github.com/grafana/synthetic-monitoring-agent@v0.64.2/Dockerfile.build (about)

     1  # First stage obtains the list of certificates.
     2  FROM --platform=$BUILDPLATFORM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS build
     3  RUN apk --no-cache add ca-certificates-bundle
     4  
     5  # setcapper stage handles adding file capabilities where needed
     6  FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS setcapper
     7  ARG TARGETOS
     8  ARG TARGETARCH
     9  ARG HOST_DIST=$TARGETOS-$TARGETARCH
    10  
    11  RUN apk --no-cache add libcap
    12  
    13  COPY --chown=sm:sm --chmod=0500 dist/${HOST_DIST}/synthetic-monitoring-agent /usr/local/bin/synthetic-monitoring-agent
    14  
    15  RUN setcap cap_net_raw=+ep /usr/local/bin/synthetic-monitoring-agent
    16  
    17  # Base release copies the binaries, configuration and also the
    18  # certificates from the first stage.
    19  FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS release
    20  ARG TARGETOS
    21  ARG TARGETARCH
    22  ARG HOST_DIST=$TARGETOS-$TARGETARCH
    23  ARG K6_V1_VERSION=v1.1.12
    24  ARG K6_V2_VERSION=v2.0.7
    25  
    26  RUN adduser -D -u 12345 -g 12345 sm
    27  
    28  ADD --chown=sm:sm --chmod=0500 https://github.com/grafana/xk6-sm/releases/download/${K6_V1_VERSION}/sm-k6-${TARGETOS}-${TARGETARCH} /usr/libexec/sm-k6/k6-v1
    29  ADD --chown=sm:sm --chmod=0500 https://github.com/grafana/xk6-sm/releases/download/${K6_V2_VERSION}/sm-k6-${TARGETOS}-${TARGETARCH} /usr/libexec/sm-k6/k6-v2
    30  COPY --chown=sm:sm --chmod=0500 --from=setcapper /usr/local/bin/synthetic-monitoring-agent /usr/local/bin/synthetic-monitoring-agent
    31  COPY --chown=sm:sm scripts/pre-stop.sh /usr/local/lib/synthetic-monitoring-agent/pre-stop.sh
    32  COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
    33  
    34  USER sm
    35  ENTRYPOINT ["/usr/local/bin/synthetic-monitoring-agent"]
    36  
    37  # Browser release copies the setup from the base agent and
    38  # additionally installs Chromium to support browser checks.
    39  FROM ghcr.io/grafana/chromium-swiftshader-alpine:149.0.7827.53-r0-3.23.4@sha256:9f1c9c4c0112e6f19c5e027ef97f4178c3e14da8288d6a37b008282ca781bffc AS with-browser
    40  RUN apk --no-cache add --repository community tini
    41  RUN adduser -D -u 12345 -g 12345 sm
    42  
    43  COPY --from=release --chown=sm:sm /usr/local/bin/synthetic-monitoring-agent /usr/local/bin/synthetic-monitoring-agent
    44  COPY --from=release --chown=sm:sm /usr/libexec/sm-k6/k6-v1 /usr/libexec/sm-k6/k6-v1
    45  COPY --from=release --chown=sm:sm /usr/libexec/sm-k6/k6-v2 /usr/libexec/sm-k6/k6-v2
    46  COPY --from=release /usr/local/lib/synthetic-monitoring-agent/pre-stop.sh /usr/local/lib/synthetic-monitoring-agent/pre-stop.sh
    47  COPY --from=release /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
    48  
    49  # Removing any file with setuid bit set, such as /usr/lib/chromium/chrome-sandbox,
    50  # which is used for chromium sandboxing.
    51  RUN find / -type f -perm -4000 -delete
    52  
    53  ENV K6_BROWSER_ARGS=no-sandbox,disable-dev-shm-usage
    54  
    55  USER sm
    56  ENTRYPOINT ["tini", "--", "/usr/local/bin/synthetic-monitoring-agent"]