Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump Nightly Docker image to Debian Bookworm #8212

Open
wants to merge 15 commits into
base: main
Choose a base branch
from
Open

Bump Nightly Docker image to Debian Bookworm #8212

wants to merge 15 commits into from

Conversation

sastorsl
Copy link

@sastorsl sastorsl commented Nov 23, 2023 •
edited by thc202

This PR bumps the base image for zaproxy from Debian Bullseye (11) to Debian Bookworm (12).
It also bumps openjdk from openjdk-11 to openjdk-17 - as 17 is the current default in Bookworm, and openjdk-11 is not directly available in Bookworm.

Resolves #8211.

@sastorsl
Resolves zaproxy#8211 Change image to debian:bookworm-slim (debian 12).
ec48a33 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Resolves zaproxy#8211 Bookworm JDK is on openjdk-17.
241ccdc 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@thc202 thc202 changed the title Resolves #8211 Bump zaproxy base image to Debian Bookworm [WIP] Bump base Docker image to Debian Bookworm Nov 23, 2023
@thc202
Copy link
Member

thc202 commented Nov 23, 2023

The version 17 no longer bundles Nashorn.

thc202
thc202 reviewed Nov 23, 2023
View reviewed changes
docker/CHANGELOG.md Outdated
@@ -1,6 +1,9 @@
# Changelog
All notable changes to the docker containers will be documented in this file.

### 2023-11-15
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is outdated, in any case it will have to wait for the decision to drop Nashorn use.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have removed it for now. Any instructions on how to formulate, what date to use, etc. is appreciated.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The description looks fine (updated to current changes), the date should match the day when the PR is merged.

@psiinon
Copy link
Member

psiinon commented Nov 23, 2023

Yeah, we need to decide how long we want to keep supporting Nashorn, and by implication Java 11...

@sastorsl
Copy link
Author

sastorsl commented Nov 23, 2023 •
edited

Many considerations with the underlying java I did not look into, that is for sure.

I guess dropping in temurin11 should not be too big of a deal though. Then the java issue could be postponed.

@sastorsl
Copy link
Author

I could update the PR with temurin, but I would like your input on this first.

https://github.com/adoptium/temurin-build/wiki/Differences-between-Adopt-OpenJDK-binaries-and-Oracle-JDK-Binaries

@sastorsl
Copy link
Author

Install:

# docker run --rm -ti debian:bookworm-slim bash
apt install curl
mkdir -p /etc/apt/keyrings
curl -s https://packages.adoptium.net/artifactory/api/gpg/key/public > /etc/apt/keyrings/adoptium.asc
echo "deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | tee /etc/apt/sources.list.d/adoptium.list

apt update
apt install temurin-11-jdk

New java version

# java -version
openjdk version "11.0.21" 2023-10-17
OpenJDK Runtime Environment Temurin-11.0.21+9 (build 11.0.21+9)
OpenJDK 64-Bit Server VM Temurin-11.0.21+9 (build 11.0.21+9, mixed mode)

@thc202
Copy link
Member

thc202 commented Nov 28, 2023

I'm good with installing Java 11, but, we should start by changing just the nightly image and then change the other images with time, just in case the newer base image causes issues downstream.

@sastorsl
Copy link
Author

I'm good with installing Java 11, but, we should start by changing just the nightly image and then change the other images with time, just in case the newer base image causes issues downstream.

I've updated Dockerfile-live only now, and included temurin-11-jdk.
I've reverted the changes made in the rest of the Dockerfile's.

Let's see how it builds, and any comments you might have.

@psiinon
Copy link
Member

psiinon commented Nov 30, 2023

Whats the difference in sizes like?
For some reason I cant build the live image locally, so I hacked the weekly to include similar changes. I had to disable the pip install as that was failing but bookworm was still bigger (although not by a lot):

docker images                          
REPOSITORY                            TAG       IMAGE ID       CREATED          SIZE
ssp/zap2docker-weekly-bookworm        latest    7ed8181b79f7   56 seconds ago   1.95GB
ssp/zap2docker-weekly                 latest    802a8dd2a6be   11 minutes ago   1.71GB

@sastorsl
Copy link
Author

sastorsl commented Dec 5, 2023

I saw that there was a couple more changes that was required.
I'll update the PR shortly.

In addition, I did what you did, and made a local build with just the basics, and compared sizes.

One (or more) packages draws in java-17-openjdk - so there are two java packages there.
And there is about 90M extra in x86_64-linux-gnu

Volumes                       bullseye  bookworm
/usr/lib/X11                  4.0K      4.0K
/usr/lib/apt                  1.1M      1.1M
/usr/lib/bfd-plugins          4.0K      4.0K
/usr/lib/binfmt.d             4.0K      8.0K
/usr/lib/compat-ld            4.0K      4.0K
/usr/lib/cpp                            0
/usr/lib/dbus-1.0             56K       56K
/usr/lib/debug                20K       20K
/usr/lib/dpkg                 36K       36K
/usr/lib/environment.d        4.0K      4.0K
/usr/lib/firefox-esr          228M (*)  226M (*)
/usr/lib/firmware                       72K
/usr/lib/gcc                  95M       120M (*)
/usr/lib/git-core             18M       23M
/usr/lib/gnupg                680K      728K
/usr/lib/gnupg2               4.0K      4.0K
/usr/lib/gold-ld              4.0K      4.0K
/usr/lib/init                           16K
/usr/lib/jvm                  258M (*)  494M (*)
/usr/lib/kernel               24K       28K
/usr/lib/locale               1.9M      404K
/usr/lib/lsb                            32K
/usr/lib/mime                 32K       40K
/usr/lib/modprobe.d                     8.0K
/usr/lib/modules-load.d       4.0K      4.0K
/usr/lib/mozilla              16K       16K
/usr/lib/openssh              1.2M      1.6M
/usr/lib/os-release           4.0K      4.0K
/usr/lib/pam.d                8.0K      8.0K
/usr/lib/python3              6.7M      25M
/usr/lib/python3.11                     54M
/usr/lib/python3.9            42M
/usr/lib/sasl2                4.0K      4.0K
/usr/lib/ssl                  24K       24K
/usr/lib/sysctl.d             12K       12K
/usr/lib/systemd              544K      4.8M
/usr/lib/sysusers.d           16K       24K
/usr/lib/tcltk                16K       16K
/usr/lib/terminfo                       228K
/usr/lib/tmpfiles.d           56K       64K
/usr/lib/udev                 16K       60K
/usr/lib/valgrind             16K       16K
/usr/lib/x86_64-linux-gnu     488M (*)  565M (*)
/usr/lib/xorg                 32K       32K

@sastorsl
Copy link
Author

sastorsl commented Dec 5, 2023

It seems that installing temurin before installing the rest of the packages we don't draw in openjdk.
I'll adapt the PR accordingly.

@sastorsl
Copy link
Author

sastorsl commented Dec 5, 2023

My local build is progressing (if somewhat slowly), and is passed my edits anyways.

docker build . --platform linux/amd64 -t zaproxy-live -t owasp/zap2docker-live:latest -t ghcr.io/zaproxy/zaproxy:nightly -t softwaresecurityproject/zap-nightly:latest -f Dockerfile-live

I'm interested in hearing if you are able to build and get tests running.

@sastorsl
Revert "Resolves zaproxy#8211 Bookworm JDK is on openjdk-17."
247e36e 
This reverts commit 241ccdc.

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Revert "Resolves zaproxy#8211 Change image to debian:bookworm-slim (d…
a088c9a 
…ebian 12)."

This reverts commit ec48a33.

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Resolves zaproxy#8211 Change image to debian:bookworm-slim (debian 12…
9a4fbae 
…) with temurin-11-jdk.

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Remove openjdk-11-jdk.
8b20c2b 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Ensure temurin is available before installing packages.
a98fa76 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
New OS implements PEP 668
418441d 
https://peps.python.org/pep-0668/

Further down the line using a python venv should be investigated.

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Group RUN into bite size chunks.
7309e61 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@thc202 thc202 changed the title [WIP] Bump base Docker image to Debian Bookworm Bump Nightly Docker image to Debian Bookworm Dec 6, 2023
@sastorsl
Copy link
Author

sastorsl commented Dec 6, 2023 •
edited

I got a build size of 2.15GB, as compared to 1.99GB in the "old".

A trivy scan showed 7 a drop from 14 CRITICAL to 4, and from 126 HIGH to 70 in the Total count.

trivy image --scanners vuln --format table --severity HIGH,CRITICAL zaproxy-live  # my build
# Total: 126 (HIGH: 112, CRITICAL: 14)

trivy image --scanners vuln --format table --severity HIGH,CRITICAL ghcr.io/zaproxy/zaproxy:stable
# Total: 74 (HIGH: 70, CRITICAL: 4)

@sastorsl
Copy link
Author

sastorsl commented Dec 6, 2023

I see that ubuntu:22.04 is 78MB and debian:bookworm-slim is 75MB. In comparison debian:bullseye-slim is 80MB.
ubuntu:22.04 also has packages for openjdk-11-jdk.

The immediate change I see is that one has to add the mozilla PPA to get firefox-esr.

According to the commits the images used to be ubuntu. Were there any compelling reasons for the switch?

@sastorsl
TEST, will be removed in a squash.
9e0fe4d
@sastorsl
TEST, will be removed in a squash.
6577d90 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Not muddying the water with ubuntu.
d3b4d11 
Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Merge branch 'docker-bookworm' of github.com:sastorsl/zaproxy into do…
f085b99 
…cker-bookworm
@sastorsl
Merge branch 'docker-bookworm' of github.com:sastorsl/zaproxy into do…
f6cc806 
…cker-bookworm

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
@sastorsl
Merge branch 'docker-bookworm' of github.com:sastorsl/zaproxy into do…
d6dd40f 
…cker-bookworm

Signed-off-by: Stein Arne Storslett <sastorsl@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@thc202 thc202 thc202 left review comments

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
Type-Task
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Bump the base Docker image from bullseye-slim to bookworm-slim
3 participants
@sastorsl @thc202 @psiinon