teleport/build.assets/Dockerfile-centos7

# Build libfido2 separately for isolation, speed and flexibility.
FROM centos:7 AS libfido2

RUN yum groupinstall -y 'Development Tools' && \
    yum install -y epel-release && \
    yum update -y && \
    yum install -y \
        cmake3 \
        git \
        libudev-devel \
        zlib-devel && \
    yum clean all

# Install libudev-zero.
# libudev-zero replaces systemd's libudev
RUN git clone --depth=1 https://github.com/illiliti/libudev-zero.git -b 1.0.1 && \
    cd libudev-zero && \
    make install-static LIBDIR='$(PREFIX)/lib64'

# Instal openssl.
# Pulled from source because repository versions are too old.
# install_sw install only binaries, skips docs.
RUN git clone --depth=1 git://git.openssl.org/openssl.git -b OpenSSL_1_1_1o && \
    cd openssl && \
    ./config --release && \
    make && \
    make install_sw

# Install libcbor.
RUN git clone --depth=1 https://github.com/PJK/libcbor.git -b v0.9.0 && \
    cd libcbor && \
    cmake3 \
        -DCBOR_CUSTOM_ALLOC=ON \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
        -DWITH_EXAMPLES=OFF . && \
    make && \
    make install

# Install libfido2.
# Depends on libcbor, openssl, zlib-devel and libudev.
# Linked so `make build/tsh` finds the library where it expects it.
RUN git clone --depth=1 https://github.com/Yubico/libfido2.git -b 1.11.0 && \
    cd libfido2 && \
    cmake3 \
        -DBUILD_EXAMPLES=OFF \
        -DBUILD_MANPAGES=OFF \
        -DBUILD_TOOLS=OFF \
        -DCMAKE_BUILD_TYPE=Release . && \
    make && \
    make install && \
# Update ld.
    echo /usr/local/lib64 > /etc/ld.so.conf.d/libfido2.conf && \
    ldconfig

FROM centos:7 AS buildbox

ENV LANGUAGE=en_US.UTF-8 \
    LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    LC_CTYPE=en_US.UTF-8

ARG GOLANG_VERSION
ARG RUST_VERSION

ARG UID
ARG GID
RUN (groupadd ci --gid=$GID -o && useradd ci --uid=$UID --gid=$GID --create-home --shell=/bin/sh && \
     mkdir -p -m0700 /var/lib/teleport && chown -R ci /var/lib/teleport)

RUN yum groupinstall -y 'Development Tools' && \
    yum install -y \
        git \
        net-tools \
        # required by Teleport PAM support
        pam-devel \
        perl-IPC-Cmd \
        tree \
        # used by our Makefile
        which \
        zip \
    yum clean all

# Install etcd.
RUN (curl -L https://github.com/coreos/etcd/releases/download/v3.3.9/etcd-v3.3.9-linux-amd64.tar.gz | tar -xz && \
     cp etcd-v3.3.9-linux-amd64/etcd* /bin/)

# Install Go.
RUN mkdir -p /opt && cd /opt && curl https://storage.googleapis.com/golang/$GOLANG_VERSION.linux-amd64.tar.gz | tar xz && \
    mkdir -p /go/src/github.com/gravitational/teleport && \
    chmod a+w /go && \
    chmod a+w /var/lib && \
    /opt/go/bin/go version
ENV GOPATH="/go" \
    GOROOT="/opt/go" \
    PATH="/opt/bin:$PATH:/opt/go/bin:/go/bin:/go/src/github.com/gravitational/teleport/build"

ARG BUILDARCH

# Install protoc (for prost, a roletester dependency)
ARG PROTOC_VER
RUN (export PROTOC_TARBALL=protoc-${PROTOC_VER}-linux-$(if [ "$BUILDARCH" = "amd64" ]; then echo "x86_64"; else echo "aarch_64"; fi).zip && \
     curl -L -o /tmp/${PROTOC_TARBALL} https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/${PROTOC_TARBALL} && \
     cd /tmp && unzip /tmp/${PROTOC_TARBALL} -d /usr/local && \
     chmod -R a+r /usr/local/include/google/protobuf && \
     chmod -R a+xr /usr/local/bin/protoc && \
     rm /tmp/${PROTOC_TARBALL})

# Tell prost to use the system protoc instead of building it from source
ENV PROTOC_NO_VENDOR true
ENV PROTOC /usr/local/bin/protoc

# Install PAM module and policies for testing.
COPY pam/ /opt/pam_teleport/
RUN make -C /opt/pam_teleport install

# Install Rust.
ENV RUSTUP_HOME=/usr/local/rustup \
    CARGO_HOME=/usr/local/cargo \
    PATH=/usr/local/cargo/bin:$PATH \
    RUST_VERSION=$RUST_VERSION

RUN mkdir -p $RUSTUP_HOME && chmod a+w $RUSTUP_HOME && \
    mkdir -p $CARGO_HOME/registry && chmod -R a+w $CARGO_HOME

RUN chmod a-w /

USER ci
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain $RUST_VERSION && \
    rustup --version && \
    cargo --version && \
    rustc --version && \
    rustup component add --toolchain $RUST_VERSION-x86_64-unknown-linux-gnu rustfmt clippy && \
    cargo install cbindgen

# Do a quick switch back to root and copy/setup libfido2 binaries.
# Do this last to take better advantage of the multi-stage build.
USER root
COPY --from=libfido2 /usr/local/include/ /usr/local/include/
COPY --from=libfido2 /usr/local/lib64/pkgconfig/ /usr/local/lib64/pkgconfig/
COPY --from=libfido2 \
    /usr/local/lib64/libcbor.a \
    /usr/local/lib64/libcrypto.a \
    /usr/local/lib64/libcrypto.so.1.1 \
    /usr/local/lib64/libfido2.a \
    /usr/local/lib64/libfido2.so.1.11.0 \
    /usr/local/lib64/libssl.a \
    /usr/local/lib64/libssl.so.1.1 \
    /usr/local/lib64/libudev.a \
    /usr/local/lib64/
RUN cd /usr/local/lib64 && \
# Re-create usual lib64 links.
    ln -s libcrypto.so.1.1 libcrypto.so && \
    ln -s libfido2.so.1.11.0 libfido2.so.1 && \
    ln -s libfido2.so.1 libfido2.so && \
    ln -s libssl.so.1.1 libssl.so && \
# Update ld.
    echo /usr/local/lib64 > /etc/ld.so.conf.d/libfido2.conf && \
    ldconfig
COPY pkgconfig/centos7/ /
ENV PKG_CONFIG_PATH="/usr/local/lib64/pkgconfig"

USER ci
VOLUME ["/go/src/github.com/gravitational/teleport"]
EXPOSE 6600 2379 2380