Restructure Containerfile and specify Outputs

.github/workflows/container-image.Containerfile

@@ -5,16 +5,18 @@
 
 FROM debian:${DEBIAN_VERSION}-slim
 
-COPY --from=plugins / /
+COPY --from=plugins /usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/
+COPY --from=plugins /plugins.cdx.json /usr/share/sbom/
 
-RUN apt-get update && \
-    apt-get upgrade -y && \
+RUN --mount=from=plugins,target=/plugins \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-install-suggests \
-        $(cat /icinga2-plugins-debian-requirements) && \
+        $(cat /plugins/debian-packages) && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /usr/lib/nagios/plugins
 CMD set -e; \
     for c in mssql_health nwc_health postgres.pl ssl_cert; do \
         test -x "check_$c"; \
         "./check_$c" --version || true; \

Containerfile

@@ -52,6 +52,20 @@ WORKDIR /check_ssl_cert
 RUN git clone --recurse-submodules https://github.com/matteocorti/check_ssl_cert.git . && \
     git checkout "$CHECK_SSL_CERT_REF"
 
+WORKDIR /deb-requirements
+RUN cat - <<EOF > packages
+bc
+bind9-dnsutils
+bind9-host
+ca-certificates
+curl
+file
+libfile-slurp-perl
+libjson-perl
+libjson-xs-perl
+openssl
+EOF
+
 WORKDIR /sbom
 RUN sep=""; sbomComponent() { \
         printf '%s{"type":"application","name":"%s","version":"%s","licenses":[{"license":{"id":"%s"}}],"purl":"pkg:github/%s/%s@%s"}' \
@@ -67,20 +81,12 @@ RUN sep=""; sbomComponent() { \
         printf ']}\n'; \
     } | tee plugins.cdx.json
 
-WORKDIR /deb-requirements
-RUN cat - <<EOF > packages
-bind9-dnsutils
-bind9-host
-libfile-slurp-perl
-libjson-perl
-libjson-xs-perl
-EOF
-
 FROM scratch
 
-COPY --from=build-plugins /check_mssql_health/bin/ /
-COPY --from=build-plugins /check_nwc_health/bin/ /
-COPY --from=build-plugins /check_postgres/bin/ /
-COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/check_ssl_cert
-COPY --from=build-plugins /sbom/plugins.cdx.json /usr/share/sbom/plugins.cdx.json
-COPY --from=build-plugins /deb-requirements/packages /icinga2-plugins-debian-requirements
+COPY --from=build-plugins /check_mssql_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/
+COPY --from=build-plugins /check_nwc_health/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/
+COPY --from=build-plugins /check_postgres/bin/usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/
+COPY --from=build-plugins /check_ssl_cert/check_ssl_cert /usr/lib/nagios/plugins/
+
+COPY --from=build-plugins /deb-requirements/packages /debian-packages
+COPY --from=build-plugins /sbom/plugins.cdx.json /plugins.cdx.json

README.md

@@ -15,13 +15,30 @@ The following check commands are included:
 - [`check_postgres`](https://github.com/bucardo/check_postgres)
 - [`check_ssl_cert`](https://github.com/matteocorti/check_ssl_cert)
 
-## Usage
+## Container Image Content
 
-The container image `ghcr.io/icinga/icinga2-plugins-container` contains the check plugins
-as well as a list of required Debian packages, located under `/icinga2-plugins-debian-requirements`.
-The content of the complete container image can be copied into the image, followed by installing the dependencies.
+The final container image contains
 
-An example is available in `.github/workflows/container-image.Containerfile`, otherwise check Icinga 2.
+- the check plugins located under `/usr/lib/nagios/plugins/`,
+- the required Debian packages in the `/debian-packages` file, and
+- a CycloneDX SBOM in `/plugins.cdx.json`.
+
+## Manual Testing
+
+Next to the main `Containerfile`, there is another `Containerfile` for testing available as `.github/workflows/container-image.Containerfile`.
+While this is used in the CI to verify the build, it can also be used locally.
+
+```
+$ # Build the main container image
+$ podman build -t plugins .
+
+$ # Build the testing container image
+$ podman build -t plugins-test -f .github/workflows/container-image.Containerfile .
+
+$ # Test the testing container
+$ podman run -t --rm plugins-test
+[ . . . ]
+```
 
 ## Release
 
@@ -36,14 +53,13 @@ The CI will take care of the rest.
 A CycloneDX SBOM describing all plugins and their versions is also included in the container image.
 
 ```
-$ podman build -t icinga2-plugins-container .
+$ podman build -t plugins .
 [ . . . ]
 
-$ syft podman:icinga2-plugins-container -q --select-catalogers +sbom-cataloger
+$ syft podman:plugins -q --select-catalogers +sbom-cataloger
 NAME                VERSION                                   TYPE
 check_mssql_health  937f4f0aa7af90506924cb2b772e092e6538b348  UnknownPackage
 check_nwc_health    22fcf6b5877e2e503316fed500581d538ae8cfea  UnknownPackage
-check_postgres      UNKNOWN                                   cpan
 check_postgres      d0bba94836b2029109c487ed0f800fecd61ab2e9  UnknownPackage
 check_ssl_cert      86cbfac35ac339e52baea69a94029ab5b9134f10  UnknownPackage
 ```