Skip to content
This repository was archived by the owner on Jul 2, 2024. It is now read-only.

Commit 67ec3fc

Browse files
jdeathejdeathe
authored
Merge pull request #705 from jdeathe/centos-6-develop
Release changes for 1.10.0
2 parents d8218f1 + e5ec0be commit 67ec3fc

30 files changed

+3281
-2011
lines changed

‎CHANGELOG.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,37 @@
44

55
Summary of release changes for Version 1 - CentOS-6
66

7+
### 1.10.0 - 2019-01-28
8+
9+
- Updates supervisor to 3.3.5.
10+
- Updates validation for `SSH_USER_ID` to allow values in the system ID range.
11+
- Updates and restructures Dockerfile to reduce number of layers in image.
12+
- Updates container naming conventions for `scmi` making the node element optional.
13+
- Updates container naming conventions and readability of `Makefile`.
14+
- Updates `docker logs` output example in README document.
15+
- Updates README instructions following review.
16+
- Updates default HEALTHCHECK interval to 1 second from 0.5.
17+
- Replaces awk with native bash regex when testing sudo user's have `NOPASSWD:ALL`.
18+
- Fixes bootstrap errors regarding readonly `PASSWORD_LENGTH`.
19+
- Fixes issue with redacted password when using `SSH_PASSWORD_AUTHENTICATION` in combination with `SSH_USER_FORCE_SFTP`.
20+
- Fixes issue with unexpected published port in run templates when `DOCKER_PORT_MAP_TCP_22` is set to an empty string or 0.
21+
- Fixes missing `SSH_TIMEZONE` from Makefile's install run template.
22+
- Fixes validation of `SSH_TIMEZONE` values - set to defaults with warning and abort on error.
23+
- Adds `SSH_USER_PRIVATE_KEY` to allow configuration of an RSA private key for `SSH_USER`.
24+
- Adds placeholder replacement of `RELEASE_VERSION` docker argument to systemd service unit template.
25+
- Adds error messages to healthcheck script and includes supervisord check.
26+
- Adds a short sleep after bootstrap Details to work-around missing output on CI service's host.
27+
- Adds port incrementation to Makefile's run template for container names with an instance suffix.
28+
- Adds consideration for event lag into test cases for unhealthy health_status events.
29+
- Adds feature to allow configuration of "root" `SSH_USER`.
30+
- Adds validation of `SSH_SUDO` values.
31+
- Removes use of `/etc/services-config` paths.
32+
- Removes fleet `--manager` option in the `scmi` installer.
33+
- Removes X-Fleet section from etcd register template unit-file.
34+
- Removes the unused group element from the default container name.
35+
- Removes the node element from the default container name.
36+
- Removes undocumented `SSH_ROOT_PASSWORD` from bootstrap process.
37+
738
### 1.9.1 - 2018-11-10
839

940
- Adds feature to set system time zone via `SSH_TIMEZONE`.

‎Dockerfile

Lines changed: 44 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
# =============================================================================
2-
# jdeathe/centos-ssh
3-
#
4-
# CentOS-6 6.10 x86_64 - SCL/EPEL/IUS Repos. / Supervisor / OpenSSH.
5-
#
6-
# =============================================================================
71
FROM centos:centos6.10
82

3+
ARG RELEASE_VERSION="1.10.0"
4+
95
# -----------------------------------------------------------------------------
10-
# Base Install + Import the RPM GPG keys for Repositories
6+
# - Import the RPM GPG keys for repositories
7+
# - Base install of required packages
8+
# - Install supervisord (used to run more than a single process)
9+
# - Install supervisor-stdout to allow output of services started by
10+
# supervisord to be easily inspected with "docker logs".
1111
# -----------------------------------------------------------------------------
1212
RUN rpm --rebuilddb \
1313
&& rpm --import \
@@ -44,6 +44,11 @@ RUN rpm --rebuilddb \
4444
policycoreutils \
4545
sysvinit-tools \
4646
&& yum clean all \
47+
&& easy_install \
48+
'supervisor == 3.3.5' \
49+
'supervisor-stdout == 0.1.1' \
50+
&& mkdir -p \
51+
/var/log/supervisor/ \
4752
&& find /usr/share \
4853
-type f \
4954
-regextype posix-extended \
@@ -55,44 +60,6 @@ RUN rpm --rebuilddb \
5560
&& rm -rf /{root,tmp,var/cache/{ldconfig,yum}}/* \
5661
&& > /etc/sysconfig/i18n
5762

58-
# -----------------------------------------------------------------------------
59-
# Install supervisord (required to run more than a single process in a container)
60-
# Note: EPEL package lacks /usr/bin/pidproxy
61-
# We require supervisor-stdout to allow output of services started by
62-
# supervisord to be easily inspected with "docker logs".
63-
# -----------------------------------------------------------------------------
64-
RUN easy_install \
65-
'supervisor == 3.3.4' \
66-
'supervisor-stdout == 0.1.1' \
67-
&& mkdir -p \
68-
/var/log/supervisor/
69-
70-
# -----------------------------------------------------------------------------
71-
# UTC Timezone & Networking
72-
# -----------------------------------------------------------------------------
73-
RUN ln -sf \
74-
/usr/share/zoneinfo/UTC \
75-
/etc/localtime \
76-
&& echo "NETWORKING=yes" > /etc/sysconfig/network
77-
78-
# -----------------------------------------------------------------------------
79-
# Configure SSH for non-root public key authentication
80-
# -----------------------------------------------------------------------------
81-
RUN sed -i \
82-
-e 's~^PasswordAuthentication yes~PasswordAuthentication no~g' \
83-
-e 's~^#PermitRootLogin yes~PermitRootLogin no~g' \
84-
-e 's~^#UseDNS yes~UseDNS no~g' \
85-
-e 's~^\(.*\)/usr/libexec/openssh/sftp-server$~\1internal-sftp~g' \
86-
/etc/ssh/sshd_config
87-
88-
# -----------------------------------------------------------------------------
89-
# Enable the wheel sudoers group
90-
# -----------------------------------------------------------------------------
91-
RUN sed -i \
92-
-e 's~^# %wheel\tALL=(ALL)\tALL~%wheel\tALL=(ALL) ALL~g' \
93-
-e 's~\(.*\) requiretty$~#\1requiretty~' \
94-
/etc/sudoers
95-
9663
# -----------------------------------------------------------------------------
9764
# Copy files into place
9865
# -----------------------------------------------------------------------------
@@ -102,40 +69,38 @@ ADD src/usr/sbin \
10269
/usr/sbin/
10370
ADD src/opt/scmi \
10471
/opt/scmi/
105-
ADD src/etc/systemd/system \
106-
/etc/systemd/system/
107-
ADD src/etc/services-config/ssh/authorized_keys \
108-
src/etc/services-config/ssh/sshd-bootstrap.conf \
109-
src/etc/services-config/ssh/sshd-bootstrap.env \
110-
/etc/services-config/ssh/
111-
ADD src/etc/services-config/supervisor/supervisord.conf \
112-
/etc/services-config/supervisor/
113-
ADD src/etc/services-config/supervisor/supervisord.d \
114-
/etc/services-config/supervisor/supervisord.d/
72+
ADD src/etc \
73+
/etc/
11574

116-
RUN mkdir -p \
117-
/etc/supervisord.d/ \
118-
&& cp -pf \
119-
/etc/ssh/sshd_config \
120-
/etc/services-config/ssh/ \
121-
&& ln -sf \
122-
/etc/services-config/ssh/sshd_config \
75+
# -----------------------------------------------------------------------------
76+
# Provisioning
77+
# - UTC Timezone
78+
# - Networking
79+
# - Configure SSH defaults for non-root public key authentication
80+
# - Enable the wheel sudoers group
81+
# - Replace placeholders with values in systemd service unit template
82+
# - Set permissions
83+
# -----------------------------------------------------------------------------
84+
RUN ln -sf \
85+
/usr/share/zoneinfo/UTC \
86+
/etc/localtime \
87+
&& echo "NETWORKING=yes" \
88+
> /etc/sysconfig/network \
89+
&& sed -i \
90+
-e 's~^PasswordAuthentication yes~PasswordAuthentication no~g' \
91+
-e 's~^#PermitRootLogin yes~PermitRootLogin no~g' \
92+
-e 's~^#UseDNS yes~UseDNS no~g' \
93+
-e 's~^\(.*\)/usr/libexec/openssh/sftp-server$~\1internal-sftp~g' \
12394
/etc/ssh/sshd_config \
124-
&& ln -sf \
125-
/etc/services-config/ssh/sshd-bootstrap.conf \
126-
/etc/sshd-bootstrap.conf \
127-
&& ln -sf \
128-
/etc/services-config/ssh/sshd-bootstrap.env \
129-
/etc/sshd-bootstrap.env \
130-
&& ln -sf \
131-
/etc/services-config/supervisor/supervisord.conf \
132-
/etc/supervisord.conf \
133-
&& ln -sf \
134-
/etc/services-config/supervisor/supervisord.d/sshd-wrapper.conf \
135-
/etc/supervisord.d/sshd-wrapper.conf \
136-
&& ln -sf \
137-
/etc/services-config/supervisor/supervisord.d/sshd-bootstrap.conf \
138-
/etc/supervisord.d/sshd-bootstrap.conf \
95+
&& sed -i \
96+
-e 's~^# %wheel\tALL=(ALL)\tALL~%wheel\tALL=(ALL) ALL~g' \
97+
-e 's~\(.*\) requiretty$~#\1requiretty~' \
98+
/etc/sudoers \
99+
&& sed -i \
100+
-e "s~{{RELEASE_VERSION}}~${RELEASE_VERSION}~g" \
101+
/etc/systemd/system/centos-ssh@.service \
102+
&& chmod 644 \
103+
/etc/{sshd-bootstrap.{conf,env},supervisord.conf,supervisord.d/sshd-{bootstrap,wrapper}.conf} \
139104
&& chmod 700 \
140105
/usr/{bin/healthcheck,sbin/{scmi,sshd-{bootstrap,wrapper}}}
141106

@@ -158,12 +123,12 @@ ENV SSH_AUTHORIZED_KEYS="" \
158123
SSH_USER_ID="500:500" \
159124
SSH_USER_PASSWORD="" \
160125
SSH_USER_PASSWORD_HASHED="false" \
126+
SSH_USER_PRIVATE_KEY="" \
161127
SSH_USER_SHELL="/bin/bash"
162128

163129
# -----------------------------------------------------------------------------
164130
# Set image metadata
165131
# -----------------------------------------------------------------------------
166-
ARG RELEASE_VERSION="1.9.1"
167132
LABEL \
168133
maintainer="James Deathe <james.deathe@gmail.com>" \
169134
install="docker run \
@@ -195,7 +160,7 @@ jdeathe/centos-ssh:${RELEASE_VERSION} \
195160
org.deathe.description="CentOS-6 6.10 x86_64 - SCL, EPEL and IUS Repositories / Supervisor / OpenSSH."
196161

197162
HEALTHCHECK \
198-
--interval=0.5s \
163+
--interval=1s \
199164
--timeout=1s \
200165
--retries=5 \
201166
CMD ["/usr/bin/healthcheck"]

0 commit comments

Comments
 (0)