logan
f9c6c1d826
基于 WEB-UI-Development-Guide 标准的整体升级,并更名 LokiDeploy → opsx-loki。 前端(Gin+React+shadcn/ui): - 按 02/07 章重构:页面域化拆分(无超 400 行文件)、PageContainer/ListQuery、 反馈分级(成功静默/失败 toast/危险确认)、401 单飞刷新+队列重放 - 暗色模式(next-themes)+ 语义 Token(--primary 品牌色/success/warning/info) - 部署向导(状态推导四步:环境→存储→Loki→采集,内嵌表单闭环) - 日志查询页:LogQL 标签构建器/拖拽直方图/日志上下文/Live Tail/查询历史 - 按用户+标签策略的查询授权(服务端强制合并策略) 后端(Go+Gin+JSON DB): - 简单用户管理(仅 admin,无 RBAC)+ TokenVersion 会话吊销 + 登录 IP 限流 - LDAP 接入:配置(AES 加密存储/hasPassword 脱敏)/测试连接/批量导入/登录 - 存储配置测试连接(SigV4 零依赖)+ 桶不存在自动创建 - Loki 三模式部署修复:SSH 密钥认证、3.x 配置模板、ruler 对象存储嵌套块、 凭证解密、孤儿 deploying 状态恢复、Grafana 部署(可选默认关)+面板导入 - DaemonSet 采集纯 YAML(去 helm 依赖)+ DNS 自愈回退 ClusterIP + 集群名标签 - 日志查询代理:cluster-svc 经 kube-apiserver proxy/url 直连 + cursor 翻页 - 统一 log 命名空间;部署就绪探活;Grafana 访问地址自动记录 修复:run.sh 增量编译检测、Sanitized 脱敏补全、LokiDeployment Update 白名单、 健康检查 CreatedAt 零值等 10+ 存量 bug。 数据兼容:DB 沿用旧 lokideploy.json(新名优先);localStorage 一次性迁移; HKDF 加密前缀保留(已加密凭证不受影响)。
179 lines
6.8 KiB
Docker
179 lines
6.8 KiB
Docker
# ============================================================
|
|
# opsx-loki - Secure Multi-Stage Dockerfile
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root user (opsxloki:1000)
|
|
# - No hardcoded JWT_SECRET (validated at runtime)
|
|
# - HEALTHCHECK instruction added
|
|
# - Binary installation verification
|
|
# P1 Fixes:
|
|
# - Supply chain risk reduction (--ignore-scripts where applicable)
|
|
# - File ownership with --chown
|
|
# - Security environment variables
|
|
# ============================================================
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 1: Frontend Builder (Node.js)
|
|
# ---------------------------------------------------------------
|
|
FROM node:20-alpine AS frontend-builder
|
|
WORKDIR /app/frontend
|
|
|
|
# Install dependencies separately to leverage layer caching
|
|
COPY frontend/package*.json ./
|
|
# Use --ignore-scripts to reduce supply chain attack surface
|
|
RUN npm ci --ignore-scripts && \
|
|
npm cache clean --force
|
|
|
|
# Copy source and build
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 2: Backend Builder (Go)
|
|
# ---------------------------------------------------------------
|
|
FROM golang:1.24-alpine AS backend-builder
|
|
RUN apk add --no-cache git ca-certificates tzdata
|
|
ENV GOTOOLCHAIN=local
|
|
WORKDIR /app/backend
|
|
|
|
# Download dependencies (cached layer)
|
|
COPY backend/go.* ./
|
|
RUN go mod download
|
|
|
|
# Copy source and build static binary
|
|
COPY backend/ ./
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-a -installsuffix cgo \
|
|
-ldflags="-s -w -extldflags '-static'" \
|
|
-o bin/opsxloki .
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 3: Final Runtime Image
|
|
# ---------------------------------------------------------------
|
|
FROM alpine:3.20
|
|
|
|
# Install runtime dependencies:
|
|
# ca-certificates: HTTPS TLS verification
|
|
# openssh-client: SSH key auth for host deployment
|
|
# curl: kubectl/helm download + runtime checks
|
|
# bash: Entrypoint script support
|
|
# wget: HEALTHCHECK (lighter than curl)
|
|
RUN apk --no-cache add \
|
|
ca-certificates \
|
|
openssh-client \
|
|
curl \
|
|
bash \
|
|
wget
|
|
|
|
ARG TARGETARCH=amd64
|
|
|
|
# ---- Install kubectl with checksum verification ----
|
|
# P1: curl downloads must have integrity verification
|
|
ENV KUBECTL_VERSION=v1.31.0
|
|
ENV KUBECTL_SHA256_AMD64=e3c5b9c15e96cd8d70b3fdf87f38197d0b92e01fb920b5d8a40a3f4c5cb4e84a
|
|
ENV KUBECTL_SHA256_ARM64=f9147d84b7dc0630cf4f9d7769c36e65a0885bbc0a34c5dc65b9d93c287d83b9
|
|
RUN set -eux; \
|
|
if [ "$TARGETARCH" = "amd64" ]; then \
|
|
KUBECTL_SHA256="$KUBECTL_SHA256_AMD64"; \
|
|
elif [ "$TARGETARCH" = "arm64" ]; then \
|
|
KUBECTL_SHA256="$KUBECTL_SHA256_ARM64"; \
|
|
else \
|
|
echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
|
|
fi; \
|
|
curl -fsSL -o /tmp/kubectl \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"; \
|
|
echo "${KUBECTL_SHA256} /tmp/kubectl" | sha256sum -c -; \
|
|
mv /tmp/kubectl /usr/local/bin/kubectl; \
|
|
chmod +x /usr/local/bin/kubectl; \
|
|
# P1: Verify installation
|
|
kubectl version --client || { echo "kubectl installation verification failed"; exit 1; }
|
|
|
|
# ---- Install helm with checksum verification ----
|
|
ENV HELM_VERSION=v3.16.3
|
|
# Helm checksums from official releases (https://github.com/helm/helm/releases)
|
|
# helm-v3.16.3-linux-amd64.tar.gz
|
|
ENV HELM_SHA256_AMD64=ad01a74073a785c33121d277100b043246217790d8d30c9f039e9c2dd5769d91
|
|
# helm-v3.16.3-linux-arm64.tar.gz
|
|
ENV HELM_SHA256_ARM64=5bd34b755e58f27f1c4bc8edaef44152d0e7b9f5978e6d0aac394a3c81951498
|
|
RUN set -eux; \
|
|
HELM_TAR="helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"; \
|
|
if [ "$TARGETARCH" = "amd64" ]; then \
|
|
HELM_SHA256="$HELM_SHA256_AMD64"; \
|
|
elif [ "$TARGETARCH" = "arm64" ]; then \
|
|
HELM_SHA256="$HELM_SHA256_ARM64"; \
|
|
else \
|
|
echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
|
|
fi; \
|
|
curl -fsSL -o "/tmp/${HELM_TAR}" \
|
|
"https://get.helm.sh/${HELM_TAR}"; \
|
|
# P1: SHA256 integrity verification
|
|
echo "${HELM_SHA256} /tmp/${HELM_TAR}" | sha256sum -c -; \
|
|
mkdir -p /tmp/helm; \
|
|
tar -xzf "/tmp/${HELM_TAR}" -C /tmp/helm; \
|
|
mv "/tmp/helm/linux-${TARGETARCH}/helm" /usr/local/bin/helm; \
|
|
chmod +x /usr/local/bin/helm; \
|
|
rm -rf /tmp/helm*; \
|
|
# P1: Verify installation
|
|
helm version --client || { echo "helm installation verification failed"; exit 1; }
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Create non-root user and group
|
|
# ---------------------------------------------------------------
|
|
RUN addgroup -g 1000 opsxloki && \
|
|
adduser -u 1000 -G opsxloki -s /bin/sh -D opsxloki
|
|
|
|
# ---------------------------------------------------------------
|
|
# Working directory with proper ownership
|
|
# ---------------------------------------------------------------
|
|
WORKDIR /app
|
|
RUN chown opsxloki:opsxloki /app
|
|
|
|
# ---- Copy application files with correct ownership (P1) ----
|
|
COPY --from=frontend-builder --chown=opsxloki:opsxloki /app/frontend/dist ./dist
|
|
COPY --from=backend-builder --chown=opsxloki:opsxloki /app/backend/bin/opsxloki ./opsxloki
|
|
|
|
# Create data directory with non-root ownership
|
|
RUN mkdir -p /app/data && chown -R opsxloki:opsxloki /app/data
|
|
|
|
# Create .kube directory for non-root user (P0: not /root/.kube)
|
|
RUN mkdir -p /home/opsxloki/.kube && \
|
|
chown -R opsxloki:opsxloki /home/opsxloki && \
|
|
chmod 700 /home/opsxloki/.kube
|
|
|
|
# ---- Security hardening: remove unnecessary tools ----
|
|
RUN rm -rf /tmp/* /var/cache/apk/*
|
|
|
|
# ---------------------------------------------------------------
|
|
# Security environment variables
|
|
# ---------------------------------------------------------------
|
|
ENV DATA_DIR=/app/data
|
|
ENV SERVER_PORT=8080
|
|
ENV KUBECONFIG=/home/opsxloki/.kube/config
|
|
# HOME must be set for kubectl/helm to find config
|
|
ENV HOME=/home/opsxloki
|
|
|
|
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
|
|
# They MUST be provided at runtime via docker-compose env or secrets.
|
|
# The entrypoint script will enforce this requirement.
|
|
|
|
# ---- Copy and configure entrypoint script ----
|
|
COPY --chown=opsxloki:opsxloki docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
EXPOSE 8080
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: HEALTHCHECK - verifies static file serving (no auth needed)
|
|
# ---------------------------------------------------------------
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider \
|
|
http://localhost:${SERVER_PORT}/index.html || exit 1
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Switch to non-root user
|
|
# ---------------------------------------------------------------
|
|
USER opsxloki
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
|
CMD ["./opsxloki"]
|