opsx
f3733f0bfc
- 品牌: Go 模块/数据文件/二进制/构建部署资产全部 opsx→lokistack;前端 localStorage 命名空间迁移(读旧写新,含按用户 id 前缀迁移);修复 nginx upstream 与 Makefile 引用已改名服务的断裂 - i18n: react-i18next 落地,common + 11 个页面域命名空间全站中英(菜单/顶栏/登录/列表页/表单/确认弹窗/状态徽章);设置页语言即时切换;修复词典自注册导致的循环导入白屏 - 用户管理: 批量删除(POST /users/batch-delete,不删自己/最后管理员,部分失败不阻断)+ 行复选/全选/批量工具条 - 主题: 浅色侧栏(中性灰激活态)、四态模式(浅色/深色/跟随系统/定时切换,按时区判定)、顶栏太阳月亮二态、设置页紧凑分段选择器 - UI: 登录记住用户名、CardActionButton 统一五页卡片操作钮、shadcn Badge 替换手写徽章、语义色修正 - 清理: 移除主机 Web 终端(前后端)、k8s-helm/Helm 遗留代码与字段、README 重写精简 - 修复: 侧栏与日志告警 order 重复、路由标题 i18n key 未翻译、词典双逗号等
127 lines
4.6 KiB
Docker
127 lines
4.6 KiB
Docker
# ============================================================
|
|
# lokistack - Secure Multi-Stage Dockerfile
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root user (lokistack:1000)
|
|
# - No hardcoded JWT_SECRET (validated at runtime)
|
|
# - HEALTHCHECK instruction added
|
|
# - Binary installation verification
|
|
# P1 Fixes:
|
|
# - Supply chain risk reduction (--ignore-scripts where applicable)
|
|
# - File ownership with --chown
|
|
# - Security environment variables
|
|
# ============================================================
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 1: Frontend Builder (Node.js)
|
|
# ---------------------------------------------------------------
|
|
FROM node:20-alpine AS frontend-builder
|
|
WORKDIR /app/frontend
|
|
|
|
# Install dependencies separately to leverage layer caching
|
|
COPY frontend/package*.json ./
|
|
# Use --ignore-scripts to reduce supply chain attack surface
|
|
RUN npm ci --ignore-scripts && \
|
|
npm cache clean --force
|
|
|
|
# Copy source and build
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 2: Backend Builder (Go)
|
|
# ---------------------------------------------------------------
|
|
FROM golang:1.24-alpine AS backend-builder
|
|
RUN apk add --no-cache git ca-certificates tzdata
|
|
ENV GOTOOLCHAIN=local
|
|
WORKDIR /app/backend
|
|
|
|
# Download dependencies (cached layer)
|
|
COPY backend/go.* ./
|
|
RUN go mod download
|
|
|
|
# Copy source and build static binary
|
|
# -trimpath：抹掉源码绝对路径（否则二进制里能 strings 出 /app/backend/controllers/*.go 共 66 处）
|
|
COPY backend/ ./
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-a -installsuffix cgo \
|
|
-ldflags="-s -w -extldflags '-static'" \
|
|
-o bin/lokistack .
|
|
|
|
# ---------------------------------------------------------------
|
|
# Stage 3: Final Runtime Image
|
|
# ---------------------------------------------------------------
|
|
FROM alpine:3.20
|
|
|
|
# Install runtime dependencies:
|
|
# ca-certificates: HTTPS TLS verification
|
|
# openssh-client: SSH key auth for host deployment
|
|
# bash: Entrypoint script support
|
|
# wget: HEALTHCHECK (lighter than curl)
|
|
RUN apk --no-cache add \
|
|
ca-certificates \
|
|
openssh-client \
|
|
bash \
|
|
wget
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Create non-root user and group
|
|
# ---------------------------------------------------------------
|
|
RUN addgroup -g 1000 lokistack && \
|
|
adduser -u 1000 -G lokistack -s /bin/sh -D lokistack
|
|
|
|
# ---------------------------------------------------------------
|
|
# Working directory with proper ownership
|
|
# ---------------------------------------------------------------
|
|
WORKDIR /app
|
|
RUN chown lokistack:lokistack /app
|
|
|
|
# ---- Copy application files with correct ownership (P1) ----
|
|
COPY --from=frontend-builder --chown=lokistack:lokistack /app/frontend/dist ./dist
|
|
COPY --from=backend-builder --chown=lokistack:lokistack /app/backend/bin/lokistack ./lokistack
|
|
|
|
# Create data directory with non-root ownership
|
|
RUN mkdir -p /app/data && chown -R lokistack:lokistack /app/data
|
|
|
|
# Create .kube directory for non-root user (P0: not /root/.kube)
|
|
RUN mkdir -p /home/lokistack/.kube && \
|
|
chown -R lokistack:lokistack /home/lokistack && \
|
|
chmod 700 /home/lokistack/.kube
|
|
|
|
# ---- Security hardening: remove unnecessary tools ----
|
|
RUN rm -rf /tmp/* /var/cache/apk/*
|
|
|
|
# ---------------------------------------------------------------
|
|
# Security environment variables
|
|
# ---------------------------------------------------------------
|
|
ENV DATA_DIR=/app/data
|
|
ENV SERVER_PORT=8080
|
|
ENV KUBECONFIG=/home/lokistack/.kube/config
|
|
ENV HOME=/home/lokistack
|
|
|
|
# NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.
|
|
# They MUST be provided at runtime via docker-compose env or secrets.
|
|
# The entrypoint script will enforce this requirement.
|
|
|
|
# ---- Copy and configure entrypoint script ----
|
|
COPY --chown=lokistack:lokistack docker-entrypoint.sh /usr/local/bin/
|
|
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
EXPOSE 8080
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: HEALTHCHECK - verifies static file serving (no auth needed)
|
|
# ---------------------------------------------------------------
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider \
|
|
http://localhost:${SERVER_PORT}/index.html || exit 1
|
|
|
|
# ---------------------------------------------------------------
|
|
# P0: Switch to non-root user
|
|
# ---------------------------------------------------------------
|
|
USER lokistack
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
|
CMD ["./lokistack"]
|