Docker on widerin

Gitlab Security Products with Java and Gradle

Sun, 08 Mar 2020 00:00:00 +0000

GitLab security products have been constantly improving support for different build tools and programming languages.

My recent contribution to License compliance allows now to inject commands SETUP_CMD environment variable to the core to bypass the package manager auto-detection and make use of the ./gradlew Gradle wrapper script.

For example:

include:
- template: Security/License-Scanning.gitlab-ci.yml
variables:
SETUP_CMD: sh my-custom-install-script.sh

In this example, my-custom-install-script.sh is a shell script at the root directory of your project.

Gitlab License Management with Java 11

Fri, 21 Dec 2018 00:00:00 +0000

If built-in License Management functionality does not support the programming language requirements you have, you can customize the License Management docker image.

This guide shows you how to use License Management with OpenJDK 11 or later.

License Management definition

License Management helps you find what licenses your project uses in its dependencies and decide for each of then whether to allow it or forbid it.

License Compliance report under pipelines

GitLab SAST and Java 11

Wed, 19 Dec 2018 00:00:00 +0000

If built-in Static Application Security Testing functionality does not support the programming language requirements you have, you can customize the analyzer docker images in [GitLab]’s sast pipeline job.

This guide shows you how to use SAST with OpenJDK 11 or later.

SAST definition

Static Application Security Testing provides you information if

your application is vulnerable by using an external library in a specific version which is known to be vulnerable or
your code has a potentially dangerous attribute in a class, or unsafe code that can lead to unintended code execution.

Project Security Dashboard

Official Grafana docker image on OpenShift 3.x

Sun, 10 Sep 2017 00:00:00 +0000

Running offical docker images from Docker hub on OpenShift can be painful as it uses arbitrary user ids by default. Often you end up building your own or using 3rd party forks/clones of the offical image, which leds to additional effort to keep it up to date in terms of security and/or version upgrades.

Background

Technically speaking, [OpenShift] generates a dynamic uid to launch a container which will not have an associated entry in the containers /etc/passwd file. At docker image build time this user does not exist so chown files and/or directories to this uid is not possible.

Grafana’s docker image

gosu

Grafana runs its service as grafana user and uses an entrypoint script which runs as root and launches grafana-server as grafana user by using gosu, see run.sh on github.com

Continuous integration with GitLab and Docker

Tue, 11 Oct 2016 00:00:00 +0000

I’ve given a talk about continuous integration with GitLab and Docker on Developer Meetup VlbgWebDev. The Meetup takes place every second Tuesday every Month and i’ve met some old colleagues there.

It was a nice Meetup with lots of discussions, that’s why i published my sample code to GitLab and my slides to Speakerdeck. First intention was to do some Pyramid demo but after I’ve heard there are some Flask people, I’ve added Flask demos as well :-)

Change umask in Docker containers

Mon, 25 Jan 2016 00:00:00 +0000

Problem

You’re mounting volumes into Docker containers and running into permission issues while accessing volume from other Docker containers.

Docker installation required

Docker must be installed on your system.

$ docker version
Client: Docker Engine - Community
 Version: 19.03.5
 API version: 1.40
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:22:34 2019
 OS/Arch: darwin/amd64
 Experimental: false

Server: Docker Engine - Community
 Engine:
 Version: 19.03.5
 API version: 1.40 (minimum version 1.12)
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:29:19 2019
 OS/Arch: linux/amd64
 Experimental: false
 containerd:
 Version: v1.2.10
 GitCommit: b34a5c8af56e510852c35414db4c1f4fa6172339
 runc:
 Version: 1.0.0-rc8+dev
 GitCommit: 3e425f80a8c931f88e6d94a8c831b9d5aa481657
 docker-init:
 Version: 0.18.0
 GitCommit: fec3683

umask

umask is set to 0022 on most linux sytems by default. This umask allows group and others to read but not write your files, see below:

Connect devpi to your docker container

Thu, 07 Jan 2016 00:00:00 +0000

You’re running pip install, buildout or your automated tests within a docker container and after running it multiple times you’ve become tired of waiting for it to finally complete? Then it’s time to connect a devpi server.

Docker installation required

Docker must be installed on your system.

$ docker version
Client: Docker Engine - Community
 Version: 19.03.5
 API version: 1.40
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:22:34 2019
 OS/Arch: darwin/amd64
 Experimental: false

Server: Docker Engine - Community
 Engine:
 Version: 19.03.5
 API version: 1.40 (minimum version 1.12)
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:29:19 2019
 OS/Arch: linux/amd64
 Experimental: false
 containerd:
 Version: v1.2.10
 GitCommit: b34a5c8af56e510852c35414db4c1f4fa6172339
 runc:
 Version: 1.0.0-rc8+dev
 GitCommit: 3e425f80a8c931f88e6d94a8c831b9d5aa481657
 docker-init:
 Version: 0.18.0
 GitCommit: fec3683

You’ll need a working directory where docker-compose.yml file and certificates are stored in, so please create a folder my-devpi as shown below:

Private docker-registry within docker

Thu, 07 Jan 2016 00:00:00 +0000

Sometimes you need your own docker-registry to just try out new things or to avoid downloading stuff again and again from the internet. I tried to build a docker-compose recipe to setup my own private registry.

Docker installation required

Docker must be installed on your system.

$ docker version
Client: Docker Engine - Community
 Version: 19.03.5
 API version: 1.40
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:22:34 2019
 OS/Arch: darwin/amd64
 Experimental: false

Server: Docker Engine - Community
 Engine:
 Version: 19.03.5
 API version: 1.40 (minimum version 1.12)
 Go version: go1.12.12
 Git commit: 633a0ea
 Built: Wed Nov 13 07:29:19 2019
 OS/Arch: linux/amd64
 Experimental: false
 containerd:
 Version: v1.2.10
 GitCommit: b34a5c8af56e510852c35414db4c1f4fa6172339
 runc:
 Version: 1.0.0-rc8+dev
 GitCommit: 3e425f80a8c931f88e6d94a8c831b9d5aa481657
 docker-init:
 Version: 0.18.0
 GitCommit: fec3683

You’ll need a working directory where docker-compose.yml file and certificates are stored in, so please create a folder my-registry as shown below:

Install Robot Framework RIDE through homebrew

Tue, 16 Oct 2012 00:00:00 +0000

Python, wxPython and robotframework RIDE on your macOS.

Update 2016, 23 Feb

Fixed wxPython installation so it works with most recent versions available today.

Update 2017, 03 Jul

Seems this installation method no longer works on >= MacOS Sierra. Please use a docker image and Ride in browser.

wxPython

Since wxPython is available on homebrew you don’t have to install the package provided on the wxPython website.

$ brew info wxpython
wxPython: stable 3.0.2.0 (bottled)
Python bindings for wxWidgets
https://www.wxwidgets.org/
/usr/local/Cellar/wxPython/3.0.2.0 (1,107 files, 38.2M)
Poured from bottle
From: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/wxpython.rb
==> Dependencies
Required: wxmac ✔
==> Options
--universal
$ brew install wxpython

This will take some time so be patient.