# FROM docker.io/debian:bookworm-slim as base-upstream ARG BASETAG=bookworm-slim FROM docker.io/debian:${BASETAG} AS base-upstream FROM base-upstream AS base-intermediate SHELL [ "/bin/sh", "-ec" ] COPY /Dockerfile.base /usr/local/share/ COPY /scripts/* /usr/local/sbin/ COPY /extra-scripts/* /usr/local/sbin/ ## PATH: remove /sbin and /bin (/usr is merged) ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \ TMPDIR=/tmp \ LANG=C.UTF-8 \ LC_ALL=C.UTF-8 \ TERM=linux \ TZ=Etc/UTC \ MALLOC_ARENA_MAX=2 \ JRE_CACERTS_PATH=/etc/ssl/certs/java/cacerts COPY /apt/prefs.backports /etc/apt/preferences.d/backports COPY /apt/sources.debian /etc/apt/sources.list.d/debian.sources ## prevent services from auto-starting, part 1 RUN s='/usr/sbin/policy-rc.d' ; b='/usr/bin/policy-rc.d' ; \ rm -f "$s" "$b" ; \ echo '#!/bin/sh' > "$b" ; \ echo 'exit 101' >> "$b" ; \ chmod 0755 "$b" ; \ ln -s "$b" "$s" RUN divert_true() { divert-rm.sh "$1" ; ln -sv /bin/true "$1" ; } ; \ ## prevent services from auto-starting, part 2 divert_true /sbin/start-stop-daemon ; \ ## always report that we're in chroot divert_true /usr/bin/ischroot ; \ ## hide systemd helpers divert_true /usr/bin/deb-systemd-helper ; \ divert_true /usr/bin/deb-systemd-invoke RUN apt-env.sh apt-get update ; \ apt-env.sh apt-get upgrade -y ; \ apt-clean.sh ## perl-base: hardlink->symlink RUN d=/usr/bin ; \ find "$d/" -wholename "$d/perl5*" -exec ln -fsv perl {} ';' ; \ ls -li "$d/perl"* ## remove unwanted binaries RUN set -f ; \ for i in \ addpart \ apt-ftparchive \ agetty \ badblocks \ blkdiscard \ blkid \ blkzone \ blockdev \ bsd-write \ chage \ chcpu \ chmem \ ctrlaltdel \ debugfs \ delpart \ dmesg \ dumpe2fs \ e2freefrag \ e2fsck \ e2image \ e2label \ e2mmpstatus \ e2scrub \ 'e2scrub*' \ e2undo \ e4crypt \ e4defrag \ faillock \ fdformat \ fincore \ findfs \ fsck \ 'fsck.*' \ fsfreeze \ fstrim \ getty \ hwclock \ isosize \ last \ lastb \ ldattach \ losetup \ lsblk \ lsirq \ lslogins \ mcookie \ mesg \ mke2fs \ mkfs \ 'mkfs.*' \ 'mklost+found' \ mkswap \ mount \ pam-auth-update \ pam_getenv \ pam_namespace_helper \ pam_timestamp_check \ partx \ pivot_root \ raw \ readprofile \ resize2fs \ resizepart \ rtcwake \ swaplabel \ swapoff \ swapon \ switch_root \ tune2fs \ umount \ utmpdump \ vigr \ vipw \ wall \ wdctl \ wipefs \ write \ 'write.*' \ zramctl \ ; do \ for d in /usr/sbin /usr/bin /sbin /bin ; do \ find "$d/" ! -type d -wholename "$d/$i" \ | while read -r p ; do \ [ -n "$p" ] || continue ; \ [ -e "$p" ] || continue ; \ dpkg -S "$p" >/dev/null 2>&1 || continue ; \ divert-rm.sh "$p" ; \ done ; \ done ; \ for d in /usr/sbin /usr/bin /sbin /bin ; do \ find "$d/" ! -type d -wholename "$d/$i" \ | while read -r p ; do \ [ -n "$p" ] || continue ; \ [ -e "$p" ] || continue ; \ rm -fv "$p" ; \ done ; \ done ; \ done RUN apt-remove.sh \ e2fsprogs \ ; \ apt-install.sh \ ca-certificates \ ca-certificates-java \ fontconfig \ p11-kit \ netbase \ openssl \ procps \ psmisc \ ; \ apt-clean.sh ## set up locales! RUN _lang=en_US.UTF8 ; \ { \ echo "locales locales/default_environment_locale select ${LANG}" ; \ echo "locales locales/locales_to_be_generated multiselect ${LANG} UTF-8" ; \ } | debconf-set-selections ; \ f=/etc/dpkg/dpkg.cfg.d/docker ; \ if [ -f "$f" ] ; then \ sed -Ei '/\/usr\/share\/locale/d' "$f" ; \ fi ; \ echo "LANG=${_lang}" > /etc/default/locale ; \ apt-install.sh locales ; apt-clean.sh ; \ grep -Fixq "${_lang} UTF-8" /etc/locale.gen || { \ echo "${_lang} UTF-8" >> /etc/locale.gen ; \ locale-gen ; \ } ; \ locale -a | grep -Fixq "${_lang}" ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8' RUN find /usr/local/sbin/ ! -type d -ls -delete ; \ find /run/ -mindepth 1 -ls -delete || : ; \ install -d -m 01777 /run/lock ## --- FROM base-intermediate AS certs SHELL [ "/bin/sh", "-ec" ] COPY /scripts/* /usr/local/sbin/ COPY /extra-scripts/* /usr/local/sbin/ ## "2024.08.30" ENV CERTIFI_COMMIT=325c2fde4f8eec10d682b09f3b0414dc05e69a81 # 'https://raw.githubusercontent.com/certifi/python-certifi' ARG CERTIFI_BASE_URI='https://github.com/certifi/python-certifi/raw' ARG CERTIFI_URI="${CERTIFI_BASE_URI}/${CERTIFI_COMMIT}/certifi/cacert.pem" ADD "${CERTIFI_URI}" /tmp/certifi.crt RUN ca_file='/etc/ssl/certs/ca-certificates.crt' ; \ java_ca_file='/etc/ssl/certs/java/cacerts' ; \ apt-install.sh default-jre-headless ; \ apt-clean.sh ; \ update-ca-certificates --fresh ; \ echo ; \ ls -l "${ca_file}" "${java_ca_file}" ; \ echo ; \ ## process certifi certifi-extras.sh /tmp/certifi.crt ; \ openssl-cert-auto-pem.sh "${ca_file}" "${ca_file}.new" "${ca_file}.fp" ; \ mv -f "${ca_file}.new" "${ca_file}" ; \ chmod 0644 "${ca_file}" "${ca_file}.fp" "${java_ca_file}" ; \ echo ; \ ls -l "${ca_file}" "${ca_file}.fp" "${java_ca_file}" ## --- FROM base-intermediate AS base COPY /scripts/* /usr/local/sbin/ COPY --from=certs /etc/ssl/certs/ca-certificates.* /etc/ssl/certs/ COPY --from=certs /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/ COPY --from=certs /usr/local/share/ca-certificates/ /usr/local/share/ca-certificates/ ENTRYPOINT [ ] CMD [ "bash" ]