Skip to content

Commit 3103f5d

Browse files
jcox250jcox250
authored
fix: [FFM-12648] upgrade golang version to resolve vulnerabilities (#412)
* fix: [FFM-12648] upgrade golang & pushpin version to resolve vulnerabilities
1 parent 1d558e1 commit 3103f5d

File tree

5 files changed

+38
-134
lines changed

5 files changed

+38
-134
lines changed

‎Dockerfile‎

Lines changed: 27 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
############################
22
# STEP 1 build executable binary
33
############################
4-
FROM golang:1.23.5 as builder
4+
FROM golang:1.23.12 as builder
55

66
WORKDIR /app
77

@@ -18,68 +18,42 @@ COPY . .
1818
# Generate Code and Build
1919
RUN make build
2020

21-
2221
############################
23-
# STEP 2 build pushpin 22.04 image - source https://github.com/fanout/docker-pushpin/blob/master/Dockerfile
24-
# TODO - this will rarely change - publish as an image we can consume
22+
# STEP 2: Grab CA certificates
2523
############################
26-
# Pull the base image
27-
FROM ubuntu:24.10 as pushpin
28-
29-
# Add private APT repository
30-
RUN \
31-
apt-get update && \
32-
apt-get install -y apt-transport-https software-properties-common && \
33-
echo deb https://fanout.jfrog.io/artifactory/debian fanout-jammy main \
34-
| tee /etc/apt/sources.list.d/fanout.list && \
35-
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys \
36-
7D0343148157C3DF
37-
38-
ENV PUSHPIN_VERSION 1.37.0-1~jammy
39-
40-
# Install Pushpin
41-
RUN \
42-
apt-get update && \
43-
apt-get install -y pushpin=$PUSHPIN_VERSION curl binutils
24+
FROM debian:bookworm-slim as certs
25+
RUN apt-get update && apt-get install -y ca-certificates
26+
RUN mkdir /tmp/certs && cp -r /etc/ssl/certs/* /tmp/certs
4427

45-
# Required for the image to work on Centos7 with 3.10 kernel
46-
RUN \
47-
strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
28+
############################
29+
# STEP 3: Add relay proxy to base pushpin image
30+
############################
31+
FROM fanout/pushpin:1.41.0
4832

49-
# Cleanup
50-
RUN \
51-
apt-get clean && \
52-
rm -fr /var/lib/apt/lists/*
33+
# Use root user for setup
34+
USER root
5335

54-
# Add entrypoint script
36+
# Copy entrypoint and binaries
5537
COPY docker-entrypoint.sh /usr/local/bin/
56-
# give permission to run entrypoint script
57-
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
58-
59-
# Define default entrypoint and command
60-
ENTRYPOINT ["docker-entrypoint.sh"]
61-
CMD ["pushpin", "--merge-output"]
62-
63-
64-
############################
65-
# STEP 3 add relay proxy build to pushpin image
66-
############################
67-
FROM pushpin
6838
COPY --from=builder /app/ff-proxy /app/ff-proxy
69-
COPY --from=builder ./app/config/pushpin /etc/pushpin
70-
COPY --from=builder ./app/start.sh /start.sh
39+
COPY --from=builder /app/config/pushpin /etc/pushpin
40+
COPY --from=builder /app/start.sh /start.sh
41+
42+
# Copy CA certificates
43+
COPY --from=certs /tmp/certs /etc/ssl/certs
7144

72-
RUN mkdir /log
73-
RUN mkdir /pushpin
74-
RUN mkdir /pushpin/run
75-
RUN mkdir /pushpin/log
76-
RUN chmod -R 0500 /app/ff-proxy /usr/lib/pushpin /etc/pushpin
77-
RUN chmod -R 0755 /log /pushpin /usr/lib/pushpin /etc/pushpin
78-
RUN chown -R 65534:65534 /app/ff-proxy /log /pushpin /usr/lib/pushpin /etc/pushpin
45+
# Prepare directories + set permissions in a single layer
46+
RUN chmod +x /usr/local/bin/docker-entrypoint.sh \
47+
&& mkdir -p /log /pushpin/run /pushpin/log \
48+
&& chmod 0500 /app/ff-proxy \
49+
&& chmod -R 0755 /usr/lib/pushpin /etc/pushpin \
50+
&& chmod -R 0775 /log /pushpin \
51+
&& chown -R 65534:65534 /app/ff-proxy /log /pushpin /usr/lib/pushpin /etc/pushpin
7952

80-
# Setting this to 65534 which hould be the nodbody user
81-
USER 65534
53+
# Use nobody user for runtime
54+
USER 65534:65534
8255

8356
# Expose default port pushpin listens on
8457
EXPOSE 7000
58+
ENTRYPOINT ["docker-entrypoint.sh"]
8559
CMD ["./start.sh"]

‎config/pushpin/pushpin.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ stats_connection_ttl=120
1616

1717
[runner]
1818
# services to start
19-
services=condure,zurl,pushpin-proxy,pushpin-handler
19+
services=condure,pushpin-proxy,pushpin-handler
2020

2121
# plain HTTP port that mongrel2 should listen on
2222
http_port=7000

‎docker-compose.yml‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,24 @@
11
version: "3.9"
22
services:
33
proxy:
4-
image: "harness/ff-proxy:v2.0.0-rc.20"
54
environment:
6-
- DEBUG=${DEBUG}
75
- LOG_LEVEL=INFO
86
- REDIS_ADDRESS=redis:6379
97
- READ_REPLICA=false
108
- AUTH_SECRET=foobar
11-
- TLS_ENABLED=${TLS_ENABLED}
12-
- TLS_CERT=${TLS_CERT}
13-
- TLS_KEY=${TLS_KEY}
149
- PROXY_KEY=${PROXY_KEY}
15-
- PORT=${PORT}
16-
- BYPASS_AUTH=${BYPASS_AUTH}
17-
- ACCOUNT_IDENTIFIER=${ACCOUNT_IDENTIFIER}
1810
build:
1911
context: ./
2012
dockerfile: ./Dockerfile
2113
volumes:
2214
- ${CONFIG_VOLUME:-./config:/config}
2315
- ./tests/e2e/certs:/certs
2416
ports:
25-
- 7000:${PORT:-7000}
17+
- "7000:7000"
18+
depends_on:
19+
- redis
2620

2721
redis:
2822
image: "redis:latest"
2923
ports:
30-
- "6379:6379"
31-
32-
pushpin:
33-
image: fanout/pushpin
34-
ports:
35-
- "7000:7000"
36-
- "5560-5563:5560-5563"
37-
- "5555:5555"
38-
volumes:
39-
- ./config/pushpin:/etc/pushpin
40-
command: "pushpin --merge-output"
24+
- "6379:6379"

‎docker-entrypoint.sh‎

Lines changed: 2 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,14 @@
11
#!/bin/bash
2-
# source - https://github.com/fanout/docker-pushpin/blob/master/docker-entrypoint.sh
32
set -e
43

5-
# Configure Pushpin
6-
if [ -w /usr/lib/pushpin/internal.conf ]; then
7-
sed -i \
8-
-e 's/zurl_out_specs=.*/zurl_out_specs=ipc:\/\/\{rundir\}\/pushpin-zurl-in/' \
9-
-e 's/zurl_out_stream_specs=.*/zurl_out_stream_specs=ipc:\/\/\{rundir\}\/pushpin-zurl-in-stream/' \
10-
-e 's/zurl_in_specs=.*/zurl_in_specs=ipc:\/\/\{rundir\}\/pushpin-zurl-out/' \
11-
/usr/lib/pushpin/internal.conf
12-
else
13-
echo "docker-entrypoint.sh: unable to write to /usr/lib/pushpin/internal.conf, readonly"
14-
fi
15-
164
if [ -w /etc/pushpin/pushpin.conf ]; then
175
sed -i \
18-
-e 's/services=.*/services=condure,zurl,pushpin-proxy,pushpin-handler/' \
6+
-e 's/services=.*/services=condure,pushpin-proxy,pushpin-handler/' \
197
-e 's/push_in_spec=.*/push_in_spec=tcp:\/\/\*:5560/' \
208
-e 's/push_in_http_addr=.*/push_in_http_addr=0.0.0.0/' \
219
-e 's/push_in_sub_specs=.*/push_in_sub_spec=tcp:\/\/\*:5562/' \
2210
-e 's/command_spec=.*/command_spec=tcp:\/\/\*:5563/' \
11+
-e 's/^http_port=.*/http_port=7000/' \
2312
/etc/pushpin/pushpin.conf
2413
else
2514
echo "docker-entrypoint.sh: unable to write to /etc/pushpin/pushpin.conf, readonly"
@@ -30,50 +19,4 @@ if [ -v target ]; then
3019
echo "* ${target},over_http" > /etc/pushpin/routes
3120
fi
3221

33-
# Update pushpin.conf file to use $PORT for http_port
34-
if [ -w /etc/pushpin/pushpin.conf ]; then
35-
PROTOCOL="http_port"
36-
PUSHPIN_PORT=7000
37-
if [ -n "${PORT}" ]; then
38-
PUSHPIN_PORT=${PORT}
39-
fi
40-
41-
if [ "${TLS_ENABLED}" = true ] ; then
42-
echo "https configured"
43-
PROTOCOL="https_ports"
44-
45-
# write ca cert to pushpin certs directory if exists
46-
if [ -n "${TLS_CERT}" ]; then
47-
echo "copying tls cert from ${TLS_CERT} to etc/pushpin/runner/certs/default_${PUSHPIN_PORT}.crt"
48-
cp ${TLS_CERT} etc/pushpin/runner/certs/default_${PUSHPIN_PORT}.crt
49-
fi
50-
51-
# write ca key to pushpin certs directory if exists
52-
if [ -n "${TLS_KEY}" ]; then
53-
echo "copying tls key from ${TLS_CERT} to etc/pushpin/runner/certs/default_${PUSHPIN_PORT}.key"
54-
cp ${TLS_KEY} etc/pushpin/runner/certs/default_${PUSHPIN_PORT}.key
55-
fi
56-
fi
57-
58-
# set port and protocol for pushpin to listen on e.g. listen for https connections on port 6000
59-
echo "Listening for requests on port ${PUSHPIN_PORT}"
60-
sed -i \
61-
-e "s/http_port=7000/${PROTOCOL}=${PUSHPIN_PORT}/" \
62-
/etc/pushpin/pushpin.conf
63-
export PORT=
64-
else
65-
echo "docker-entrypoint.sh: unable to write to /etc/pushpin/pushpin.conf, readonly"
66-
fi
67-
68-
# Update routes file to forward traffic using ssl if tls_enabled is true
69-
if [ -w /etc/pushpin/routes ]; then
70-
if [ "${TLS_ENABLED}" = true ] ; then
71-
sed -i \
72-
-e "s/localhost:8000/localhost:8000,ssl,insecure/" \
73-
/etc/pushpin/routes
74-
fi
75-
else
76-
echo "docker-entrypoint.sh: unable to write to /etc/pushpin/routes, readonly"
77-
fi
78-
7922
exec "$@"

‎tests/e2e/stream_test.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ func TestEvent(t *testing.T) {
4040
args{
4141
Key: GetServerAPIKey(),
4242
Operation: func() error {
43+
t.Log("Patching feature flag")
4344
parameters := make(map[string]interface{})
4445
parameters["state"] = "on"
4546
resp := PatchFeatureFlag(t, DefaultClient(), GetAccountIdentifier(), GetOrgIdentifier(), "string-flag1", GetProjectIdentifier(), GetEnvironmentIdentifier(), "setFeatureFlagState", parameters)
@@ -60,6 +61,7 @@ func TestEvent(t *testing.T) {
6061
args{
6162
Key: GetServerAPIKey(),
6263
Operation: func() error {
64+
t.Log("Patching feature flag")
6365
parameters := make(map[string]interface{})
6466
parameters["state"] = "off"
6567
resp := PatchFeatureFlag(t, DefaultClient(), GetAccountIdentifier(), GetOrgIdentifier(), "string-flag1", GetProjectIdentifier(), GetEnvironmentIdentifier(), "setFeatureFlagState", parameters)
@@ -108,10 +110,11 @@ func TestEvent(t *testing.T) {
108110
// wait for up to 10 seconds for the expected sse event to come in
109111
select {
110112
case msg := <-eventChan:
113+
t.Log("Event received")
111114
assert.Equal(t, tt.want.sseEvent.Event, msg.Event)
112115
assert.Equal(t, tt.want.sseEvent.Domain, msg.Domain)
113116
assert.Equal(t, tt.want.sseEvent.Identifier, msg.Identifier)
114-
case <-time.After(10 * time.Second):
117+
case <-time.After(20 * time.Second):
115118
t.Error("Timed out waiting for event to come in")
116119
}
117120
result, err := client.StringVariation("string-flag1", nil, "default")

0 commit comments

Comments
 (0)