Repository navigation
Expand file tree
/
Copy pathDockerfile
More file actions
195 lines (175 loc) · 8.28 KB
/
Copy pathDockerfile
File metadata and controls
195 lines (175 loc) · 8.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
# Node.js from the official Alpine image instead of Alpine's nodejs package, which
# lags Node's security releases. Match the major version to what reachability needs
# and the Alpine release to the python:3-alpine base below.
FROM node:24-alpine3.24 AS node
FROM python:3-alpine
LABEL org.opencontainers.image.authors="socket.dev"
# Language version arguments with defaults
ARG GO_VERSION=system
ARG JAVA_VERSION=17
ARG DOTNET_VERSION=8
# CLI and SDK arguments
ARG CLI_VERSION
ARG SDK_VERSION
ARG PIP_INDEX_URL=https://pypi.org/simple
ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple
ARG USE_LOCAL_INSTALL=false
# Install base packages first
# ca-certificates must be 20261020-r0 or newer, which drops the roots the
# compromised eMudhra intermediates chain to. The base image ships an older
# one, and `apk add` does not upgrade installed packages, so upgrade it here.
RUN apk update && apk add --no-cache \
git curl wget \
ruby ruby-dev build-base strace && \
apk upgrade --no-cache ca-certificates && \
[ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
# pip uses its own vendored CA bundle, not the system store, and the base image's
# pip trusts the compromised eMudhra intermediates. 26.2.2 vendors certifi
# 2026.10.19. Upgrade it against the system store fixed above.
RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" && \
python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
# npm, npx and yarn are symlinks in the node image. COPY would dereference them
# into flat files and break their relative requires, so recreate the links.
COPY --from=node /usr/local/bin/node /usr/local/bin/node
COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node /opt /opt
# Node rejects the compromised eMudhra intermediates from 24.22.1.
RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \
ln -s /opt/yarn-v*/bin/yarn /usr/local/bin/yarn && \
ln -s /opt/yarn-v*/bin/yarnpkg /usr/local/bin/yarnpkg && \
node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'
# Install Go with version control
RUN if [ "$GO_VERSION" = "system" ]; then \
apk add --no-cache go && \
echo "/usr/lib/go" > /etc/goroot; \
else \
cd /tmp && \
ARCH=$(uname -m) && \
case $ARCH in \
x86_64) GOARCH=amd64 ;; \
aarch64) GOARCH=arm64 ;; \
*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
esac && \
wget https://golang.org/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
tar -C /usr/local -xzf go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
rm go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
echo "/usr/local/go" > /etc/goroot; \
fi
# Install Java with version control
RUN if [ "$JAVA_VERSION" = "8" ]; then \
apk add --no-cache openjdk8-jdk; \
elif [ "$JAVA_VERSION" = "11" ]; then \
apk add --no-cache openjdk11-jdk; \
elif [ "$JAVA_VERSION" = "17" ]; then \
apk add --no-cache openjdk17-jdk; \
elif [ "$JAVA_VERSION" = "21" ]; then \
apk add --no-cache openjdk21-jdk; \
else \
echo "Unsupported Java version: $JAVA_VERSION. Supported: 8, 11, 17, 21" && exit 1; \
fi
# Install .NET with version control
RUN if [ "$DOTNET_VERSION" = "6" ]; then \
apk add --no-cache dotnet6-sdk; \
elif [ "$DOTNET_VERSION" = "8" ]; then \
apk add --no-cache dotnet8-sdk; \
else \
echo "Unsupported .NET version: $DOTNET_VERSION. Supported: 6, 8" && exit 1; \
fi
# Install PyPy (Alpine-compatible build for x86_64 only)
# PyPy is an alternative Python interpreter that makes the Python reachability analysis faster.
# This is a custom build of PyPy3.12 for Alpine on x86-64.
ARG TARGETARCH # Passed by Docker buildx
RUN if [ "$TARGETARCH" = "amd64" ]; then \
PYPY_URL="https://github.com/BarrensZeppelin/alpine-pypy/releases/download/alp3.24.2-pypy3.12-8.0.1/pypy3.12-v8.0.1-linux64-alpine3.24.tar.gz" && \
PYPY_SHA256="b6d5dd429c6394f1710a52e3e20d5c9198547caff9528547c457d3f2ed37db09" && \
curl -L -o /tmp/pypy.tar.gz "$PYPY_URL" && \
echo "$PYPY_SHA256 /tmp/pypy.tar.gz" | sha256sum -c - && \
mkdir -p /opt/pypy && \
tar -xz --strip-components=1 -C /opt/pypy -f /tmp/pypy.tar.gz && \
rm /tmp/pypy.tar.gz && \
ln -s /opt/pypy/bin/pypy3 /bin/pypy3 && \
pypy3 --version; \
fi
# Install additional tools
RUN npm install socket -g && \
gem install bundler && \
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
. ~/.cargo/env && \
rustup component add rustfmt clippy
# Set environment paths
ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
ENV GOPATH="/go"
# Install uv (0.13.4+ ships the patched webpki-roots)
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
# Install pyenv
# pyenv lets us build/install arbitrary Python versions on demand. We install
# the build dependencies needed to compile CPython on Alpine, then install
# pyenv itself. We deliberately only symlink the `pyenv` binary onto the PATH
# and do NOT add pyenv's shims directory, so its shims don't shadow the system
# Python that the CLI runs on.
RUN apk add --no-cache \
bash \
bzip2-dev \
ca-certificates \
libffi-dev \
libxslt-dev \
linux-headers \
ncurses-dev \
openssl-dev \
readline-dev \
sqlite-dev \
xz-dev \
zlib-dev
RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | PYENV_GIT_TAG="v2.7.1" bash && \
ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \
pyenv --version
# Install Python dependencies from the lockfile with hash verification so the
# image never resolves loose versions from PyPI at build time.
COPY pyproject.toml uv.lock /tmp/socket-cli-lock/
# Index flags are passed explicitly (always production PyPI) so the
# PIP_INDEX_URL/PIP_EXTRA_INDEX_URL ARGs used to point CLI/SDK preview installs
# at TestPyPI don't leak into the locked dependency install via pip's env vars.
RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-project \
--format requirements-txt -o /tmp/socket-cli-lock/requirements.txt && \
pip install --require-hashes --no-deps \
--index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \
-r /tmp/socket-cli-lock/requirements.txt
# Install CLI based on build mode
RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
echo "Using local development install"; \
else \
cli_installed=false; \
for i in $(seq 1 10); do \
echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \
if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \
cli_installed=true; \
break; \
fi; \
if [ "$i" -lt 10 ]; then \
echo "Install failed, waiting 30s before retry..."; \
sleep 30; \
fi; \
done; \
if [ "$cli_installed" != "true" ]; then \
echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \
exit 1; \
fi; \
pip check || exit 1; \
if [ ! -z "$SDK_VERSION" ]; then \
pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
fi; \
fi
# Copy local source and install in editable mode if USE_LOCAL_INSTALL is true
COPY . /app
WORKDIR /app
RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
pip install --no-deps -e . && pip check; \
fi
# Create workspace directory with proper permissions
RUN mkdir -p /go/src && chmod -R 777 /go
# Copy and setup entrypoint script
COPY scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]