diff --git a/.github/workflows/container-image.Containerfile b/.github/workflows/container-image.Containerfile index 46fcbe7..d223704 100644 --- a/.github/workflows/container-image.Containerfile +++ b/.github/workflows/container-image.Containerfile @@ -5,12 +5,14 @@ ARG DEBIAN_VERSION="trixie" FROM debian:${DEBIAN_VERSION}-slim -COPY --from=plugins / / +COPY --from=plugins /usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=plugins /plugins.cdx.json /usr/share/sbom/ -RUN apt-get update && \ - apt-get upgrade -y && \ +RUN --mount=from=plugins,target=/plugins \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-install-suggests \ - $(cat /icinga2-plugins-debian-requirements) && \ + $(cat /plugins/debian-packages) && \ rm -rf /var/lib/apt/lists/* WORKDIR /usr/lib/nagios/plugins diff --git a/Containerfile b/Containerfile index 819991e..3531d8c 100644 --- a/Containerfile +++ b/Containerfile @@ -52,6 +52,20 @@ WORKDIR /check_ssl_cert RUN git clone --recurse-submodules https://github.com/matteocorti/check_ssl_cert.git . && \ git checkout "$CHECK_SSL_CERT_REF" +WORKDIR /deb-requirements +RUN cat - < packages +bc +bind9-dnsutils +bind9-host +ca-certificates +curl +file +libfile-slurp-perl +libjson-perl +libjson-xs-perl +openssl +EOF + WORKDIR /sbom RUN sep=""; sbomComponent() { \ printf '%s{"type":"application","name":"%s","version":"%s","licenses":[{"license":{"id":"%s"}}],"purl":"pkg:github/%s/%s@%s"}' \ @@ -67,20 +81,12 @@ RUN sep=""; sbomComponent() { \ printf ']}\n'; \ } | tee plugins.cdx.json -WORKDIR /deb-requirements -RUN cat - < packages -bind9-dnsutils -bind9-host -libfile-slurp-perl -libjson-perl -libjson-xs-perl -EOF - FROM scratch -COPY --from=build-plugins /check_mssql_health/bin/ / -COPY --from=build-plugins /check_nwc_health/bin/ / -COPY --from=build-plugins /check_postgres/bin/ / -COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/check_ssl_cert -COPY --from=build-plugins /sbom/plugins.cdx.json /usr/share/sbom/plugins.cdx.json -COPY --from=build-plugins /deb-requirements/packages /icinga2-plugins-debian-requirements +COPY --from=build-plugins /check_mssql_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_nwc_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_postgres/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/ + +COPY --from=build-plugins /deb-requirements/packages /debian-packages +COPY --from=build-plugins /sbom/plugins.cdx.json /plugins.cdx.json diff --git a/README.md b/README.md index 341dd47..a085313 100644 --- a/README.md +++ b/README.md @@ -15,13 +15,30 @@ The following check commands are included: - [`check_postgres`](https://github.com/bucardo/check_postgres) - [`check_ssl_cert`](https://github.com/matteocorti/check_ssl_cert) -## Usage +## Container Image Content -The container image `ghcr.io/icinga/icinga2-plugins-container` contains the check plugins -as well as a list of required Debian packages, located under `/icinga2-plugins-debian-requirements`. -The content of the complete container image can be copied into the image, followed by installing the dependencies. +The final container image contains -An example is available in `.github/workflows/container-image.Containerfile`, otherwise check Icinga 2. +- the check plugins located under `/usr/lib/nagios/plugins/`, +- the required Debian packages in the `/debian-packages` file, and +- a CycloneDX SBOM in `/plugins.cdx.json`. + +## Manual Testing + +Next to the main `Containerfile`, there is another `Containerfile` for testing available as `.github/workflows/container-image.Containerfile`. +While this is used in the CI to verify the build, it can also be used locally. + +``` +$ # Build the main container image +$ podman build -t plugins . + +$ # Build the testing container image +$ podman build -t plugins-test -f .github/workflows/container-image.Containerfile . + +$ # Test the testing container +$ podman run -t --rm plugins-test +[ . . . ] +``` ## Release @@ -36,14 +53,13 @@ The CI will take care of the rest. A CycloneDX SBOM describing all plugins and their versions is also included in the container image. ``` -$ podman build -t icinga2-plugins-container . +$ podman build -t plugins . [ . . . ] -$ syft podman:icinga2-plugins-container -q --select-catalogers +sbom-cataloger +$ syft podman:plugins -q --select-catalogers +sbom-cataloger NAME VERSION TYPE check_mssql_health 937f4f0aa7af90506924cb2b772e092e6538b348 UnknownPackage check_nwc_health 22fcf6b5877e2e503316fed500581d538ae8cfea UnknownPackage -check_postgres UNKNOWN cpan check_postgres d0bba94836b2029109c487ed0f800fecd61ab2e9 UnknownPackage check_ssl_cert 86cbfac35ac339e52baea69a94029ab5b9134f10 UnknownPackage ```