octree-gva / docker Goto Github PK

As others do to secure a docker container, we should define AppArmor and seccomp profiles for the docker containers published.

reference:

• https://www.redhat.com/sysadmin/container-security-seccomp
• https://wiki.ubuntu.com/AppArmor

This would be particularly useful when running the container in K8s.

As a developper, I want to be able to do

FROM decidim:026-alpine
RUN my-script

For now, I will have a lot of issues I want to do this as there is a USER command in alpine image. The user created in the base image won't be accessible in the child one.

FROM decidim:026-alpine
USER root
COPY ./my-exe /usr/local/bin
USER decidim

Wont work.

tasks

• Remove add-users, add-group, USER directive in templates
• update README to incite people to create their own Docker image with a FROM directive
• Prepare a PR to decidim-generators to add the Dockerfile, link the fork's branch without doing actual PR (blocked by merging this, and publish to decidim docker hub).

would be great to run the tests of the generated image. Ideally, all tests of decidim-* would be executed in a github action.

As newest version of decidim don't use the sass gem but the new dart alternative, the gems won't compile.
There are two options to consider:

1. Add a webpack configuration to use sass gem while on alpine
2. Add the necessary executables to run dart-node.

Reference:

• sass-embeded, decidim sass loader

  The sass-embedded runs the Dart Sass embedded compiler as a separate executable

Known fix:

1. create a new decidim sass loader, using the sass gem, and add the overrides. (/config/webpacker/custom.js)
2. add the gem sass to the gemfile

For now we use an ugly copy/pasting method to be able to build and push at the same time dev and alpine images.

What would be needed:

• Add in alpine template a FROM decidim:matching-dev-tag
• Split github action in two, to first build and publish dev image, then alpine image
• Remove old copy-pasting