Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit e0fb336

Browse files
jjlinjjlin
committedJan 25, 2023
Allow listening on privileged ports (below 1024) as non-root
This is done by running `setcap cap_net_bind_service=+ep` on the executable in the build phase (doing it in the runtime phase creates an extra copy of the executable that bloats the image). This only works when using the BuildKit-based builder, since the `COPY` instruction doesn't copy capabilities on the legacy builder.
1 parent 686474f commit e0fb336

17 files changed

+184
-156
lines changed
 

‎docker/Dockerfile.j2

+30-20
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,6 @@ FROM vaultwarden/web-vault@{{ vault_image_digest }} as vault
8383
########################## BUILD IMAGE ##########################
8484
FROM {{ build_stage_base_image }} as build
8585

86-
87-
8886
# Build time options to avoid dpkg warnings and help with reproducible builds.
8987
ENV DEBIAN_FRONTEND=noninteractive \
9088
LANG=C.UTF-8 \
@@ -93,31 +91,33 @@ ENV DEBIAN_FRONTEND=noninteractive \
9391
CARGO_HOME="/root/.cargo" \
9492
USER="root"
9593

96-
9794
# Create CARGO_HOME folder and don't download rust docs
9895
RUN {{ mount_rust_cache -}} mkdir -pv "${CARGO_HOME}" \
9996
&& rustup set profile minimal
10097

10198
{% if "alpine" in target_file %}
99+
# Install build dependencies
100+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
102101
{% if "armv6" in target_file %}
102+
103103
# To be able to build the armv6 image with mimalloc we need to specifically specify the libatomic.a file location
104104
ENV RUSTFLAGS='-Clink-arg=/usr/local/musl/{{ package_arch_target }}/lib/libatomic.a'
105105
{% endif %}
106106
{% elif "arm" in target_file %}
107-
#
108-
# Install required build libs for {{ package_arch_name }} architecture.
107+
# Install build dependencies for the {{ package_arch_name }} architecture
109108
RUN dpkg --add-architecture {{ package_arch_name }} \
110109
&& apt-get update \
111110
&& apt-get install -y \
112111
--no-install-recommends \
113-
libssl-dev{{ package_arch_prefix }} \
112+
gcc-{{ package_cross_compiler }} \
114113
libc6-dev{{ package_arch_prefix }} \
115-
libpq5{{ package_arch_prefix }} \
116-
libpq-dev{{ package_arch_prefix }} \
117-
libmariadb3{{ package_arch_prefix }} \
114+
libcap2-bin \
118115
libmariadb-dev{{ package_arch_prefix }} \
119116
libmariadb-dev-compat{{ package_arch_prefix }} \
120-
gcc-{{ package_cross_compiler }} \
117+
libmariadb3{{ package_arch_prefix }} \
118+
libpq-dev{{ package_arch_prefix }} \
119+
libpq5{{ package_arch_prefix }} \
120+
libssl-dev{{ package_arch_prefix }} \
121121
#
122122
# Make sure cargo has the right target config
123123
&& echo '[target.{{ package_arch_target }}]' >> "${CARGO_HOME}/config" \
@@ -129,16 +129,14 @@ ENV CC_{{ package_arch_target | replace("-", "_") }}="/usr/bin/{{ package_cross_
129129
CROSS_COMPILE="1" \
130130
OPENSSL_INCLUDE_DIR="/usr/include/{{ package_cross_compiler }}" \
131131
OPENSSL_LIB_DIR="/usr/lib/{{ package_cross_compiler }}"
132-
133132
{% elif "amd64" in target_file %}
134-
# Install DB packages
133+
# Install build dependencies
135134
RUN apt-get update \
136135
&& apt-get install -y \
137136
--no-install-recommends \
138-
libmariadb-dev{{ package_arch_prefix }} \
139-
libpq-dev{{ package_arch_prefix }} \
140-
&& apt-get clean \
141-
&& rm -rf /var/lib/apt/lists/*
137+
libcap2-bin \
138+
libmariadb-dev \
139+
libpq-dev
142140
{% endif %}
143141

144142
# Creates a dummy project used to grab dependencies
@@ -179,6 +177,18 @@ RUN touch src/main.rs
179177
# your actual source files being built
180178
RUN {{ mount_rust_cache -}} cargo build --features ${DB} --release{{ package_arch_target_param }}
181179

180+
{% if "buildkit" in target_file %}
181+
# Add the `cap_net_bind_service` capability to allow listening on
182+
# privileged (< 1024) ports even when running as a non-root user.
183+
# This is only done if building with BuildKit; with the legacy
184+
# builder, the `COPY` instruction doesn't carry over capabilities.
185+
{% if package_arch_target is defined %}
186+
RUN setcap cap_net_bind_service=+ep target/{{ package_arch_target }}/release/vaultwarden
187+
{% else %}
188+
RUN setcap cap_net_bind_service=+ep target/release/vaultwarden
189+
{% endif %}
190+
{% endif %}
191+
182192
######################## RUNTIME IMAGE ########################
183193
# Create a new stage with a minimal image
184194
# because we already have a binary built
@@ -200,18 +210,18 @@ RUN [ "cross-build-start" ]
200210
RUN mkdir /data \
201211
{% if "alpine" in runtime_stage_base_image %}
202212
&& apk add --no-cache \
203-
openssl \
204-
tzdata \
213+
ca-certificates \
205214
curl \
206-
ca-certificates
215+
openssl \
216+
tzdata
207217
{% else %}
208218
&& apt-get update && apt-get install -y \
209219
--no-install-recommends \
210-
openssl \
211220
ca-certificates \
212221
curl \
213222
libmariadb-dev-compat \
214223
libpq5 \
224+
openssl \
215225
&& apt-get clean \
216226
&& rm -rf /var/lib/apt/lists/*
217227
{% endif %}

‎docker/amd64/Dockerfile

+5-8
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,19 +37,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
# Install DB packages
44+
# Install build dependencies
4845
RUN apt-get update \
4946
&& apt-get install -y \
5047
--no-install-recommends \
48+
libcap2-bin \
5149
libmariadb-dev \
52-
libpq-dev \
53-
&& apt-get clean \
54-
&& rm -rf /var/lib/apt/lists/*
50+
libpq-dev
5551

5652
# Creates a dummy project used to grab dependencies
5753
RUN USER=root cargo new --bin /app
@@ -83,6 +79,7 @@ RUN touch src/main.rs
8379
# your actual source files being built
8480
RUN cargo build --features ${DB} --release
8581

82+
8683
######################## RUNTIME IMAGE ########################
8784
# Create a new stage with a minimal image
8885
# because we already have a binary built
@@ -97,11 +94,11 @@ ENV ROCKET_PROFILE="release" \
9794
RUN mkdir /data \
9895
&& apt-get update && apt-get install -y \
9996
--no-install-recommends \
100-
openssl \
10197
ca-certificates \
10298
curl \
10399
libmariadb-dev-compat \
104100
libpq5 \
101+
openssl \
105102
&& apt-get clean \
106103
&& rm -rf /var/lib/apt/lists/*
107104

‎docker/amd64/Dockerfile.alpine

+6-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:x86_64-musl-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,7 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN cargo build --features ${DB} --release --target=x86_64-unknown-linux-musl
7978

79+
8080
######################## RUNTIME IMAGE ########################
8181
# Create a new stage with a minimal image
8282
# because we already have a binary built
@@ -92,10 +92,10 @@ ENV ROCKET_PROFILE="release" \
9292
# Create data folder and Install needed libraries
9393
RUN mkdir /data \
9494
&& apk add --no-cache \
95-
openssl \
96-
tzdata \
95+
ca-certificates \
9796
curl \
98-
ca-certificates
97+
openssl \
98+
tzdata
9999

100100

101101
VOLUME /data

‎docker/amd64/Dockerfile.buildkit

+10-8
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,19 +37,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
# Install DB packages
44+
# Install build dependencies
4845
RUN apt-get update \
4946
&& apt-get install -y \
5047
--no-install-recommends \
48+
libcap2-bin \
5149
libmariadb-dev \
52-
libpq-dev \
53-
&& apt-get clean \
54-
&& rm -rf /var/lib/apt/lists/*
50+
libpq-dev
5551

5652
# Creates a dummy project used to grab dependencies
5753
RUN USER=root cargo new --bin /app
@@ -83,6 +79,12 @@ RUN touch src/main.rs
8379
# your actual source files being built
8480
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release
8581

82+
# Add the `cap_net_bind_service` capability to allow listening on
83+
# privileged (< 1024) ports even when running as a non-root user.
84+
# This is only done if building with BuildKit; with the legacy
85+
# builder, the `COPY` instruction doesn't carry over capabilities.
86+
RUN setcap cap_net_bind_service=+ep target/release/vaultwarden
87+
8688
######################## RUNTIME IMAGE ########################
8789
# Create a new stage with a minimal image
8890
# because we already have a binary built
@@ -97,11 +99,11 @@ ENV ROCKET_PROFILE="release" \
9799
RUN mkdir /data \
98100
&& apt-get update && apt-get install -y \
99101
--no-install-recommends \
100-
openssl \
101102
ca-certificates \
102103
curl \
103104
libmariadb-dev-compat \
104105
libpq5 \
106+
openssl \
105107
&& apt-get clean \
106108
&& rm -rf /var/lib/apt/lists/*
107109

‎docker/amd64/Dockerfile.buildkit.alpine

+11-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:x86_64-musl-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,12 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=x86_64-unknown-linux-musl
7978

79+
# Add the `cap_net_bind_service` capability to allow listening on
80+
# privileged (< 1024) ports even when running as a non-root user.
81+
# This is only done if building with BuildKit; with the legacy
82+
# builder, the `COPY` instruction doesn't carry over capabilities.
83+
RUN setcap cap_net_bind_service=+ep target/x86_64-unknown-linux-musl/release/vaultwarden
84+
8085
######################## RUNTIME IMAGE ########################
8186
# Create a new stage with a minimal image
8287
# because we already have a binary built
@@ -92,10 +97,10 @@ ENV ROCKET_PROFILE="release" \
9297
# Create data folder and Install needed libraries
9398
RUN mkdir /data \
9499
&& apk add --no-cache \
95-
openssl \
96-
tzdata \
100+
ca-certificates \
97101
curl \
98-
ca-certificates
102+
openssl \
103+
tzdata
99104

100105

101106
VOLUME /data

‎docker/arm64/Dockerfile

+9-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for arm64 architecture.
44+
# Install build dependencies for the arm64 architecture
4945
RUN dpkg --add-architecture arm64 \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:arm64 \
49+
gcc-aarch64-linux-gnu \
5450
libc6-dev:arm64 \
55-
libpq5:arm64 \
56-
libpq-dev:arm64 \
57-
libmariadb3:arm64 \
51+
libcap2-bin \
5852
libmariadb-dev:arm64 \
5953
libmariadb-dev-compat:arm64 \
60-
gcc-aarch64-linux-gnu \
54+
libmariadb3:arm64 \
55+
libpq-dev:arm64 \
56+
libpq5:arm64 \
57+
libssl-dev:arm64 \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.aarch64-unknown-linux-gnu]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_aarch64_unknown_linux_gnu="/usr/bin/aarch64-linux-gnu-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/aarch64-linux-gnu" \
7168
OPENSSL_LIB_DIR="/usr/lib/aarch64-linux-gnu"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,7 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN cargo build --features ${DB} --release --target=aarch64-unknown-linux-gnu
104100

101+
105102
######################## RUNTIME IMAGE ########################
106103
# Create a new stage with a minimal image
107104
# because we already have a binary built
@@ -117,11 +114,11 @@ RUN [ "cross-build-start" ]
117114
RUN mkdir /data \
118115
&& apt-get update && apt-get install -y \
119116
--no-install-recommends \
120-
openssl \
121117
ca-certificates \
122118
curl \
123119
libmariadb-dev-compat \
124120
libpq5 \
121+
openssl \
125122
&& apt-get clean \
126123
&& rm -rf /var/lib/apt/lists/*
127124

‎docker/arm64/Dockerfile.alpine

+6-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:aarch64-musl-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,7 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN cargo build --features ${DB} --release --target=aarch64-unknown-linux-musl
7978

79+
8080
######################## RUNTIME IMAGE ########################
8181
# Create a new stage with a minimal image
8282
# because we already have a binary built
@@ -93,10 +93,10 @@ RUN [ "cross-build-start" ]
9393
# Create data folder and Install needed libraries
9494
RUN mkdir /data \
9595
&& apk add --no-cache \
96-
openssl \
97-
tzdata \
96+
ca-certificates \
9897
curl \
99-
ca-certificates
98+
openssl \
99+
tzdata
100100

101101
RUN [ "cross-build-end" ]
102102

‎docker/arm64/Dockerfile.buildkit

+14-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for arm64 architecture.
44+
# Install build dependencies for the arm64 architecture
4945
RUN dpkg --add-architecture arm64 \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:arm64 \
49+
gcc-aarch64-linux-gnu \
5450
libc6-dev:arm64 \
55-
libpq5:arm64 \
56-
libpq-dev:arm64 \
57-
libmariadb3:arm64 \
51+
libcap2-bin \
5852
libmariadb-dev:arm64 \
5953
libmariadb-dev-compat:arm64 \
60-
gcc-aarch64-linux-gnu \
54+
libmariadb3:arm64 \
55+
libpq-dev:arm64 \
56+
libpq5:arm64 \
57+
libssl-dev:arm64 \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.aarch64-unknown-linux-gnu]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_aarch64_unknown_linux_gnu="/usr/bin/aarch64-linux-gnu-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/aarch64-linux-gnu" \
7168
OPENSSL_LIB_DIR="/usr/lib/aarch64-linux-gnu"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,12 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=aarch64-unknown-linux-gnu
104100

101+
# Add the `cap_net_bind_service` capability to allow listening on
102+
# privileged (< 1024) ports even when running as a non-root user.
103+
# This is only done if building with BuildKit; with the legacy
104+
# builder, the `COPY` instruction doesn't carry over capabilities.
105+
RUN setcap cap_net_bind_service=+ep target/aarch64-unknown-linux-gnu/release/vaultwarden
106+
105107
######################## RUNTIME IMAGE ########################
106108
# Create a new stage with a minimal image
107109
# because we already have a binary built
@@ -117,11 +119,11 @@ RUN [ "cross-build-start" ]
117119
RUN mkdir /data \
118120
&& apt-get update && apt-get install -y \
119121
--no-install-recommends \
120-
openssl \
121122
ca-certificates \
122123
curl \
123124
libmariadb-dev-compat \
124125
libpq5 \
126+
openssl \
125127
&& apt-get clean \
126128
&& rm -rf /var/lib/apt/lists/*
127129

‎docker/arm64/Dockerfile.buildkit.alpine

+11-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:aarch64-musl-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,12 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=aarch64-unknown-linux-musl
7978

79+
# Add the `cap_net_bind_service` capability to allow listening on
80+
# privileged (< 1024) ports even when running as a non-root user.
81+
# This is only done if building with BuildKit; with the legacy
82+
# builder, the `COPY` instruction doesn't carry over capabilities.
83+
RUN setcap cap_net_bind_service=+ep target/aarch64-unknown-linux-musl/release/vaultwarden
84+
8085
######################## RUNTIME IMAGE ########################
8186
# Create a new stage with a minimal image
8287
# because we already have a binary built
@@ -93,10 +98,10 @@ RUN [ "cross-build-start" ]
9398
# Create data folder and Install needed libraries
9499
RUN mkdir /data \
95100
&& apk add --no-cache \
96-
openssl \
97-
tzdata \
101+
ca-certificates \
98102
curl \
99-
ca-certificates
103+
openssl \
104+
tzdata
100105

101106
RUN [ "cross-build-end" ]
102107

‎docker/armv6/Dockerfile

+9-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for armel architecture.
44+
# Install build dependencies for the armel architecture
4945
RUN dpkg --add-architecture armel \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:armel \
49+
gcc-arm-linux-gnueabi \
5450
libc6-dev:armel \
55-
libpq5:armel \
56-
libpq-dev:armel \
57-
libmariadb3:armel \
51+
libcap2-bin \
5852
libmariadb-dev:armel \
5953
libmariadb-dev-compat:armel \
60-
gcc-arm-linux-gnueabi \
54+
libmariadb3:armel \
55+
libpq-dev:armel \
56+
libpq5:armel \
57+
libssl-dev:armel \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.arm-unknown-linux-gnueabi]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_arm_unknown_linux_gnueabi="/usr/bin/arm-linux-gnueabi-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/arm-linux-gnueabi" \
7168
OPENSSL_LIB_DIR="/usr/lib/arm-linux-gnueabi"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,7 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN cargo build --features ${DB} --release --target=arm-unknown-linux-gnueabi
104100

101+
105102
######################## RUNTIME IMAGE ########################
106103
# Create a new stage with a minimal image
107104
# because we already have a binary built
@@ -117,11 +114,11 @@ RUN [ "cross-build-start" ]
117114
RUN mkdir /data \
118115
&& apt-get update && apt-get install -y \
119116
--no-install-recommends \
120-
openssl \
121117
ca-certificates \
122118
curl \
123119
libmariadb-dev-compat \
124120
libpq5 \
121+
openssl \
125122
&& apt-get clean \
126123
&& rm -rf /var/lib/apt/lists/*
127124

‎docker/armv6/Dockerfile.alpine

+7-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:arm-musleabi-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,13 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
46+
4747
# To be able to build the armv6 image with mimalloc we need to specifically specify the libatomic.a file location
4848
ENV RUSTFLAGS='-Clink-arg=/usr/local/musl/arm-unknown-linux-musleabi/lib/libatomic.a'
4949

@@ -79,6 +79,7 @@ RUN touch src/main.rs
7979
# your actual source files being built
8080
RUN cargo build --features ${DB} --release --target=arm-unknown-linux-musleabi
8181

82+
8283
######################## RUNTIME IMAGE ########################
8384
# Create a new stage with a minimal image
8485
# because we already have a binary built
@@ -95,10 +96,10 @@ RUN [ "cross-build-start" ]
9596
# Create data folder and Install needed libraries
9697
RUN mkdir /data \
9798
&& apk add --no-cache \
98-
openssl \
99-
tzdata \
99+
ca-certificates \
100100
curl \
101-
ca-certificates
101+
openssl \
102+
tzdata
102103

103104
RUN [ "cross-build-end" ]
104105

‎docker/armv6/Dockerfile.buildkit

+14-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for armel architecture.
44+
# Install build dependencies for the armel architecture
4945
RUN dpkg --add-architecture armel \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:armel \
49+
gcc-arm-linux-gnueabi \
5450
libc6-dev:armel \
55-
libpq5:armel \
56-
libpq-dev:armel \
57-
libmariadb3:armel \
51+
libcap2-bin \
5852
libmariadb-dev:armel \
5953
libmariadb-dev-compat:armel \
60-
gcc-arm-linux-gnueabi \
54+
libmariadb3:armel \
55+
libpq-dev:armel \
56+
libpq5:armel \
57+
libssl-dev:armel \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.arm-unknown-linux-gnueabi]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_arm_unknown_linux_gnueabi="/usr/bin/arm-linux-gnueabi-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/arm-linux-gnueabi" \
7168
OPENSSL_LIB_DIR="/usr/lib/arm-linux-gnueabi"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,12 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=arm-unknown-linux-gnueabi
104100

101+
# Add the `cap_net_bind_service` capability to allow listening on
102+
# privileged (< 1024) ports even when running as a non-root user.
103+
# This is only done if building with BuildKit; with the legacy
104+
# builder, the `COPY` instruction doesn't carry over capabilities.
105+
RUN setcap cap_net_bind_service=+ep target/arm-unknown-linux-gnueabi/release/vaultwarden
106+
105107
######################## RUNTIME IMAGE ########################
106108
# Create a new stage with a minimal image
107109
# because we already have a binary built
@@ -117,11 +119,11 @@ RUN [ "cross-build-start" ]
117119
RUN mkdir /data \
118120
&& apt-get update && apt-get install -y \
119121
--no-install-recommends \
120-
openssl \
121122
ca-certificates \
122123
curl \
123124
libmariadb-dev-compat \
124125
libpq5 \
126+
openssl \
125127
&& apt-get clean \
126128
&& rm -rf /var/lib/apt/lists/*
127129

‎docker/armv6/Dockerfile.buildkit.alpine

+12-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:arm-musleabi-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,13 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
46+
4747
# To be able to build the armv6 image with mimalloc we need to specifically specify the libatomic.a file location
4848
ENV RUSTFLAGS='-Clink-arg=/usr/local/musl/arm-unknown-linux-musleabi/lib/libatomic.a'
4949

@@ -79,6 +79,12 @@ RUN touch src/main.rs
7979
# your actual source files being built
8080
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=arm-unknown-linux-musleabi
8181

82+
# Add the `cap_net_bind_service` capability to allow listening on
83+
# privileged (< 1024) ports even when running as a non-root user.
84+
# This is only done if building with BuildKit; with the legacy
85+
# builder, the `COPY` instruction doesn't carry over capabilities.
86+
RUN setcap cap_net_bind_service=+ep target/arm-unknown-linux-musleabi/release/vaultwarden
87+
8288
######################## RUNTIME IMAGE ########################
8389
# Create a new stage with a minimal image
8490
# because we already have a binary built
@@ -95,10 +101,10 @@ RUN [ "cross-build-start" ]
95101
# Create data folder and Install needed libraries
96102
RUN mkdir /data \
97103
&& apk add --no-cache \
98-
openssl \
99-
tzdata \
104+
ca-certificates \
100105
curl \
101-
ca-certificates
106+
openssl \
107+
tzdata
102108

103109
RUN [ "cross-build-end" ]
104110

‎docker/armv7/Dockerfile

+9-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for armhf architecture.
44+
# Install build dependencies for the armhf architecture
4945
RUN dpkg --add-architecture armhf \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:armhf \
49+
gcc-arm-linux-gnueabihf \
5450
libc6-dev:armhf \
55-
libpq5:armhf \
56-
libpq-dev:armhf \
57-
libmariadb3:armhf \
51+
libcap2-bin \
5852
libmariadb-dev:armhf \
5953
libmariadb-dev-compat:armhf \
60-
gcc-arm-linux-gnueabihf \
54+
libmariadb3:armhf \
55+
libpq-dev:armhf \
56+
libpq5:armhf \
57+
libssl-dev:armhf \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.armv7-unknown-linux-gnueabihf]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_armv7_unknown_linux_gnueabihf="/usr/bin/arm-linux-gnueabihf-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/arm-linux-gnueabihf" \
7168
OPENSSL_LIB_DIR="/usr/lib/arm-linux-gnueabihf"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,7 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN cargo build --features ${DB} --release --target=armv7-unknown-linux-gnueabihf
104100

101+
105102
######################## RUNTIME IMAGE ########################
106103
# Create a new stage with a minimal image
107104
# because we already have a binary built
@@ -117,11 +114,11 @@ RUN [ "cross-build-start" ]
117114
RUN mkdir /data \
118115
&& apt-get update && apt-get install -y \
119116
--no-install-recommends \
120-
openssl \
121117
ca-certificates \
122118
curl \
123119
libmariadb-dev-compat \
124120
libpq5 \
121+
openssl \
125122
&& apt-get clean \
126123
&& rm -rf /var/lib/apt/lists/*
127124

‎docker/armv7/Dockerfile.alpine

+6-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:armv7-musleabihf-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,7 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN cargo build --features ${DB} --release --target=armv7-unknown-linux-musleabihf
7978

79+
8080
######################## RUNTIME IMAGE ########################
8181
# Create a new stage with a minimal image
8282
# because we already have a binary built
@@ -93,10 +93,10 @@ RUN [ "cross-build-start" ]
9393
# Create data folder and Install needed libraries
9494
RUN mkdir /data \
9595
&& apk add --no-cache \
96-
openssl \
97-
tzdata \
96+
ca-certificates \
9897
curl \
99-
ca-certificates
98+
openssl \
99+
tzdata
100100

101101
RUN [ "cross-build-end" ]
102102

‎docker/armv7/Dockerfile.buildkit

+14-12
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM rust:1.66-bullseye as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,25 +37,24 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

47-
#
48-
# Install required build libs for armhf architecture.
44+
# Install build dependencies for the armhf architecture
4945
RUN dpkg --add-architecture armhf \
5046
&& apt-get update \
5147
&& apt-get install -y \
5248
--no-install-recommends \
53-
libssl-dev:armhf \
49+
gcc-arm-linux-gnueabihf \
5450
libc6-dev:armhf \
55-
libpq5:armhf \
56-
libpq-dev:armhf \
57-
libmariadb3:armhf \
51+
libcap2-bin \
5852
libmariadb-dev:armhf \
5953
libmariadb-dev-compat:armhf \
60-
gcc-arm-linux-gnueabihf \
54+
libmariadb3:armhf \
55+
libpq-dev:armhf \
56+
libpq5:armhf \
57+
libssl-dev:armhf \
6158
#
6259
# Make sure cargo has the right target config
6360
&& echo '[target.armv7-unknown-linux-gnueabihf]' >> "${CARGO_HOME}/config" \
@@ -70,7 +67,6 @@ ENV CC_armv7_unknown_linux_gnueabihf="/usr/bin/arm-linux-gnueabihf-gcc" \
7067
OPENSSL_INCLUDE_DIR="/usr/include/arm-linux-gnueabihf" \
7168
OPENSSL_LIB_DIR="/usr/lib/arm-linux-gnueabihf"
7269

73-
7470
# Creates a dummy project used to grab dependencies
7571
RUN USER=root cargo new --bin /app
7672
WORKDIR /app
@@ -102,6 +98,12 @@ RUN touch src/main.rs
10298
# your actual source files being built
10399
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=armv7-unknown-linux-gnueabihf
104100

101+
# Add the `cap_net_bind_service` capability to allow listening on
102+
# privileged (< 1024) ports even when running as a non-root user.
103+
# This is only done if building with BuildKit; with the legacy
104+
# builder, the `COPY` instruction doesn't carry over capabilities.
105+
RUN setcap cap_net_bind_service=+ep target/armv7-unknown-linux-gnueabihf/release/vaultwarden
106+
105107
######################## RUNTIME IMAGE ########################
106108
# Create a new stage with a minimal image
107109
# because we already have a binary built
@@ -117,11 +119,11 @@ RUN [ "cross-build-start" ]
117119
RUN mkdir /data \
118120
&& apt-get update && apt-get install -y \
119121
--no-install-recommends \
120-
openssl \
121122
ca-certificates \
122123
curl \
123124
libmariadb-dev-compat \
124125
libpq5 \
126+
openssl \
125127
&& apt-get clean \
126128
&& rm -rf /var/lib/apt/lists/*
127129

‎docker/armv7/Dockerfile.buildkit.alpine

+11-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ FROM vaultwarden/web-vault@sha256:d5f71fb05c4b87935bf51d84140db0f8716cabfe2974fb
2929
########################## BUILD IMAGE ##########################
3030
FROM blackdex/rust-musl:armv7-musleabihf-stable-1.66.1 as build
3131

32-
33-
3432
# Build time options to avoid dpkg warnings and help with reproducible builds.
3533
ENV DEBIAN_FRONTEND=noninteractive \
3634
LANG=C.UTF-8 \
@@ -39,11 +37,12 @@ ENV DEBIAN_FRONTEND=noninteractive \
3937
CARGO_HOME="/root/.cargo" \
4038
USER="root"
4139

42-
4340
# Create CARGO_HOME folder and don't download rust docs
4441
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry mkdir -pv "${CARGO_HOME}" \
4542
&& rustup set profile minimal
4643

44+
# Install build dependencies
45+
RUN apt-get update && apt-get install -y --no-install-recommends libcap2-bin
4746

4847
# Creates a dummy project used to grab dependencies
4948
RUN USER=root cargo new --bin /app
@@ -77,6 +76,12 @@ RUN touch src/main.rs
7776
# your actual source files being built
7877
RUN --mount=type=cache,target=/root/.cargo/git --mount=type=cache,target=/root/.cargo/registry cargo build --features ${DB} --release --target=armv7-unknown-linux-musleabihf
7978

79+
# Add the `cap_net_bind_service` capability to allow listening on
80+
# privileged (< 1024) ports even when running as a non-root user.
81+
# This is only done if building with BuildKit; with the legacy
82+
# builder, the `COPY` instruction doesn't carry over capabilities.
83+
RUN setcap cap_net_bind_service=+ep target/armv7-unknown-linux-musleabihf/release/vaultwarden
84+
8085
######################## RUNTIME IMAGE ########################
8186
# Create a new stage with a minimal image
8287
# because we already have a binary built
@@ -93,10 +98,10 @@ RUN [ "cross-build-start" ]
9398
# Create data folder and Install needed libraries
9499
RUN mkdir /data \
95100
&& apk add --no-cache \
96-
openssl \
97-
tzdata \
101+
ca-certificates \
98102
curl \
99-
ca-certificates
103+
openssl \
104+
tzdata
100105

101106
RUN [ "cross-build-end" ]
102107

0 commit comments

Comments
 (0)
Please sign in to comment.