GeezerVison is showing github.com — socket-python-cli/Dockerfile at main · SocketDev/socket-python-cli

Expand file tree

Dockerfile

Copy path

More file actions

Latest commit

History

199 lines (178 loc) · 8.46 KB

Dockerfile

Copy path

File metadata and controls

199 lines (178 loc) · 8.46 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

# Node.js from the official Alpine image instead of Alpine's nodejs package, which

# lags Node's security releases. Match the major version to what reachability needs

# and the Alpine release to the python:3-alpine base below.

FROM node:24-alpine3.24 AS node

FROM python:3-alpine

LABEL org.opencontainers.image.authors="socket.dev"

# Build-time only. Keeps pip's cache out of the layers, and lets the CLI install

# retries see a release PyPI has just listed (pip caches its index for 10 min).

ARG PIP_NO_CACHE_DIR=1

# Language version arguments with defaults

ARG GO_VERSION=system

ARG JAVA_VERSION=17

ARG DOTNET_VERSION=8

# CLI and SDK arguments

ARG CLI_VERSION

ARG SDK_VERSION

ARG PIP_INDEX_URL=https://pypi.org/simple

ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple

ARG USE_LOCAL_INSTALL=false

# Install base packages first

# ca-certificates must be 20261020-r0 or newer, which drops the roots the

# compromised eMudhra intermediates chain to. The base image ships an older

# one, and `apk add` does not upgrade installed packages, so upgrade it here.

RUN apk update && apk add --no-cache \

git curl wget \

ruby ruby-dev build-base strace && \

apk upgrade --no-cache ca-certificates && \

[ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]

# pip uses its own vendored CA bundle, not the system store, and the base image's

# pip trusts the compromised eMudhra intermediates. 26.2.2 vendors certifi

# 2026.10.19. Upgrade it against the system store fixed above.

RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" && \

python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'

# npm, npx and yarn are symlinks in the node image. COPY would dereference them

# into flat files and break their relative requires, so recreate the links.

COPY --from=node /usr/local/bin/node /usr/local/bin/node

COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules

COPY --from=node /opt /opt

# Node rejects the compromised eMudhra intermediates from 24.22.1.

RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \

ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \

ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \

ln -s /opt/yarn-v*/bin/yarn /usr/local/bin/yarn && \

ln -s /opt/yarn-v*/bin/yarnpkg /usr/local/bin/yarnpkg && \

node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>24||(a===24&&(b>22||(b===22&&c>=1)))?0:1)'

# Install Go with version control

RUN if [ "$GO_VERSION" = "system" ]; then \

apk add --no-cache go && \

echo "/usr/lib/go" > /etc/goroot; \

else \

cd /tmp && \

ARCH=$(uname -m) && \

case $ARCH in \

x86_64) GOARCH=amd64 ;; \

aarch64) GOARCH=arm64 ;; \

*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \

esac && \

wget https://golang.org/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz && \

tar -C /usr/local -xzf go${GO_VERSION}.linux-${GOARCH}.tar.gz && \

rm go${GO_VERSION}.linux-${GOARCH}.tar.gz && \

echo "/usr/local/go" > /etc/goroot; \

# Install Java with version control

RUN if [ "$JAVA_VERSION" = "8" ]; then \

apk add --no-cache openjdk8-jdk; \

elif [ "$JAVA_VERSION" = "11" ]; then \

apk add --no-cache openjdk11-jdk; \

elif [ "$JAVA_VERSION" = "17" ]; then \

apk add --no-cache openjdk17-jdk; \

elif [ "$JAVA_VERSION" = "21" ]; then \

apk add --no-cache openjdk21-jdk; \

else \

echo "Unsupported Java version: $JAVA_VERSION. Supported: 8, 11, 17, 21" && exit 1; \

# Install .NET with version control

RUN if [ "$DOTNET_VERSION" = "6" ]; then \

apk add --no-cache dotnet6-sdk; \

elif [ "$DOTNET_VERSION" = "8" ]; then \

apk add --no-cache dotnet8-sdk; \

else \

echo "Unsupported .NET version: $DOTNET_VERSION. Supported: 6, 8" && exit 1; \

# Install PyPy (Alpine-compatible build for x86_64 only)

# PyPy is an alternative Python interpreter that makes the Python reachability analysis faster.

# This is a custom build of PyPy3.12 for Alpine on x86-64.

ARG TARGETARCH # Passed by Docker buildx

RUN if [ "$TARGETARCH" = "amd64" ]; then \

PYPY_URL="https://github.com/BarrensZeppelin/alpine-pypy/releases/download/alp3.24.2-pypy3.12-8.0.1/pypy3.12-v8.0.1-linux64-alpine3.24.tar.gz" && \

PYPY_SHA256="b6d5dd429c6394f1710a52e3e20d5c9198547caff9528547c457d3f2ed37db09" && \

curl -L -o /tmp/pypy.tar.gz "$PYPY_URL" && \

echo "$PYPY_SHA256 /tmp/pypy.tar.gz" | sha256sum -c - && \

mkdir -p /opt/pypy && \

tar -xz --strip-components=1 -C /opt/pypy -f /tmp/pypy.tar.gz && \

rm /tmp/pypy.tar.gz && \

ln -s /opt/pypy/bin/pypy3 /bin/pypy3 && \

pypy3 --version; \

# Install additional tools

RUN npm install socket -g && \

gem install bundler && \

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \

. ~/.cargo/env && \

rustup component add rustfmt clippy

# Set environment paths

ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"

ENV GOPATH="/go"

# Install uv (0.13.4+ ships the patched webpki-roots)

COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv

# Install pyenv

# pyenv lets us build/install arbitrary Python versions on demand. We install

# the build dependencies needed to compile CPython on Alpine, then install

# pyenv itself. We deliberately only symlink the `pyenv` binary onto the PATH

# and do NOT add pyenv's shims directory, so its shims don't shadow the system

# Python that the CLI runs on.

RUN apk add --no-cache \

bash \

bzip2-dev \

ca-certificates \

libffi-dev \

libxslt-dev \

linux-headers \

ncurses-dev \

openssl-dev \

readline-dev \

sqlite-dev \

xz-dev \

zlib-dev

RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | PYENV_GIT_TAG="v2.7.1" bash && \

ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \

pyenv --version

# Install Python dependencies from the lockfile with hash verification so the

# image never resolves loose versions from PyPI at build time.

COPY pyproject.toml uv.lock /tmp/socket-cli-lock/

# Index flags are passed explicitly (always production PyPI) so the

# PIP_INDEX_URL/PIP_EXTRA_INDEX_URL ARGs used to point CLI/SDK preview installs

# at TestPyPI don't leak into the locked dependency install via pip's env vars.

RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-project \

--format requirements-txt -o /tmp/socket-cli-lock/requirements.txt && \

pip install --require-hashes --no-deps \

--index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \

-r /tmp/socket-cli-lock/requirements.txt

# Install CLI based on build mode

RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \

echo "Using local development install"; \

else \

cli_installed=false; \

for i in $(seq 1 10); do \

echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \

if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \

cli_installed=true; \

break; \

fi; \

if [ "$i" -lt 10 ]; then \

echo "Install failed, waiting 30s before retry..."; \

sleep 30; \

fi; \

done; \

if [ "$cli_installed" != "true" ]; then \

echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \

exit 1; \

fi; \

pip check || exit 1; \

if [ ! -z "$SDK_VERSION" ]; then \

pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \

fi; \

# Copy local source and install in editable mode if USE_LOCAL_INSTALL is true

COPY . /app

WORKDIR /app

RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \

pip install --no-deps -e . && pip check; \

# Create workspace directory with proper permissions

RUN mkdir -p /go/src && chmod -R 777 /go

# Copy and setup entrypoint script

COPY scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

RUN chmod +x /usr/local/bin/docker-entrypoint.sh

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]