Skip to content

Commit c926ddb

Browse files
committed
move to contrast-security-oss
1 parent 8cddc81 commit c926ddb

File tree

4 files changed

+151
-120
lines changed

4 files changed

+151
-120
lines changed

.github/workflows/container.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,6 @@ jobs:
2929

3030
- name: Build binaries
3131
run: |
32-
docker run --rm -v ${{ github.workspace }}:/repo -w /repo ghcr.io/bmacnaughton/${{ matrix.image }}:latest
32+
docker run --rm -v ${{ github.workspace }}:/repo -w /repo ghcr.io/contrast-security-oss/${{ matrix.image }}:latest
3333
- name: Show files
3434
run: find ${{ github.workspace }}

.github/workflows/release.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ jobs:
4545
with:
4646
context: ${{ matrix.image }}
4747
tags: |
48-
ghcr.io/bmacnaughton/${{ matrix.image }}:latest
49-
ghcr.io/bmacnaughton/${{ matrix.image }}:${{ env.MAJOR }}
50-
ghcr.io/bmacnaughton/${{ matrix.image }}:${{ env.MINOR }}
51-
ghcr.io/bmacnaughton/${{ matrix.image }}:${{ env.PATCH }}
48+
ghcr.io/contrast-security-oss/${{ matrix.image }}:latest
49+
ghcr.io/contrast-security-oss/${{ matrix.image }}:${{ env.MAJOR }}
50+
ghcr.io/contrast-security-oss/${{ matrix.image }}:${{ env.MINOR }}
51+
ghcr.io/contrast-security-oss/${{ matrix.image }}:${{ env.PATCH }}
5252
labels: |
5353
org.opencontainers.image.version=${{ env.PATCH }}
5454
org.opencontainers.image.source=${{ github.event.repository.html_url }}

README.md

Lines changed: 29 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,33 @@
11
# docker-images
22

3+
These docker images are used to build software for different target systems.
4+
35
Originally used by `prebuildify-cross`, these images were modified by Contrast Security, Inc. so
4-
they had fewer dependencies. The primary changes are that the containers now require that the repo
6+
they had fewer dependencies.
7+
8+
All images include Node.js LTS, Python 3.x, npm and a build toolchain suitable for
9+
`node-gyp` and `prebuildify`.
10+
11+
# using the images
12+
13+
The primary changes are that the containers now require that the repo
514
be mapped to `/repo`, `entrypoint` is set to `sh`, and `cmd` is set to `scripts/build-generic.sh`
6-
with an argument of the image name, e.g., `centos7`.
15+
with an argument of the image name, e.g., `centos7`. You'll typically want to set the user when
16+
you invoke the image; if you don't you'll have to make sure the file/directory permissions will
17+
work.
718

819
From `centos7/Dockerfile`:
920
```
1021
ENTRYPOINT ["sh"]
1122
CMD ["scripts/build-generic.sh", "centos7"]
1223
```
1324

14-
How to invoke the `centos7` image:
25+
How to invoke the `centos7` image (to build from my local copy of `node-fn-inspect`):
1526
```
16-
docker run -v /home/bruce/github/csi/fn-inspect:/repo ghcr.io/bmacnaughton/centos7
27+
# typical usage is to set the user to the user invoking the image so that the
28+
# permissions are effectively inherited.
29+
30+
docker run -v /home/bruce/github/csi/fn-inspect:/repo -u $(id -u) ghcr.io/contrast-security-oss/centos7
1731
1832
# The docker image will invoke `/home/bruce/github/csi/fn-inspect/scripts/build-generic.sh`
1933
# as a shell script with the argument `centos7` (the name of the image). The command that is
@@ -22,126 +36,26 @@ docker run -v /home/bruce/github/csi/fn-inspect:/repo ghcr.io/bmacnaughton/cento
2236
# `sh scripts/build-generic.sh centos7`
2337
```
2438

39+
A more minor change is to not create the `node` user in the `centos7` image. It's not
40+
needed and had the potential to create permissions issues.
41+
2542
## build-generic.sh
2643

2744
The `build-generic.sh` script can be invoked from images that do not have `bash`, so your
2845
script must be Posix-compliant in order to work with `ash`, `dash`, etc.
2946

30-
# THE FOLLOWING TEXT NEEDS TO BE UPDATED
31-
32-
33-
**Docker images for cross compiling prebuilt binaries for Node.js. Used by [`prebuildify-cross`](https://github.com/prebuild/prebuildify-cross).**
34-
35-
[![Release](https://img.shields.io/github/v/release/prebuild/docker-images)](https://github.com/prebuild/docker-images/releases/latest)
36-
[![Release](https://github.com/prebuild/docker-images/actions/workflows/release.yml/badge.svg)](https://github.com/prebuild/docker-images/actions/workflows/release.yml)
37-
[![Common Changelog](https://common-changelog.org/badge.svg)](https://common-changelog.org)
38-
39-
## About
40-
41-
All images include Node.js LTS, Python 3.x, npm and a preconfigured build toolchain suitable for `node-gyp` and `prebuildify`. For example:
42-
43-
```
44-
> docker run --rm ghcr.io/prebuild/alpine node -v
45-
v16.15.1
46-
```
47-
48-
Images are tagged with a major, minor and full version as well as `latest`. For example, use the following to pin to major version 2:
49-
50-
```dockerfile
51-
FROM ghcr.io/prebuild/alpine:2
52-
```
53-
54-
## Versioning guarantees
55-
56-
Within a major version range, we will not change toolchains, environment variables, working directories, users and more. However, the Node.js version will change without notice. We use Node.js [LTS](https://github.com/nodejs/Release) (at the time of building images) for a light maintenance effort. This is okay because `prebuildify` can target (the headers of) older Node.js versions while itself running on a newer version.
57-
58-
Images that are based on [`dockcross`](https://github.com/dockcross/dockcross) (see below) may inadvertently introduce breaking changes because `dockcross` does not use semantic versions ([dockcross/dockcross#399](https://github.com/dockcross/dockcross/issues/399)) and does not maintain a changelog that would allow us to easily categorize changes and then tag our images accordingly. If this concerns you we recommend pinning to an exact version (`x.x.x`) which we treat as immutable.
59-
60-
## Images
61-
62-
### [`centos7-devtoolset7`](https://github.com/orgs/prebuild/packages/container/package/centos7-devtoolset7)
63-
64-
Compile in CentOS 7, as a better alternative to (commonly) Ubuntu 16.04 on Travis or GitHub Actions. Makes prebuilds compatible with Debian 8, Ubuntu 14.04, RHEL 7, CentOS 7 and other Linux flavors with an old glibc.
65-
66-
> The neat thing about this is that you get to compile with gcc 7 but glibc 2.17, so binaries are compatible for \[among others] Ubuntu 14.04 and Debian 8.
67-
>
68-
> The RHEL folks put in a ton of work to make the devtoolsets work on their older base systems (libc mainly), which involves shipping a delta library that contains the new stuff that can be statically linked in where it's used. We use this method for building Node binary releases.
69-
>
70-
> \-- <cite>[**@rvagg**](https://github.com/rvagg) ([prebuild/docker-images#8](https://github.com/prebuild/docker-images/pull/8))</cite>
71-
72-
Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the libc flavor, to set them apart from musl prebuilds, e.g. `linux-x64/node.glibc.node`.
73-
74-
### [`alpine`](https://github.com/orgs/prebuild/packages/container/package/alpine)
75-
76-
Compile in Alpine, which uses musl instead of glibc and therefore can't run regular linux prebuilds. Worse, it sometimes does successfully _load_ such a prebuild during `npm install` - which prevents a compilation fallback from kicking in - and then segfaults at runtime. You can fix this situation in two ways: by shipping an `alpine` prebuild and/or by shipping a `centos7-devtoolset7` prebuild, because the latter will be skipped in Alpine thanks to the `glibc` tag.
47+
Of course, you can use `--entrypoint` or run a command other than `scripts/build-generic.sh`
48+
if your use case calls for it.
7749

78-
Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the libc flavor, to set them apart from glibc prebuilds, e.g. `linux-x64/node.musl.node`.
50+
## limitations
7951

80-
### [`linux-armv6`](https://github.com/orgs/prebuild/packages/container/package/linux-armv6)
52+
Only the images required by Contrast Security, Inc. are built and published at this time.
53+
If you're using the images and need another target, let us know; we'll add it.
8154

82-
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (6).
83-
84-
### [`linux-armv7`](https://github.com/orgs/prebuild/packages/container/package/linux-armv7)
85-
86-
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
87-
88-
### [`linux-armv7l-musl`](https://github.com/orgs/prebuild/packages/container/package/linux-armv7l-musl)
89-
90-
Cross-compile for Linux ARM. This image uses musl instead of glibc for Alpine linux. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
91-
92-
### [`linux-arm64`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64)
93-
94-
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
95-
96-
### [`linux-arm64-lts`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64-lts)
97-
98-
Cross-compile for Linux ARM. This image uses an old version of glibc (glibc 2.27) for compatibility. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
99-
100-
### [`linux-arm64-musl`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64-musl)
101-
102-
Cross-compile for Linux ARM. This image uses musl instead of glibc for Alpine linux. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
103-
104-
### [`android-armv7`](https://github.com/orgs/prebuild/packages/container/package/android-armv7)
105-
106-
Cross-compile for Android ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
107-
108-
### [`android-arm64`](https://github.com/orgs/prebuild/packages/container/package/android-arm64)
109-
110-
Cross-compile for Android ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
111-
112-
## Old images
113-
114-
Images were previously hosted on Docker Hub. These are no longer updated:
115-
116-
- [`centos7-devtoolset7`](https://hub.docker.com/r/prebuild/centos7-devtoolset7)
117-
- [`alpine`](https://hub.docker.com/r/prebuild/alpine)
118-
- [`linux-armv6`](https://hub.docker.com/r/prebuild/linux-armv6)
119-
- [`linux-armv7`](https://hub.docker.com/r/prebuild/linux-armv7)
120-
- [`linux-arm64`](https://hub.docker.com/r/prebuild/linux-arm64)
121-
- [`android-armv7`](https://hub.docker.com/r/prebuild/android-armv7)
122-
- [`android-arm64`](https://hub.docker.com/r/prebuild/android-arm64)
123-
124-
## Development
125-
126-
### Releasing
127-
128-
Update [`CHANGELOG.md`](CHANGELOG.md) according to [Common Changelog](https://common-changelog), for which you might like [`hallmark`](https://github.com/vweevers/hallmark) to pull commit messages into the changelog:
129-
130-
```
131-
hallmark bump minor
132-
```
133-
134-
Tweak `CHANGELOG.md` as needed until `hallmark lint` is happy. Then commit, tag and push. For example:
135-
136-
```
137-
git add CHANGELOG.md
138-
git commit -m "2.1.0"
139-
git tag -a v2.1.0 -m v2.1.0
140-
git push --follow-tags
141-
```
55+
## releasing
14256

143-
The git tag triggers [CI/CD](https://github.com/prebuild/docker-images/actions) to publish new images to [GHCR](https://github.com/orgs/prebuild/packages?ecosystem=container). A changelog entry is required.
57+
Create a version tag of the form vX.Y.Z and push it to master.
14458

14559
## License
14660

147-
[GPL-3.0-only](LICENSE) © 2019 `prebuild` contributors.
61+
[GPL-3.0-only](LICENSE) © 2019 `prebuild` contributors. 2024 Contrast Security, Inc.

original-readme.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# This is the unmodified portion of prebuild/docker-images
2+
3+
**Docker images for cross compiling prebuilt binaries for Node.js. Used by [`prebuildify-cross`](https://github.com/prebuild/prebuildify-cross).**
4+
5+
[![Release](https://img.shields.io/github/v/release/prebuild/docker-images)](https://github.com/prebuild/docker-images/releases/latest)
6+
[![Release](https://github.com/prebuild/docker-images/actions/workflows/release.yml/badge.svg)](https://github.com/prebuild/docker-images/actions/workflows/release.yml)
7+
[![Common Changelog](https://common-changelog.org/badge.svg)](https://common-changelog.org)
8+
9+
## About
10+
11+
All images include Node.js LTS, Python 3.x, npm and a preconfigured build toolchain suitable for `node-gyp` and `prebuildify`. For example:
12+
13+
```
14+
> docker run --rm ghcr.io/prebuild/alpine node -v
15+
v16.15.1
16+
```
17+
18+
Images are tagged with a major, minor and full version as well as `latest`. For example, use the following to pin to major version 2:
19+
20+
```dockerfile
21+
FROM ghcr.io/prebuild/alpine:2
22+
```
23+
24+
## Versioning guarantees
25+
26+
Within a major version range, we will not change toolchains, environment variables, working directories, users and more. However, the Node.js version will change without notice. We use Node.js [LTS](https://github.com/nodejs/Release) (at the time of building images) for a light maintenance effort. This is okay because `prebuildify` can target (the headers of) older Node.js versions while itself running on a newer version.
27+
28+
Images that are based on [`dockcross`](https://github.com/dockcross/dockcross) (see below) may inadvertently introduce breaking changes because `dockcross` does not use semantic versions ([dockcross/dockcross#399](https://github.com/dockcross/dockcross/issues/399)) and does not maintain a changelog that would allow us to easily categorize changes and then tag our images accordingly. If this concerns you we recommend pinning to an exact version (`x.x.x`) which we treat as immutable.
29+
30+
## Images
31+
32+
### [`centos7-devtoolset7`](https://github.com/orgs/prebuild/packages/container/package/centos7-devtoolset7)
33+
34+
Compile in CentOS 7, as a better alternative to (commonly) Ubuntu 16.04 on Travis or GitHub Actions. Makes prebuilds compatible with Debian 8, Ubuntu 14.04, RHEL 7, CentOS 7 and other Linux flavors with an old glibc.
35+
36+
> The neat thing about this is that you get to compile with gcc 7 but glibc 2.17, so binaries are compatible for \[among others] Ubuntu 14.04 and Debian 8.
37+
>
38+
> The RHEL folks put in a ton of work to make the devtoolsets work on their older base systems (libc mainly), which involves shipping a delta library that contains the new stuff that can be statically linked in where it's used. We use this method for building Node binary releases.
39+
>
40+
> \-- <cite>[**@rvagg**](https://github.com/rvagg) ([prebuild/docker-images#8](https://github.com/prebuild/docker-images/pull/8))</cite>
41+
42+
Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the libc flavor, to set them apart from musl prebuilds, e.g. `linux-x64/node.glibc.node`.
43+
44+
### [`alpine`](https://github.com/orgs/prebuild/packages/container/package/alpine)
45+
46+
Compile in Alpine, which uses musl instead of glibc and therefore can't run regular linux prebuilds. Worse, it sometimes does successfully _load_ such a prebuild during `npm install` - which prevents a compilation fallback from kicking in - and then segfaults at runtime. You can fix this situation in two ways: by shipping an `alpine` prebuild and/or by shipping a `centos7-devtoolset7` prebuild, because the latter will be skipped in Alpine thanks to the `glibc` tag.
47+
48+
Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the libc flavor, to set them apart from glibc prebuilds, e.g. `linux-x64/node.musl.node`.
49+
50+
### [`linux-armv6`](https://github.com/orgs/prebuild/packages/container/package/linux-armv6)
51+
52+
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (6).
53+
54+
### [`linux-armv7`](https://github.com/orgs/prebuild/packages/container/package/linux-armv7)
55+
56+
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
57+
58+
### [`linux-armv7l-musl`](https://github.com/orgs/prebuild/packages/container/package/linux-armv7l-musl)
59+
60+
Cross-compile for Linux ARM. This image uses musl instead of glibc for Alpine linux. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
61+
62+
### [`linux-arm64`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64)
63+
64+
Cross-compile for Linux ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
65+
66+
### [`linux-arm64-lts`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64-lts)
67+
68+
Cross-compile for Linux ARM. This image uses an old version of glibc (glibc 2.27) for compatibility. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
69+
70+
### [`linux-arm64-musl`](https://github.com/orgs/prebuild/packages/container/package/linux-arm64-musl)
71+
72+
Cross-compile for Linux ARM. This image uses musl instead of glibc for Alpine linux. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
73+
74+
### [`android-armv7`](https://github.com/orgs/prebuild/packages/container/package/android-armv7)
75+
76+
Cross-compile for Android ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (7).
77+
78+
### [`android-arm64`](https://github.com/orgs/prebuild/packages/container/package/android-arm64)
79+
80+
Cross-compile for Android ARM. This image thinly wraps a [`dockcross`](https://github.com/dockcross/dockcross) image. Preconfigures `prebuildify` to [tag](https://github.com/prebuild/prebuildify#options) prebuilds with the armv version (8).
81+
82+
## Old images
83+
84+
Images were previously hosted on Docker Hub. These are no longer updated:
85+
86+
- [`centos7-devtoolset7`](https://hub.docker.com/r/prebuild/centos7-devtoolset7)
87+
- [`alpine`](https://hub.docker.com/r/prebuild/alpine)
88+
- [`linux-armv6`](https://hub.docker.com/r/prebuild/linux-armv6)
89+
- [`linux-armv7`](https://hub.docker.com/r/prebuild/linux-armv7)
90+
- [`linux-arm64`](https://hub.docker.com/r/prebuild/linux-arm64)
91+
- [`android-armv7`](https://hub.docker.com/r/prebuild/android-armv7)
92+
- [`android-arm64`](https://hub.docker.com/r/prebuild/android-arm64)
93+
94+
## Development
95+
96+
### Releasing
97+
98+
Update [`CHANGELOG.md`](CHANGELOG.md) according to [Common Changelog](https://common-changelog), for which you might like [`hallmark`](https://github.com/vweevers/hallmark) to pull commit messages into the changelog:
99+
100+
```
101+
hallmark bump minor
102+
```
103+
104+
Tweak `CHANGELOG.md` as needed until `hallmark lint` is happy. Then commit, tag and push. For example:
105+
106+
```
107+
git add CHANGELOG.md
108+
git commit -m "2.1.0"
109+
git tag -a v2.1.0 -m v2.1.0
110+
git push --follow-tags
111+
```
112+
113+
The git tag triggers [CI/CD](https://github.com/prebuild/docker-images/actions) to publish new images to [GHCR](https://github.com/orgs/prebuild/packages?ecosystem=container). A changelog entry is required.
114+
115+
## License
116+
117+
[GPL-3.0-only](LICENSE) © 2019 `prebuild` contributors.

0 commit comments

Comments
 (0)