mirror of
https://github.com/minio/minio
synced 2024-07-22 02:44:15 +00:00
3455f786fa
This commit changes the config/IAM encryption process. Instead of encrypting config data (users, policies etc.) with the root credentials MinIO now encrypts this data with a KMS - if configured. Therefore, this PR moves the MinIO-KMS configuration (via env. variables) to a "top-level" configuration. The KMS configuration cannot be stored in the config file since it is used to decrypt the config file in the first place. As a consequence, this commit also removes support for Hashicorp Vault - which has been deprecated anyway. Signed-off-by: Andreas Auernhammer <aead@mail.de>
30 lines
713 B
Docker
30 lines
713 B
Docker
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.3
|
|
|
|
ARG TARGETARCH
|
|
|
|
LABEL maintainer="MinIO Inc <dev@min.io>"
|
|
|
|
COPY dockerscripts/docker-entrypoint.sh /usr/bin/
|
|
COPY minio /usr/bin/
|
|
|
|
ENV MINIO_UPDATE=off \
|
|
MINIO_ACCESS_KEY_FILE=access_key \
|
|
MINIO_SECRET_KEY_FILE=secret_key \
|
|
MINIO_ROOT_USER_FILE=access_key \
|
|
MINIO_ROOT_PASSWORD_FILE=secret_key \
|
|
MINIO_KMS_SECRET_KEY_FILE=kms_master_key
|
|
|
|
RUN microdnf update --nodocs
|
|
RUN microdnf install curl ca-certificates shadow-utils util-linux --nodocs
|
|
RUN microdnf clean all && \
|
|
chmod +x /usr/bin/minio && \
|
|
chmod +x /usr/bin/docker-entrypoint.sh
|
|
|
|
EXPOSE 9000
|
|
|
|
ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
|
|
|
|
VOLUME ["/data"]
|
|
|
|
CMD ["minio"]
|