Skip to content

Commit bc86c94

Browse files
rassierassie
committed
Update Dockerfiles
1 parent dd1368d commit bc86c94

File tree

42 files changed

+3130
-652
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+3130
-652
lines changed

‎11/jdk/alpine/entrypoint.sh‎

Lines changed: 73 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,87 @@
33

44
set -e
55

6+
# JDK truststore location
7+
CACERT=$JAVA_HOME/lib/security/cacerts
8+
9+
# JDK8 puts its JRE in a subdirectory
10+
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11+
CACERT=$JAVA_HOME/jre/lib/security/cacerts
12+
fi
13+
614
# Opt-in is only activated if the environment variable is set
715
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
816

9-
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
10-
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
11-
# system location, for whatever reason.
12-
if [ -d /certificates ] && [ -n "$(ls -A /certificates 2>/dev/null)" ]; then
13-
cp -a /certificates/* /usr/local/share/ca-certificates/
17+
if [ ! -w /tmp ]; then
18+
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
19+
exit 1
1420
fi
1521

16-
CACERT="$JAVA_HOME/lib/security/cacerts"
17-
18-
# JDK8 puts its JRE in a subdirectory
19-
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
20-
CACERT="$JAVA_HOME/jre/lib/security/cacerts"
22+
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
23+
# we'll use a temporary truststore.
24+
if [ ! -w "$CACERT" ]; then
25+
# We cannot write to the JVM truststore, so we create a temporary one
26+
CACERT_NEW=$(mktemp)
27+
echo "Using a temporary truststore at $CACERT_NEW"
28+
cp $CACERT $CACERT_NEW
29+
CACERT=$CACERT_NEW
30+
# If we use a custom truststore, we need to make sure that the JVM uses it
31+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
2132
fi
2233

23-
# OpenJDK images used to create a hook for `update-ca-certificates`. Since we are using an entrypoint anyway, we
24-
# might as well just generate the truststore and skip the hooks.
25-
update-ca-certificates
34+
tmp_store=$(mktemp)
35+
36+
# Copy full system CA store to a temporary location
37+
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
38+
39+
# Add the system CA certificates to the JVM truststore.
40+
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
41+
42+
# Import the additional certificate into JVM truststore
43+
for i in /certificates/*crt; do
44+
if [ ! -f "$i" ]; then
45+
continue
46+
fi
47+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
48+
done
2649

27-
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$CACERT"
50+
# Add additional certificates to the system CA store. This requires write permissions to several system
51+
# locations, which is not possible in a container with read-only filesystem and/or non-root container.
52+
if [ "$(id -u)" -eq 0 ]; then
53+
54+
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
55+
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
56+
# system location, for whatever reason.
57+
if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
58+
59+
# UBI/CentOS
60+
if [ -d /usr/share/pki/ca-trust-source/anchors/ ]; then
61+
cp -a /certificates/* /usr/share/pki/ca-trust-source/anchors/
62+
fi
63+
64+
# Ubuntu/Alpine
65+
if [ -d /usr/local/share/ca-certificates/ ]; then
66+
cp -a /certificates/* /usr/local/share/ca-certificates/
67+
fi
68+
fi
69+
70+
# UBI/CentOS
71+
if which update-ca-trust >/dev/null; then
72+
update-ca-trust
73+
fi
74+
75+
# Ubuntu/Alpine
76+
if which update-ca-certificates >/dev/null; then
77+
update-ca-certificates
78+
fi
79+
else
80+
# If we are not root, we cannot update the system truststore. That's bad news for tools like `curl` and `wget`,
81+
# but since the JVM is the primary focus here, we can live with that.
82+
true
83+
fi
2884
fi
2985

86+
# Let's provide a variable with the correct path for tools that want or need to use it
87+
export CACERT
88+
3089
exec "$@"

‎11/jdk/centos/entrypoint.sh‎

Lines changed: 75 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,89 @@
1-
#!/usr/bin/env bash
2-
# Shebang needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
1+
#!/usr/bin/env sh
2+
# Converted to POSIX shell to avoid the need for bash in the image
33

44
set -e
55

6+
# JDK truststore location
7+
CACERT=$JAVA_HOME/lib/security/cacerts
8+
9+
# JDK8 puts its JRE in a subdirectory
10+
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11+
CACERT=$JAVA_HOME/jre/lib/security/cacerts
12+
fi
13+
614
# Opt-in is only activated if the environment variable is set
715
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
816

9-
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
10-
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
11-
# system location, for whatever reason.
12-
if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
13-
cp -a /certificates/* /usr/share/pki/ca-trust-source/anchors/
17+
if [ ! -w /tmp ]; then
18+
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
19+
exit 1
1420
fi
1521

16-
CACERT=$JAVA_HOME/lib/security/cacerts
17-
18-
# JDK8 puts its JRE in a subdirectory
19-
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
20-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
22+
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
23+
# we'll use a temporary truststore.
24+
if [ ! -w "$CACERT" ]; then
25+
# We cannot write to the JVM truststore, so we create a temporary one
26+
CACERT_NEW=$(mktemp)
27+
echo "Using a temporary truststore at $CACERT_NEW"
28+
cp $CACERT $CACERT_NEW
29+
CACERT=$CACERT_NEW
30+
# If we use a custom truststore, we need to make sure that the JVM uses it
31+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
2132
fi
2233

23-
# RHEL-based images already include a routine to update a java truststore from the system CA bundle within
24-
# `update-ca-trust`. All we need to do is to link the system CA bundle to the java truststore.
25-
update-ca-trust
34+
tmp_store=$(mktemp)
35+
36+
# Copy full system CA store to a temporary location
37+
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
38+
39+
# Add the system CA certificates to the JVM truststore.
40+
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
41+
42+
# Import the additional certificate into JVM truststore
43+
for i in /certificates/*crt; do
44+
if [ ! -f "$i" ]; then
45+
continue
46+
fi
47+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
48+
done
2649

27-
ln -sf /etc/pki/ca-trust/extracted/java/cacerts "$CACERT"
50+
# Add additional certificates to the system CA store. This requires write permissions to several system
51+
# locations, which is not possible in a container with read-only filesystem and/or non-root container.
52+
if [ "$(id -u)" -eq 0 ]; then
53+
54+
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
55+
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
56+
# system location, for whatever reason.
57+
if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
58+
59+
# UBI/CentOS
60+
if [ -d /usr/share/pki/ca-trust-source/anchors/ ]; then
61+
cp -a /certificates/* /usr/share/pki/ca-trust-source/anchors/
62+
fi
63+
64+
# Ubuntu/Alpine
65+
if [ -d /usr/local/share/ca-certificates/ ]; then
66+
cp -a /certificates/* /usr/local/share/ca-certificates/
67+
fi
68+
fi
69+
70+
# UBI/CentOS
71+
if which update-ca-trust >/dev/null; then
72+
update-ca-trust
73+
fi
74+
75+
# Ubuntu/Alpine
76+
if which update-ca-certificates >/dev/null; then
77+
update-ca-certificates
78+
fi
79+
else
80+
# If we are not root, we cannot update the system truststore. That's bad news for tools like `curl` and `wget`,
81+
# but since the JVM is the primary focus here, we can live with that.
82+
true
83+
fi
2884
fi
2985

86+
# Let's provide a variable with the correct path for tools that want or need to use it
87+
export CACERT
88+
3089
exec "$@"

‎11/jdk/ubi/ubi9-minimal/entrypoint.sh‎

Lines changed: 75 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,89 @@
1-
#!/usr/bin/env bash
2-
# Shebang needs to be `bash`, see https://github.com/adoptium/containers/issues/415 for details
1+
#!/usr/bin/env sh
2+
# Converted to POSIX shell to avoid the need for bash in the image
33

44
set -e
55

6+
# JDK truststore location
7+
CACERT=$JAVA_HOME/lib/security/cacerts
8+
9+
# JDK8 puts its JRE in a subdirectory
10+
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
11+
CACERT=$JAVA_HOME/jre/lib/security/cacerts
12+
fi
13+
614
# Opt-in is only activated if the environment variable is set
715
if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
816

9-
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
10-
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
11-
# system location, for whatever reason.
12-
if [ -d /certificates ] && [ "$(ls -A /certificates)" ]; then
13-
cp -a /certificates/* /usr/share/pki/ca-trust-source/anchors/
17+
if [ ! -w /tmp ]; then
18+
echo "Using additional CA certificates requires write permissions to /tmp. Cannot create truststore."
19+
exit 1
1420
fi
1521

16-
CACERT=$JAVA_HOME/lib/security/cacerts
17-
18-
# JDK8 puts its JRE in a subdirectory
19-
if [ -f "$JAVA_HOME/jre/lib/security/cacerts" ]; then
20-
CACERT=$JAVA_HOME/jre/lib/security/cacerts
22+
# Figure out whether we can write to the JVM truststore. If we can, we'll add the certificates there. If not,
23+
# we'll use a temporary truststore.
24+
if [ ! -w "$CACERT" ]; then
25+
# We cannot write to the JVM truststore, so we create a temporary one
26+
CACERT_NEW=$(mktemp)
27+
echo "Using a temporary truststore at $CACERT_NEW"
28+
cp $CACERT $CACERT_NEW
29+
CACERT=$CACERT_NEW
30+
# If we use a custom truststore, we need to make sure that the JVM uses it
31+
export JAVA_TOOL_OPTIONS="${JAVA_TOOL_OPTIONS} -Djavax.net.ssl.trustStore=${CACERT} -Djavax.net.ssl.trustStorePassword=changeit"
2132
fi
2233

23-
# RHEL-based images already include a routine to update a java truststore from the system CA bundle within
24-
# `update-ca-trust`. All we need to do is to link the system CA bundle to the java truststore.
25-
update-ca-trust
34+
tmp_store=$(mktemp)
35+
36+
# Copy full system CA store to a temporary location
37+
trust extract --overwrite --format=java-cacerts --filter=ca-anchors --purpose=server-auth "$tmp_store"
38+
39+
# Add the system CA certificates to the JVM truststore.
40+
keytool -importkeystore -destkeystore "$CACERT" -srckeystore "$tmp_store" -srcstorepass changeit -deststorepass changeit -noprompt # >/dev/null
41+
42+
# Import the additional certificate into JVM truststore
43+
for i in /certificates/*crt; do
44+
if [ ! -f "$i" ]; then
45+
continue
46+
fi
47+
keytool -import -noprompt -alias "$(basename "$i" .crt)" -file "$i" -keystore "$CACERT" -storepass changeit # >/dev/null
48+
done
2649

27-
ln -sf /etc/pki/ca-trust/extracted/java/cacerts "$CACERT"
50+
# Add additional certificates to the system CA store. This requires write permissions to several system
51+
# locations, which is not possible in a container with read-only filesystem and/or non-root container.
52+
if [ "$(id -u)" -eq 0 ]; then
53+
54+
# Copy certificates from /certificates to the system truststore, but only if the directory exists and is not empty.
55+
# The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
56+
# system location, for whatever reason.
57+
if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
58+
59+
# UBI/CentOS
60+
if [ -d /usr/share/pki/ca-trust-source/anchors/ ]; then
61+
cp -a /certificates/* /usr/share/pki/ca-trust-source/anchors/
62+
fi
63+
64+
# Ubuntu/Alpine
65+
if [ -d /usr/local/share/ca-certificates/ ]; then
66+
cp -a /certificates/* /usr/local/share/ca-certificates/
67+
fi
68+
fi
69+
70+
# UBI/CentOS
71+
if which update-ca-trust >/dev/null; then
72+
update-ca-trust
73+
fi
74+
75+
# Ubuntu/Alpine
76+
if which update-ca-certificates >/dev/null; then
77+
update-ca-certificates
78+
fi
79+
else
80+
# If we are not root, we cannot update the system truststore. That's bad news for tools like `curl` and `wget`,
81+
# but since the JVM is the primary focus here, we can live with that.
82+
true
83+
fi
2884
fi
2985

86+
# Let's provide a variable with the correct path for tools that want or need to use it
87+
export CACERT
88+
3089
exec "$@"

0 commit comments

Comments
 (0)