From 8eab8bb5b4882c7d315690dcff570eac833e2c37 Mon Sep 17 00:00:00 2001 From: Alvar Penning Date: Wed, 11 Nov 2026 09:24:36 +0100 Subject: [PATCH] Restructure Containerfile and specify Outputs Document files in the container image and ensure that only /usr/lib/nagios/plugins/ gets populated by files. Then, place the Debian Package List and the SBOM under root. The testing container image can bind mount the required packages list. Also, enrich the list of required packages by requirements for check_ssl_cert, which were already present in the current Icinga 2 Containerfile, but not in the testing one. --- .../workflows/container-image.Containerfile | 10 +++--- Containerfile | 36 +++++++++++-------- README.md | 32 ++++++++++++----- 3 files changed, 51 insertions(+), 27 deletions(-) diff --git a/.github/workflows/container-image.Containerfile b/.github/workflows/container-image.Containerfile index 46fcbe7..d223704 100644 --- a/.github/workflows/container-image.Containerfile +++ b/.github/workflows/container-image.Containerfile @@ -5,12 +5,14 @@ ARG DEBIAN_VERSION="trixie" FROM debian:${DEBIAN_VERSION}-slim -COPY --from=plugins / / +COPY --from=plugins /usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=plugins /plugins.cdx.json /usr/share/sbom/ -RUN apt-get update && \ - apt-get upgrade -y && \ +RUN --mount=from=plugins,target=/plugins \ + apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-install-suggests \ - $(cat /icinga2-plugins-debian-requirements) && \ + $(cat /plugins/debian-packages) && \ rm -rf /var/lib/apt/lists/* WORKDIR /usr/lib/nagios/plugins diff --git a/Containerfile b/Containerfile index 819991e..3531d8c 100644 --- a/Containerfile +++ b/Containerfile @@ -52,6 +52,20 @@ WORKDIR /check_ssl_cert RUN git clone --recurse-submodules https://github.com/matteocorti/check_ssl_cert.git . && \ git checkout "$CHECK_SSL_CERT_REF" +WORKDIR /deb-requirements +RUN cat - < packages +bc +bind9-dnsutils +bind9-host +ca-certificates +curl +file +libfile-slurp-perl +libjson-perl +libjson-xs-perl +openssl +EOF + WORKDIR /sbom RUN sep=""; sbomComponent() { \ printf '%s{"type":"application","name":"%s","version":"%s","licenses":[{"license":{"id":"%s"}}],"purl":"pkg:github/%s/%s@%s"}' \ @@ -67,20 +81,12 @@ RUN sep=""; sbomComponent() { \ printf ']}\n'; \ } | tee plugins.cdx.json -WORKDIR /deb-requirements -RUN cat - < packages -bind9-dnsutils -bind9-host -libfile-slurp-perl -libjson-perl -libjson-xs-perl -EOF - FROM scratch -COPY --from=build-plugins /check_mssql_health/bin/ / -COPY --from=build-plugins /check_nwc_health/bin/ / -COPY --from=build-plugins /check_postgres/bin/ / -COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/check_ssl_cert -COPY --from=build-plugins /sbom/plugins.cdx.json /usr/share/sbom/plugins.cdx.json -COPY --from=build-plugins /deb-requirements/packages /icinga2-plugins-debian-requirements +COPY --from=build-plugins /check_mssql_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_nwc_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_postgres/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/ +COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/ + +COPY --from=build-plugins /deb-requirements/packages /debian-packages +COPY --from=build-plugins /sbom/plugins.cdx.json /plugins.cdx.json diff --git a/README.md b/README.md index 341dd47..a085313 100644 --- a/README.md +++ b/README.md @@ -15,13 +15,30 @@ The following check commands are included: - [`check_postgres`](https://github.com/bucardo/check_postgres) - [`check_ssl_cert`](https://github.com/matteocorti/check_ssl_cert) -## Usage +## Container Image Content -The container image `ghcr.io/icinga/icinga2-plugins-container` contains the check plugins -as well as a list of required Debian packages, located under `/icinga2-plugins-debian-requirements`. -The content of the complete container image can be copied into the image, followed by installing the dependencies. +The final container image contains -An example is available in `.github/workflows/container-image.Containerfile`, otherwise check Icinga 2. +- the check plugins located under `/usr/lib/nagios/plugins/`, +- the required Debian packages in the `/debian-packages` file, and +- a CycloneDX SBOM in `/plugins.cdx.json`. + +## Manual Testing + +Next to the main `Containerfile`, there is another `Containerfile` for testing available as `.github/workflows/container-image.Containerfile`. +While this is used in the CI to verify the build, it can also be used locally. + +``` +$ # Build the main container image +$ podman build -t plugins . + +$ # Build the testing container image +$ podman build -t plugins-test -f .github/workflows/container-image.Containerfile . + +$ # Test the testing container +$ podman run -t --rm plugins-test +[ . . . ] +``` ## Release @@ -36,14 +53,13 @@ The CI will take care of the rest. A CycloneDX SBOM describing all plugins and their versions is also included in the container image. ``` -$ podman build -t icinga2-plugins-container . +$ podman build -t plugins . [ . . . ] -$ syft podman:icinga2-plugins-container -q --select-catalogers +sbom-cataloger +$ syft podman:plugins -q --select-catalogers +sbom-cataloger NAME VERSION TYPE check_mssql_health 937f4f0aa7af90506924cb2b772e092e6538b348 UnknownPackage check_nwc_health 22fcf6b5877e2e503316fed500581d538ae8cfea UnknownPackage -check_postgres UNKNOWN cpan check_postgres d0bba94836b2029109c487ed0f800fecd61ab2e9 UnknownPackage check_ssl_cert 86cbfac35ac339e52baea69a94029ab5b9134f10 UnknownPackage ```