sh") -ne 0 ]; then chmod +x /scripts/runner.sh && RUNNER_FS=/runner-fs /scripts/runner.sh; fi
|
|
28
38
|
|
|
29
39
|
RUN rm -rf /scripts
|
|
30
40
|
|
|
@@ -35,19 +45,31 @@ RUN pip install --target /connector-deps -r requirements.txt
|
|
|
35
45
|
|
|
36
46
|
# Stage 3: runtime-image — minimal distroless FIPS image, no shell, only copy artifacts
|
|
37
47
|
FROM ${RUNNER_IMAGE_NAME} AS runtime-image
|
|
38
|
-
USER root
|
|
39
48
|
ARG ASSET_KEYS
|
|
40
49
|
ENV ASSET_KEYS=$ASSET_KEYS
|
|
41
50
|
|
|
51
|
+
# Copy runner OS packages installed in the isolated root during the builder stage.
|
|
52
|
+
COPY --from=builder /runner-os-pkgs /
|
|
53
|
+
|
|
54
|
+
# Copy any runtime files staged by runner.sh (certs, configs, etc.) into the image.
|
|
55
|
+
COPY --from=builder /runner-fs /
|
|
56
|
+
|
|
57
|
+
# Copy compile-fips base packages (e.g. connector_definition_runner, pylint, black, etc.)
|
|
58
|
+
# from the builder stage so they are available at runtime.
|
|
59
|
+
COPY --from=builder /usr/lib/python3.9/site-packages /usr/lib/python3.9/site-packages/
|
|
60
|
+
|
|
42
61
|
# Copy only the connector-specific packages into site-packages.
|
|
43
62
|
# The runner's own FIPS Python installation remains intact.
|
|
44
|
-
COPY --from=builder /connector-deps /usr/
|
|
63
|
+
COPY --from=builder /connector-deps /usr/lib/python3.9/site-packages/
|
|
45
64
|
|
|
46
65
|
COPY connector /app
|
|
47
66
|
WORKDIR /app
|
|
67
|
+
USER nonroot
|
|
48
68
|
ENTRYPOINT ["python", "run.py"]
|
|
49
69
|
|
|
50
70
|
FROM ${RUNTIME_IMAGE} AS connector-image
|
|
71
|
+
COPY --from=builder /bin/busybox /bin/sh
|
|
72
|
+
COPY --from=builder /bin/busybox /bin/sleep
|
|
51
73
|
{{#each labels}}
|
|
52
74
|
LABEL {{{@key}}}="{{{this}}}"
|
|
53
75
|
{{/each}}
|
package/package.json
CHANGED
|
@@ -9,9 +9,9 @@
|
|
|
9
9
|
"@oclif/core": "2.8.5",
|
|
10
10
|
"@oclif/plugin-help": "5.2.9",
|
|
11
11
|
"@oclif/plugin-plugins": "3.1.2",
|
|
12
|
-
"@sw-tsdk/common": "3.
|
|
13
|
-
"@sw-tsdk/core": "3.
|
|
14
|
-
"@sw-tsdk/docker": "3.
|
|
12
|
+
"@sw-tsdk/common": "3.25.0-next.330d718",
|
|
13
|
+
"@sw-tsdk/core": "3.25.0-next.330d718",
|
|
14
|
+
"@sw-tsdk/docker": "3.25.0-next.330d718",
|
|
15
15
|
"@swimlane/connector-interfaces": "1.11.0",
|
|
16
16
|
"@swimlane/cosign": "1.4.1",
|
|
17
17
|
"archiver": "5.3.1",
|
|
@@ -66,6 +66,6 @@
|
|
|
66
66
|
"test": "jest --passWithNoTests"
|
|
67
67
|
},
|
|
68
68
|
"types": "lib/index.d.ts",
|
|
69
|
-
"version": "3.
|
|
70
|
-
"gitHead": "
|
|
69
|
+
"version": "3.25.0-next.330d718",
|
|
70
|
+
"gitHead": "330d718891162eb8b0698d9af9d11cf89ab958ab"
|
|
71
71
|
}
|