diff --git a/task1_docker/Dockerfile b/task1_docker/Dockerfile index d6b4524..a385049 100644 --- a/task1_docker/Dockerfile +++ b/task1_docker/Dockerfile @@ -1,6 +1,20 @@ -FROM golang:1.19 +# Build Stage +FROM golang:1.19 AS build WORKDIR /app -COPY . . +COPY go.mod ./ RUN go mod download -RUN go build -o /hello_world +COPY . . +RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /hello_world + +# Production Stage +FROM scratch +COPY --from=build /hello_world /hello_world ENTRYPOINT ["/hello_world"] + + +#FROM golang:1.19 +#WORKDIR /app +#COPY . . +#RUN go mod download +#RUN go build -o /hello_world +#ENTRYPOINT ["/hello_world"] \ No newline at end of file diff --git a/task1_docker/README.md b/task1_docker/README.md index 74a387b..3f2ac50 100644 --- a/task1_docker/README.md +++ b/task1_docker/README.md @@ -2,7 +2,20 @@ ### 1. Optimize Dockerfile (make it more lightweight) ``` -Type here what was done... +To optimize it, it means I have to make the Dockerfile as lightweight +as possible and the benefits to this is to reduce the attack area and +improve the security of the overall application. The methods implemented involves: + +- Using a specific base image that matches the requirements of the +application in production + +- when using the COPY command, I made sure I copied the necessary files +for the building and running of the application + +- Combining the RUN command instead of using multiple RUN commands, +becasue these commands add an extra layer to the application + +- Finally using a multi-stage build ``` @@ -10,16 +23,69 @@ Type here what was done... ``` Type here what was done... +To create a multistage build technically mean creating a more than one +build so as to keep the Dockerfile optimized, easy to read and maintain. +This is so because most times developers uses different Dockerfile for +build and production. To achieve this this is what i did: +The multistage build consist of two stages, where each is defined with +its own FROM statement + +- Build Stage + +In this stage, I use an official Golang image as the base image and +give it an alias "build" ('FROM golang:1.19 AS build). +I set the working directory to "./app", copy the go.mod files to +the container, and download the Go module dependencies using the "go +mod download". +I then copy the rest of the application code to the container and build +it using the "CGO_ENABLED=0 GOOS=linux go build" command with the +necessary flags to produce a statically linked binary executable ('/ +hello_world'). +Finally an optional case of using the strip command. The strip command +can be used to remove the debug information from the executable, this +like i said is optional and not necessary. + +- Production Stage + +In this stage, I will start with a minimal 'scratch' base image, which +contains no files or dependencies. +I copied the '/hello_world' binary executable from the 'build' stage +using the 'COPY --from=build' command which copies the file from the +'build' stage to the current stage. +Finally, I will set the entry point to '/hello_world', which specifies +the command to run when the container starts ``` ### 3. Build, run and open in browser ``` -Type here the command you used to build and run the container... +To do this we will run the following command + +- docker build -t go_app . +- docker run -p 8060:8060 go_app + +To open in browser, I will access http:/localhost:8060/helloworld ``` +![](image.png) + + ### 4. Tag it with :v1.0.0 and :latest and push the image to your DockerHub or Github Packages repository ``` -Type here the public image URL +For (:v1.0.0): +- docker build -t galactican/go_app:v1.0.0 . +- docker push galactican/go_app:v1.0.0 + +``` +[Docker image for v1.0.0](https://hub.docker.com/layers/galactican/go_app/v1.0.0/images/sha256:4805a5a50105f82ec9563b118757084608a565760e64281bac93f8c3370882cd) ``` +For (:latest) +- docker build -t galactican/go_app:latest . +- docker push galactican/go_app:latest + +``` +[Docker image for :latest](https://hub.docker.com/layers/galactican/go_app/latest/images/sha256:4805a5a50105f82ec9563b118757084608a565760e64281bac93f8c3370882cd) + + +![](image2.png) diff --git a/task1_docker/image.png b/task1_docker/image.png new file mode 100644 index 0000000..00690a9 Binary files /dev/null and b/task1_docker/image.png differ diff --git a/task1_docker/image2.png b/task1_docker/image2.png new file mode 100644 index 0000000..ba330dd Binary files /dev/null and b/task1_docker/image2.png differ diff --git a/task2_vault/README.md b/task2_vault/README.md index 70b14d5..677161d 100644 --- a/task2_vault/README.md +++ b/task2_vault/README.md @@ -19,14 +19,23 @@ Look for TODO comment in the tf config. Don't modify existing resources.\ Check if the container is able to read and print the secret or still produces errors: `docker logs -f service-alpha`. ``` -Type here what was done... +I created a new policy called service-alpha-policy as showned in the script. +The policy explains that the created secrets engine will have a read permission. +Meaning that every key implemented in that directory can be read when they are required ``` ### 2. Split the terraform config into 2 modules. One for building/deploying the service, another for managing vault resources.\ Use variables. ``` -Type here what was done... + +I splitted the configuration into two modules, where one of the modules 'service-alpha' is +responsible for building and deploying the service alpha container + +The other module 'vault-resources' is responsible for managing resources meant by vault which +may include 'vault_generic_secret, vault_auth_backend, vault_policy, and vault_userpass_user' + +Both of these modules can then be used within the 'main.tf' and reference appropriately ``` diff --git a/task2_vault/tf/main.tf b/task2_vault/tf/main.tf index 26d989f..ac82eaf 100644 --- a/task2_vault/tf/main.tf +++ b/task2_vault/tf/main.tf @@ -1,3 +1,16 @@ +# This is the main terraform script used for implemeneting the module created + +module "service-alpha" { + source = "./service-alpha" +} + +module "vault" { + source = "./vault" +} + + + +/** terraform { required_version = ">= 1.1.0" @@ -47,10 +60,24 @@ resource "vault_auth_backend" "userpass" { # TODO: Add missing users and policies +# policy for the service-alpha container +resource "vault_policy" "service-alpha-policy" { + name = "service-alpha-policy" + policy = <