mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-13 08:59:08 +02:00
Nicolas Frati
e4ddd9a3fc
* [management] Add a release-wired UBI image variant OpenShift and other Red Hat environments expect UBI-based images that run as an arbitrary non-root UID. The proxy, combined server and rootless client already ship -ubi variants; this adds the same for management, published as <version>-ubi and ubi-latest for amd64 and arm64. The default --port of 80 cannot bind without root, so the image defaults to 8080. For Let's Encrypt, public 443 forwards to --port and --letsencrypt-listen-address is empty (#7706), so the main listener answers the TLS-ALPN challenges. * [management] Certify the management UBI image Adds management to the Red Hat certification components. Its Partner Connect component ID goes in the REDHAT_CERT_ID_MANAGEMENT repository variable.
34 lines
1.3 KiB
Docker
34 lines
1.3 KiB
Docker
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
|
|
|
|
ARG TARGETPLATFORM
|
|
ARG VERSION=dev
|
|
ARG RELEASE=1
|
|
|
|
LABEL name="netbird-management" \
|
|
maintainer="NetBird <dev@netbird.io>" \
|
|
vendor="NetBird GmbH" \
|
|
version="${VERSION}" \
|
|
release="${RELEASE}" \
|
|
summary="NetBird Management" \
|
|
description="NetBird Management is the control plane of a NetBird network and serves its REST and gRPC APIs."
|
|
|
|
COPY --chmod=0555 ${TARGETPLATFORM}/netbird-mgmt /go/bin/netbird-mgmt
|
|
COPY licenses/ /licenses/
|
|
# Only the data directory shares the root group for arbitrary non-root UIDs.
|
|
# Runtime-created keys and databases retain the application's restrictive modes.
|
|
RUN mkdir -p /var/lib/netbird /etc/netbird && \
|
|
chown 1000:0 /var/lib/netbird && \
|
|
chmod 0770 /var/lib/netbird && \
|
|
chmod -R a+rX /licenses
|
|
|
|
USER 1000:0
|
|
ENV HOME=/var/lib/netbird
|
|
# Runtimes such as OpenShift and Podman reserve ports below 1024 for root, so
|
|
# --port defaults to 8080 here. With --letsencrypt-domain, forward public 443
|
|
# to --port and set --letsencrypt-listen-address to empty, so the main listener
|
|
# answers the TLS-ALPN challenges. 33073 is the legacy gRPC port.
|
|
EXPOSE 8080 33073
|
|
STOPSIGNAL SIGTERM
|
|
ENTRYPOINT ["/go/bin/netbird-mgmt", "management"]
|
|
CMD ["--port", "8080", "--log-file", "console"]
|