Dockerfile.rls

# DOCKERFILE.rls for BRANE
#   by Tim Müller and Onno Valkering
#
# Contains the Dockerfile for the various Brane instance images.
#
# This version builds the release images. For images build in development mode,
# check Dockerfile.dev.
#


##### BUILD STAGE #####
### This file will act as the bottom for both builder images
FROM rust:1 AS build-common
LABEL org.opencontainers.image.source https://github.com/epi-project/brane

# Install build dependencies (that are not in the rust image already)
RUN apt-get update && apt-get install -y \
    cmake \
    curl \
    unzip \
 && rm -rf /var/lib/apt/lists/*

# Copy over relevant crates & other files
RUN mkdir /build
COPY . /build



### This file does the Brane services
FROM build-common AS build-brane
LABEL org.opencontainers.image.source https://github.com/epi-project/brane

# Build optimized binaries
WORKDIR /build
RUN --mount=type=cache,id=cargoidx,target=/usr/local/cargo/registry \
    --mount=type=cache,id=branecache,target=/build/target \
    cargo build \
        --release \
        --package brane-api \
        --package brane-drv \
        --package brane-job \
        --package brane-prx \
        --package brane-plr \
        --package brane-reg \
    && cp ./target/release/brane-api /brane-api \
    && cp ./target/release/brane-drv /brane-drv \
    && cp ./target/release/brane-job /brane-job \
    && cp ./target/release/brane-prx /brane-prx \
    && cp ./target/release/brane-plr /brane-plr \
    && cp ./target/release/brane-reg /brane-reg

# If ever run, run a shell
WORKDIR /
ENTRYPOINT [ "/bin/bash" ]



### This file does the policy reasoner service
FROM build-common AS build-policy-reasoner
LABEL org.opencontainers.image.source https://github.com/epi-project/brane

# Fetch the reasoner code next
WORKDIR /
ARG REASONER=eflint
ARG REASONER_BRANCH=main
ADD "http://github.com/epi-project/policy-reasoner/zipball/${REASONER_BRANCH}/" /policy-reasoner.zip
RUN unzip /policy-reasoner.zip && mv /epi-project-policy-reasoner* /policy-reasoner

# Touch a `policy.db` into action to avoid the policy reasoner's `build.rs` building it for us (unnecessary)
RUN mkdir -p /policy-reasoner/data && touch /policy-reasoner/data/policy.db

# Compile it!
WORKDIR /policy-reasoner
RUN --mount=type=cache,id=cargoidx,target=/usr/local/cargo/registry \
    --mount=type=cache,id=reasonercache,target=/policy-reasoner/target \
    cargo build --release --bin $REASONER --features brane-api-resolver \
 && cp ./target/release/$REASONER /brane-chk

# If ever run, run a shell
WORKDIR /
ENTRYPOINT [ "/bin/bash" ]



### This target does the eflint-server binary
FROM ubuntu:22.04 AS build-eflint-server

# Define build args
ARG ARCH=amd64

# Install deps
RUN apt-get update && apt-get install -y \
    git wget \
 && rm -rf /var/lib/apt/lists/*

# Install go
RUN wget https://go.dev/dl/go1.22.1.linux-$ARCH.tar.gz -O - | tar -xvz

# Fetch the repo & compile it
RUN PATH="$PATH:/go/bin" \
 && git clone https://github.com/epi-project/eflint-server-go /eflint-server-go \
 && cd /eflint-server-go/cmd/eflint-server \
 && go build . \
 && mv ./eflint-server /eflint-server





##### BASE IMAGE #####
# This image defines the base image for all Brane service images.
FROM ubuntu:22.04 AS brane-base
LABEL org.opencontainers.image.source https://github.com/epi-project/brane

# Add the log directory
RUN mkdir -p /logs/profile

# Add an ubuntu 21.10 source for libssl1.1 (insecure, but it's the dev image anyway)
# Can't get around that, even in release, since libssl1.1 is only available in old repos
RUN echo "deb http://old-releases.ubuntu.com/ubuntu impish-security main" >> /etc/apt/sources.list

# Install libssl (the Rust crate depends on it)
RUN apt-get update && apt-get install -y \
    libssl1.1 \
 && rm -rf /var/lib/apt/lists/*

# If ever run, run a shell
ENTRYPOINT [ "/bin/bash" ]





##### BRANE-PRX #####
# This image contains the Brane proxy service.
FROM brane-base AS brane-prx

# Copy `brane-prx` from build stage
COPY --from=build-brane /brane-prx /brane-prx

# Run the compiled executable as base
ENTRYPOINT [ "./brane-prx" ]





##### BRANE-API #####
# This image contains the Brane API service.
FROM brane-base AS brane-api

# Install additional runtime dependencies specific for brane-api
RUN apt-get update && apt-get install -y \
    gnupg2 \
    wget \
 && rm -rf /var/lib/apt/lists/*

# Copy `brane-api` from build stage
COPY --from=build-brane /brane-api /brane-api

# Run the compiled executable as base
ENTRYPOINT [ "/brane-api" ]





##### BRANE-DRV #####
# This image contains the Brane driver service.
FROM brane-base AS brane-drv

# Copy `brane-drv` from build stage
COPY --from=build-brane /brane-drv /brane-drv

# Run the compiled executable as base
ENTRYPOINT [ "./brane-drv" ]





##### BRANE-PLR #####
# This image contains the Brane planner service.
FROM brane-base AS brane-plr

# Copy `brane-plr` from build stage
COPY --from=build-brane /brane-plr /brane-plr

# Run the compiled executable as base
ENTRYPOINT [ "./brane-plr" ]





##### BRANE-JOB #####
# This image contains the Brane job service.
FROM brane-base AS brane-job

# Copy `brane-job` from build stage
COPY --from=build-brane /brane-job /brane-job

# Run the compiled executable as base
ENTRYPOINT [ "./brane-job" ]





##### BRANE-REG #####
# This image contains the Brane registry service.
FROM brane-base AS brane-reg

# Copy `brane-reg` from build stage
COPY --from=build-brane /brane-reg /brane-reg

# Run the compiled executable as base
ENTRYPOINT [ "./brane-reg" ]





##### BRANE-CHK #####
# This image contains the policy reasoner / checker!
FROM ubuntu:22.04 AS brane-chk

# Install deps
RUN apt-get update && apt-get install -y \
    sqlite3 \
 && rm -rf /var/lib/apt/lists/*

# Generate a start script
RUN printf '#!/bin/bash\n# Startup script for the policy reasoner container\n\n# Spawn the eFLINT reasoner itself\n/eflint-server 2>&1 &\n\n# Launch the policy reasoner binary\n/brane-chk $@\n\n' > /startup.sh \
 && chmod +x /startup.sh

# Install the eFLINT JSON server
# ADD https://github.com/Olaf-Erkemeij/eflint-server/raw/bd3997df89441f13cbc82bd114223646df41540d/eflint-server /eflint-server
# RUN chmod +x /eflint-server

# Copy some config from the build stage
COPY --from=build-policy-reasoner /policy-reasoner/examples/config/jwt_resolver.yaml /examples/config/jwt_resolver.yaml

# Copy `policy-reasoner` from build stage
COPY --from=build-policy-reasoner /brane-chk /brane-chk
RUN chmod +x /brane-chk

# Copy `eflint-server` from build stage
COPY --from=build-eflint-server /eflint-server /eflint-server

# Run the compiler executable as base
WORKDIR /
ENTRYPOINT [ "/startup.sh" ]