diff --git a/.drone.yml b/.drone.yml index e69de29..16f9f34 100644 --- a/.drone.yml +++ b/.drone.yml @@ -0,0 +1,54 @@ +kind: pipeline +name: build +type: kubernetes + +steps: + - name: docker_redis_6.2 + image: plugins/docker + settings: + context: 6.2/ + dockerfile: 6.2/Dockerfile + registry: harbor.dragse.it + repo: harbor.dragse.it/base/redis + tags: + - "6" + - "6.2" + - "6.2.6" + - "latest" + username: + from_secret: repo_username + password: + from_secret: repo_password + - name: send telegram notification + image: appleboy/drone-telegram + settings: + token: + from_secret: tele_token + to: + from_secret: tele_user + +--- +kind: secret +name: repo_username +get: + path: repo-credentials + name: username +--- +kind: secret +name: repo_password +get: + path: repo-credentials + name: password + +--- +kind: secret +name: tele_user +get: + path: telegram-notification + name: user_id +--- +kind: secret +name: tele_token +get: + path: telegram-notification + name: token diff --git a/6.2/Dockerfile b/6.2/Dockerfile index e69de29..7f257a9 100644 --- a/6.2/Dockerfile +++ b/6.2/Dockerfile @@ -0,0 +1,111 @@ +FROM harbor.dragse.it/base/alpine:3.15 + +LABEL maintainer="Lennard Brinkhaus " + +RUN echo $'http://nexus.dragse.it/repository/apk-main/\nhttp://nexus.dragse.it/repository/apk-community/' > /etc/apk/repositories +RUN apk --no-cache upgrade \ + && apk --no-cache add ca-certificates wget openssl \ + && update-ca-certificates \ + +# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added +RUN addgroup -S -g 1000 redis && adduser -S -G redis -u 999 redis +# alpine already has a gid 999, so we'll use the next id + +RUN apk add --no-cache \ +# grab su-exec for easy step-down from root + 'su-exec>=0.2' \ +# add tzdata for https://github.com/docker-library/redis/issues/138 + tzdata + +ENV REDIS_VERSION 6.2.6 +ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-6.2.6.tar.gz +ENV REDIS_DOWNLOAD_SHA 5b2b8b7a50111ef395bf1c1d5be11e6e167ac018125055daa8b5c2317ae131ab + +RUN set -eux; \ + \ + apk add --no-cache --virtual .build-deps \ + coreutils \ + dpkg-dev dpkg \ + gcc \ + linux-headers \ + make \ + musl-dev \ + openssl-dev \ +# install real "wget" to avoid: +# + wget -O redis.tar.gz https://download.redis.io/releases/redis-6.0.6.tar.gz +# Connecting to download.redis.io (45.60.121.1:80) +# wget: bad header line: XxhODalH: btu; path=/; Max-Age=900 + wget \ + ; \ + \ + wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \ + echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \ + mkdir -p /usr/src/redis; \ + tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \ + rm redis.tar.gz; \ + \ +# disable Redis protected mode [1] as it is unnecessary in context of Docker +# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P) +# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \ + sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \ + grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \ +# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything" +# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840 +# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default) + \ +# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility +# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation) + gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ + extraJemallocConfigureFlags="--build=$gnuArch"; \ +# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23 + dpkgArch="$(dpkg --print-architecture)"; \ + case "${dpkgArch##*-}" in \ + amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \ + *) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \ + esac; \ + extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \ + grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \ + sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \ + grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \ + \ + export BUILD_TLS=yes; \ + make -C /usr/src/redis -j "$(nproc)" all; \ + make -C /usr/src/redis install; \ + \ +# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies) + serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \ + find /usr/local/bin/redis* -maxdepth 0 \ + -type f -not -name redis-server \ + -exec sh -eux -c ' \ + md5="$(md5sum "$1" | cut -d" " -f1)"; \ + test "$md5" = "$serverMd5"; \ + ' -- '{}' ';' \ + -exec ln -svfT 'redis-server' '{}' ';' \ + ; \ + \ + rm -r /usr/src/redis; \ + \ + runDeps="$( \ + scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \ + | tr ',' '\n' \ + | sort -u \ + | awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \ + )"; \ + apk add --no-network --virtual .redis-rundeps $runDeps; \ + apk del --no-network .build-deps; \ + \ + redis-cli --version; \ + redis-server --version + +RUN mkdir /data && chown redis:redis /data +VOLUME /data +WORKDIR /data + +COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh +RUN chmod +x /usr/local/bin/docker-entrypoint.sh + +ENTRYPOINT ["docker-entrypoint.sh"] + +EXPOSE 6379 +CMD ["redis-server"] diff --git a/6.2/docker-entrypoint.sh b/6.2/docker-entrypoint.sh index e69de29..db00075 100644 --- a/6.2/docker-entrypoint.sh +++ b/6.2/docker-entrypoint.sh @@ -0,0 +1,16 @@ +#!/bin/sh +set -e + +# first arg is `-f` or `--some-option` +# or first arg is `something.conf` +if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then + set -- redis-server "$@" +fi + +# allow the container to be started with `--user` +if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then + find . \! -user redis -exec chown redis '{}' + + exec su-exec redis "$0" "$@" +fi + +exec "$@"