mirror of
https://github.com/falcosecurity/falco.git
synced 2025-09-13 13:32:50 +00:00
update(docker): upgrade Falco driver loader image
Signed-off-by: Luca Guerra <luca@guerra.sh>
This commit is contained in:
Luca Guerra
poiana
@@ -1,4 +1,4 @@
|
|||||||
FROM debian:buster
|
FROM debian:bookworm
|
||||||
|
|
||||||
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
LABEL maintainer="cncf-falco-dev@lists.cncf.io"
|
||||||
LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
|
LABEL org.opencontainers.image.source="https://github.com/falcosecurity/falco"
|
||||||
@@ -22,73 +22,36 @@ RUN apt-get update \
|
|||||||
bash-completion \
|
bash-completion \
|
||||||
bc \
|
bc \
|
||||||
bison \
|
bison \
|
||||||
clang-7 \
|
|
||||||
ca-certificates \
|
ca-certificates \
|
||||||
|
clang \
|
||||||
|
cpio \
|
||||||
curl \
|
curl \
|
||||||
dkms \
|
dkms \
|
||||||
|
dwarves \
|
||||||
flex \
|
flex \
|
||||||
gnupg2 \
|
|
||||||
gcc \
|
gcc \
|
||||||
|
gcc-11 \
|
||||||
|
gnupg2 \
|
||||||
|
gpg \
|
||||||
jq \
|
jq \
|
||||||
libc6-dev \
|
libc6-dev \
|
||||||
libelf-dev \
|
libelf-dev \
|
||||||
|
libiberty-dev \
|
||||||
|
libncurses-dev \
|
||||||
|
libpci-dev \
|
||||||
libssl-dev \
|
libssl-dev \
|
||||||
llvm-7 \
|
libudev-dev \
|
||||||
netcat \
|
llvm \
|
||||||
patchelf \
|
lsb-release \
|
||||||
|
netcat-openbsd \
|
||||||
|
openssl \
|
||||||
|
rpm2cpio \
|
||||||
|
software-properties-common \
|
||||||
|
wget \
|
||||||
xz-utils \
|
xz-utils \
|
||||||
|
zstd \
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
RUN if [ "$TARGETARCH" = "amd64" ]; \
|
|
||||||
then apt-get install -y --no-install-recommends libmpx2; \
|
|
||||||
fi
|
|
||||||
|
|
||||||
# gcc 6 is no longer included in debian stable, but we need it to
|
|
||||||
# build kernel modules on the default debian-based ami used by
|
|
||||||
# kops. So grab copies we've saved from debian snapshots with the
|
|
||||||
# prefix https://snapshot.debian.org/archive/debian/20170517T033514Z
|
|
||||||
# or so.
|
|
||||||
|
|
||||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libcilkrts5_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
|
||||||
curl -L -o cpp-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-6_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o gcc-6-base_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6-base_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o gcc-6_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-6_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libasan3_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan3_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libubsan0_6.3.0-18_${TARGETARCH}.deb https://download.falco.org/dependencies/libubsan0_6.3.0-18_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libmpfr4_3.1.3-2_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpfr4_3.1.3-2_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libisl15_0.18-1_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-1_${TARGETARCH}.deb \
|
|
||||||
&& dpkg -i cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb; \
|
|
||||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libcilkrts5_6.3.0-18_${TARGETARCH}.deb; fi; \
|
|
||||||
dpkg -i libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb \
|
|
||||||
&& rm -f cpp-6_6.3.0-18_${TARGETARCH}.deb gcc-6-base_6.3.0-18_${TARGETARCH}.deb gcc-6_6.3.0-18_${TARGETARCH}.deb libasan3_6.3.0-18_${TARGETARCH}.deb libcilkrts5_6.3.0-18_${TARGETARCH}.deb libgcc-6-dev_6.3.0-18_${TARGETARCH}.deb libubsan0_6.3.0-18_${TARGETARCH}.deb libmpfr4_3.1.3-2_${TARGETARCH}.deb libisl15_0.18-1_${TARGETARCH}.deb
|
|
||||||
|
|
||||||
# gcc 5 is no longer included in debian stable, but we need it to
|
|
||||||
# build centos kernels, which are 3.x based and explicitly want a gcc
|
|
||||||
# version 3, 4, or 5 compiler. So grab copies we've saved from debian
|
|
||||||
# snapshots with the prefix https://snapshot.debian.org/archive/debian/20190122T000000Z.
|
|
||||||
|
|
||||||
RUN if [ "$TARGETARCH" = "amd64" ]; then curl -L -o libmpx0_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
|
||||||
curl -L -o cpp-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/cpp-5_5.5.0-12_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o gcc-5-base_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5-base_5.5.0-12_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o gcc-5_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/gcc-5_5.5.0-12_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libasan2_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libasan2_5.5.0-12_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb https://download.falco.org/dependencies/libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libisl15_0.18-4_${TARGETARCH}.deb https://download.falco.org/dependencies/libisl15_0.18-4_${TARGETARCH}.deb \
|
|
||||||
&& dpkg -i cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb; \
|
|
||||||
if [ "$TARGETARCH" = "amd64" ]; then dpkg -i libmpx0_5.5.0-12_${TARGETARCH}.deb; fi; \
|
|
||||||
dpkg -i libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb \
|
|
||||||
&& rm -f cpp-5_5.5.0-12_${TARGETARCH}.deb gcc-5-base_5.5.0-12_${TARGETARCH}.deb gcc-5_5.5.0-12_${TARGETARCH}.deb libasan2_5.5.0-12_${TARGETARCH}.deb libgcc-5-dev_5.5.0-12_${TARGETARCH}.deb libisl15_0.18-4_${TARGETARCH}.deb libmpx0_5.5.0-12_${TARGETARCH}.deb
|
|
||||||
|
|
||||||
# Since our base Debian image ships with GCC 7 which breaks older kernels, revert the
|
|
||||||
# default to gcc-5.
|
|
||||||
RUN rm -rf /usr/bin/gcc && ln -s /usr/bin/gcc-5 /usr/bin/gcc
|
|
||||||
|
|
||||||
RUN rm -rf /usr/bin/clang \
|
|
||||||
&& rm -rf /usr/bin/llc \
|
|
||||||
&& ln -s /usr/bin/clang-7 /usr/bin/clang \
|
|
||||||
&& ln -s /usr/bin/llc-7 /usr/bin/llc
|
|
||||||
|
|
||||||
RUN curl -s https://falco.org/repo/falcosecurity-packages.asc | apt-key add - \
|
RUN curl -s https://falco.org/repo/falcosecurity-packages.asc | apt-key add - \
|
||||||
&& echo "deb https://download.falco.org/packages/${VERSION_BUCKET} stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list \
|
&& echo "deb https://download.falco.org/packages/${VERSION_BUCKET} stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list \
|
||||||
&& apt-get update -y \
|
&& apt-get update -y \
|
||||||
@@ -107,22 +70,6 @@ RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /etc/fa
|
|||||||
RUN rm -df /lib/modules \
|
RUN rm -df /lib/modules \
|
||||||
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
&& ln -s $HOST_ROOT/lib/modules /lib/modules
|
||||||
|
|
||||||
# debian:stable head contains binutils 2.31, which generates
|
|
||||||
# binaries that are incompatible with kernels < 4.16. So manually
|
|
||||||
# forcibly install binutils 2.30-22 instead.
|
|
||||||
|
|
||||||
RUN if [ "$TARGETARCH" = "amd64" ] ; then \
|
|
||||||
curl -L -o binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-x86-64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
|
||||||
else \
|
|
||||||
curl -L -o binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-aarch64-linux-gnu_2.30-22_${TARGETARCH}.deb; \
|
|
||||||
fi
|
|
||||||
|
|
||||||
RUN curl -L -o binutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils_2.30-22_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o libbinutils_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/libbinutils_2.30-22_${TARGETARCH}.deb \
|
|
||||||
&& curl -L -o binutils-common_2.30-22_${TARGETARCH}.deb https://download.falco.org/dependencies/binutils-common_2.30-22_${TARGETARCH}.deb \
|
|
||||||
&& dpkg -i *binutils*.deb \
|
|
||||||
&& rm -f *binutils*.deb
|
|
||||||
|
|
||||||
COPY ./docker-entrypoint.sh /
|
COPY ./docker-entrypoint.sh /
|
||||||
|
|
||||||
ENTRYPOINT ["/docker-entrypoint.sh"]
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|
||||||
|
|||||||
Reference in New Issue
Block a user