wekan/Dockerfile

FROM debian:buster-slim
MAINTAINER wekan

# Declare Arguments
ARG NODE_VERSION
ARG METEOR_RELEASE
ARG METEOR_EDGE
ARG USE_EDGE
ARG NPM_VERSION
ARG FIBERS_VERSION
ARG ARCHITECTURE
ARG SRC_PATH

# Set the environment variables (defaults where required)
# DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
# ENV BUILD_DEPS="paxctl"
ENV BUILD_DEPS="apt-utils gnupg gosu wget curl bzip2 build-essential python git ca-certificates gcc-7"
ENV NODE_VERSION ${NODE_VERSION:-v8.11.1}
ENV METEOR_RELEASE ${METEOR_RELEASE:-1.6.0.1}
ENV USE_EDGE ${USE_EDGE:-false}
ENV METEOR_EDGE ${METEOR_EDGE:-1.5-beta.17}
ENV NPM_VERSION ${NPM_VERSION:-latest}
ENV FIBERS_VERSION ${FIBERS_VERSION:-2.0.0}
ENV ARCHITECTURE ${ARCHITECTURE:-linux-x64}
ENV SRC_PATH ${SRC_PATH:-./}

# Copy the app to the image
COPY ${SRC_PATH} /home/wekan/app

RUN \
    echo "=== Add non-root user wekan" && \
    useradd --user-group --system --home-dir /home/wekan wekan && \
    \
    echo "=== OS dependencies" && \
    apt-get update -y && apt-get install -y --no-install-recommends ${BUILD_DEPS} && \
    \
    # Download nodejs
    #wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
    #wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
    #---------------------------------------------------------------------------------------------
    # Node Fibers 100% CPU usage issue:
    # https://github.com/wekan/wekan-mongodb/issues/2#issuecomment-381453161
    # https://github.com/meteor/meteor/issues/9796#issuecomment-381676326
    # https://github.com/sandstorm-io/sandstorm/blob/0f1fec013fe7208ed0fd97eb88b31b77e3c61f42/shell/server/00-startup.js#L99-L129
    # Also see beginning of wekan/server/authentication.js
    #   import Fiber from "fibers";
    #   Fiber.poolSize = 1e9;
    echo "=== Getting newest Node from Sandstorm fork of Node" && \
    echo "=== Source: https://github.com/sandstorm-io/node ===" && \
    \
    # From https://github.com/sandstorm-io/sandstorm/blob/master/branch.conf
    SANDSTORM_BRANCH_NUMBER=0 && \
    \
    # From https://github.com/sandstorm-io/sandstorm/blob/master/release.sh
    SANDSTORM_CHANNEL=dev && \
    SANDSTORM_LAST_BUILD=$(curl -fs https://install.sandstorm.io/$SANDSTORM_CHANNEL) && \
    \
    echo "=== Latest Sandstorm Release: ${SANDSTORM_LAST_BUILD}===" && \
    if (( SANDSTORM_LAST_BUILD / 1000 > SANDSTORM_BRANCH_NUMBER )); && \
    then && \
      echo "SANDSTORM BRANCH ERROR: $CHANNEL has already moved past this branch!" >&2 && \
      echo "  I refuse to replace it with an older branch." >&2 && \
      exit 1 && \
    fi && \
    BASE_BUILD=$(( BRANCH_NUMBER * 1000 )) && \
    BUILD=$(( BASE_BUILD > LAST_BUILD ? BASE_BUILD : LAST_BUILD + 1 )) && \
    BUILD_MINOR="$(( $BUILD % 1000 ))" && \
    DISPLAY_VERSION="${BRANCH_NUMBER}.${BUILD_MINOR}" && \
    TAG_NAME="v${DISPLAY_VERSION}" && \
    SIGNING_KEY_ID=160D2D577518B58D94C9800B63F227499DA8CCBD && \
    TARBALL=sandstorm-$SANDSTORM_LAST_BUILD.tar.xz && \
    NODE_EXE=sandstorm-$SANDSTORM_LAST_BUILD/bin/node && \
    echo "=== Downloading Sandstorm GPG keys to verify Sandstorm release" && \
    # Do verification in custom GPG workspace
    # https://docs.sandstorm.io/en/latest/install/#option-3-pgp-verified-install
    export GNUPGHOME=$(mktemp -d) && \
    curl https://raw.githubusercontent.com/sandstorm-io/sandstorm/master/keys/release-keyring.gpg | gpg --import && \
    wget https://raw.githubusercontent.com/sandstorm-io/sandstorm/master/keys/release-certificate.kentonv.sig && \
    gpg --decrypt release-certificate.kentonv.sig && \
    echo "=== Downloading Sandstorm release from https://dl.sandstorm.io/${TARBALL} ===" && \
    wget https://dl.sandstorm.io/$TARBALL && \
    echo "=== Downloading signature for Sandstorm release from https://dl.sandstorm.io/${TARBALL}.sig ===" && \
    wget https://dl.sandstorm.io/$TARBALL.sig && \
    echo "=== Verifying signature of Sandstorm release" && \
    gpg --verify $TARBALL.sig $TARBALL && \
    \
    if [ $? -eq 0 ] && \
    then && \
      echo "=== All is well. Good signature in Sandstorm." && \
    else && \
      echo "=== PROBLEM WITH SANDSTORM SIGNATURE." && \
      exit 1 && \
    fi && \
    echo "=== Extracting Node from Sandstorm release tarball" && \
    # --strip 2 removes path of 2 subdirectories
    tar -xf $TARBALL $NODE_EXE --strip=2 && \
    echo "=== Deleting Sandstorm release tarball and signature" && \
    rm $TARBALL $TARBALL.sig release-certificate.kentonv.si* && \
    # == OLD ==
    # Download node version 8.11.1 that has fix included, node binary copied from Sandstorm
    # Description at https://releases.wekan.team/node.txt
    ##wget https://releases.wekan.team/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
    ##echo "308d0caaef0a1da3e98d1a1615016aad9659b3caf31d0f09ced20cabedb8acbf  node-v8.11.1-linux-x64.tar.gz" >> SHASUMS256.txt.asc && \
    ##\
    # Verify nodejs authenticity
    ##grep ${NODE_VERSION}-${ARCHITECTURE}.tar.gz SHASUMS256.txt.asc | shasum -a 256 -c - && \
    #export GNUPGHOME="$(mktemp -d)" && \
    #\
    # Try other key servers if ha.pool.sks-keyservers.net is unreachable
    # Code from https://github.com/chorrell/docker-node/commit/2b673e17547c34f17f24553db02beefbac98d23c
    # gpg keys listed at https://github.com/nodejs/node#release-team
    # and keys listed here from previous version of this Dockerfile
    #for key in \
    #9554F04D7259F04124DE6B476D5A82AC7E37093B \
    #94AE36675C464D64BAFA68DD7434390BDBE9B9C5 \
    #FD3A5288F042B6850C66B31F09FE44734EB7990E \
    #71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 \
    #DD8F2338BAE7501E3DD5AC78C273792F7D83545D \
    #C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 \
    #B9AE9905FFD7803F25714661B63B535A4C206CA9 \
    #; do \
    #gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
    #gpg --keyserver pgp.mit.edu --recv-keys "$key" || \
    #gpg --keyserver keyserver.pgp.com --recv-keys "$key" ; \
    #done && \
    #gpg --verify SHASUMS256.txt.asc && \
    # Ignore socket files then delete files then delete directories
    #find "$GNUPGHOME" -type f | xargs rm -f && \
    #find "$GNUPGHOME" -type d | xargs rm -fR && \
    ##rm -f SHASUMS256.txt.asc && \
    \
    # Install Node
    #tar xvzf node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
    #rm node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
    #mv node-${NODE_VERSION}-${ARCHITECTURE} /opt/nodejs && \
    mv node /opt/nodejs && \
    ln -s /opt/nodejs/bin/node /usr/bin/node && \
    ln -s /opt/nodejs/bin/npm /usr/bin/npm && \
    \
    #DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
    #paxctl -mC `which node` && \
    \
    echo "=== Install Node dependencies" && \
    npm install -g npm@${NPM_VERSION} && \
    npm install -g node-gyp && \
    npm install -g fibers@${FIBERS_VERSION} && \
    \
    echo "=== Change user to wekan and install meteor" && \
    cd /home/wekan/ && \
    chown wekan:wekan --recursive /home/wekan && \
    curl https://install.meteor.com -o /home/wekan/install_meteor.sh && \
    sed -i "s|RELEASE=.*|RELEASE=${METEOR_RELEASE}\"\"|g" ./install_meteor.sh && \
    echo "Starting meteor ${METEOR_RELEASE} installation...   \n" && \
    chown wekan:wekan /home/wekan/install_meteor.sh && \
    \
    # Check if opting for a release candidate instead of major release
    if [ "$USE_EDGE" = false ]; then \
      gosu wekan:wekan sh /home/wekan/install_meteor.sh; \
    else \
      gosu wekan:wekan git clone --recursive --depth 1 -b release/METEOR@${METEOR_EDGE} git://github.com/meteor/meteor.git /home/wekan/.meteor; \
    fi; \
    \
    echo "=== Get additional packages" && \
    mkdir -p /home/wekan/app/packages && \
    chown wekan:wekan --recursive /home/wekan && \
    cd /home/wekan/app/packages && \
    gosu wekan:wekan git clone --depth 1 -b master git://github.com/wekan/flow-router.git kadira-flow-router && \
    gosu wekan:wekan git clone --depth 1 -b master git://github.com/meteor-useraccounts/core.git meteor-useraccounts-core && \
    sed -i 's/api\.versionsFrom/\/\/api.versionsFrom/' /home/wekan/app/packages/meteor-useraccounts-core/package.js && \
    cd /home/wekan/.meteor && \
    gosu wekan:wekan /home/wekan/.meteor/meteor -- help; \
    \
    echo "=== Build app" && \
    cd /home/wekan/app && \
    gosu wekan:wekan /home/wekan/.meteor/meteor add standard-minifier-js && \
    gosu wekan:wekan /home/wekan/.meteor/meteor npm install && \
    gosu wekan:wekan /home/wekan/.meteor/meteor build --directory /home/wekan/app_build && \
    cp /home/wekan/app/fix-download-unicode/cfs_access-point.txt /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
    chown wekan:wekan /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
    #Removed binary version of bcrypt because of security vulnerability that is not fixed yet.
    #https://github.com/wekan/wekan/commit/4b2010213907c61b0e0482ab55abb06f6a668eac
    #https://github.com/wekan/wekan/commit/7eeabf14be3c63fae2226e561ef8a0c1390c8d3c
    #cd /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/npm-bcrypt && \
    #gosu wekan:wekan rm -rf node_modules/bcrypt && \
    #gosu wekan:wekan npm install bcrypt && \
    cd /home/wekan/app_build/bundle/programs/server/ && \
    gosu wekan:wekan npm install && \
    #gosu wekan:wekan npm install bcrypt && \
    mv /home/wekan/app_build/bundle /build && \
    \
    echo "=== Cleanup" && \
    apt-get remove --purge -y ${BUILD_DEPS} && \
    apt-get autoremove -y && \
    rm -R /var/lib/apt/lists/* && \
    rm -R /home/wekan/.meteor && \
    rm -R /home/wekan/app && \
    rm -R /home/wekan/app_build && \
    rm /home/wekan/install_meteor.sh

ENV PORT=80
EXPOSE $PORT

CMD ["node", "/build/main.js"]