Dockerfile.template

{{- $gosu := index .Packages "gosu" }}
{{- $golang := index .Packages "golang" }}
{{- $cassandra := index .Packages "cassandra" }}
{{- $c2dRelease := index .TemplateArgs "c2dRelease" }}

ARG BASE_REGISTRY="docker.io"
FROM ${BASE_REGISTRY}/golang:bookworm AS gosu-builder

RUN set -eux; \
	apt-get update; \
	apt-get install -y --no-install-recommends \
		arch-test \
		file \
		patch \
		git \
	; \
	rm -rf /var/lib/apt/lists/*

RUN mkdir -p /usr/src/ \
		&& git clone https://github.com/tianon/gosu.git --branch "{{ $gosu.Version }}" /usr/src/gosu

# note: we cannot add "-s" here because then "govulncheck" does not work (see SECURITY.md); the ~0.2MiB increase (as of 2022-12-16, Go 1.18) is worth it
ENV BUILD_FLAGS="-v -ldflags '-d -w'"

RUN set -eux; \
	{ \
		echo '#!/usr/bin/env bash'; \
		echo 'set -Eeuo pipefail -x'; \
		echo 'eval "go build $BUILD_FLAGS -o /go/bin/gosu-$ARCH"'; \
		echo 'file "/go/bin/gosu-$ARCH"'; \
		echo 'if arch-test "$ARCH"; then'; \
# there's a fun QEMU + Go 1.18+ bug that causes our binaries (especially on ARM arches) to hang indefinitely *sometimes*, hence the "timeout" and looping here
		echo '  try() { for (( i = 0; i < 30; i++ )); do if timeout 1s "$@"; then return 0; fi; done; return 1; }'; \
		echo '  try "/go/bin/gosu-$ARCH" --version'; \
		echo '  try "/go/bin/gosu-$ARCH" nobody id'; \
		echo '  try "/go/bin/gosu-$ARCH" nobody ls -l /proc/self/fd'; \
		echo 'fi'; \
	} > /usr/local/bin/gosu-build-and-test.sh; \
	chmod +x /usr/local/bin/gosu-build-and-test.sh

# disable CGO for ALL THE THINGS (to help ensure no libc)
ENV CGO_ENABLED 0

WORKDIR /go/src/github.com/tianon/gosu
RUN cp /usr/src/gosu/go.mod /usr/src/gosu/go.sum ./
RUN set -eux; \
	go mod download; \
	go mod verify

RUN cp /usr/src/gosu/*.go ./

RUN ARCH=amd64    GOARCH=amd64       gosu-build-and-test.sh

RUN set -eux; ls -lAFh /go/bin/gosu-*; file /go/bin/gosu-*


FROM {{ .From }}

# explicitly set user/group IDs
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra

RUN set -ex; \
	apt-get update; \
	if ! command -v gpg > /dev/null; then \
		apt-get install -y --no-install-recommends \
			gnupg \
			dirmngr \
		; \
	fi ; \
	if ! command -v free > /dev/null; then \
		apt-get install -y --no-install-recommends \
			procps \
		; \
	fi ; \
	rm -rf /var/lib/apt/lists/*;

COPY --from=gosu-builder /go/bin/gosu-amd64 /usr/local/bin/gosu
RUN chmod +x /usr/local/bin/gosu \
			&& gosu nobody true

RUN apt-get update \
	&& apt-get install -y --no-install-recommends \
		ca-certificates \
		# solves warning: "jemalloc shared library could not be preloaded to speed up memory allocations"
		libjemalloc2 \
# "free" is used by cassandra-env.sh
		procps \
# "cqlsh" needs a python interpreter
		python3 \
# "ip" is not required by Cassandra itself, but is commonly used in scripting Cassandra's configuration (since it is so fixated on explicit IP addresses)
		iproute2 \
# Cassandra will automatically use numactl if available
#   https://github.com/apache/cassandra/blob/18bcda2d4c2eba7370a0b21f33eed37cb730bbb3/bin/cassandra#L90-L100
#   https://github.com/apache/cassandra/commit/604c0e87dc67fa65f6904ef9a98a029c9f2f865a
		numactl \
		wget \
	&& rm -rf /var/lib/apt/lists/*

# https://wiki.apache.org/cassandra/DebianPackaging#Adding_Repository_Keys
ENV GPG_KEYS {{ $cassandra.Gpg }}

ENV CASSANDRA_VERSION {{ $cassandra.Version }}
ENV CASSANDRA_HOME /opt/cassandra
ENV CASSANDRA_CONFIG /etc/cassandra
ENV PATH $CASSANDRA_HOME/bin:$PATH

ENV C2D_RELEASE {{ $c2dRelease }}

RUN set -ex; \
	export DIST_FILE="https://archive.apache.org/dist/cassandra/{{ $cassandra.Version }}/apache-cassandra-{{ $cassandra.Version }}-bin.tar.gz"; \
	wget --progress=dot:giga -O "cassandra-bin.tgz" "${DIST_FILE}"

RUN mkdir -p "$CASSANDRA_HOME"; \
	tar --extract --file cassandra-bin.tgz --directory "$CASSANDRA_HOME" --strip-components 1; \
	rm cassandra-bin.tgz*; \
	\
	[ ! -e "$CASSANDRA_CONFIG" ]; \
	mv "$CASSANDRA_HOME/conf" "$CASSANDRA_CONFIG"; \
	ln -sT "$CASSANDRA_CONFIG" "$CASSANDRA_HOME/conf"

ENV JMX_EXPORTER_VERSION 1.0.1
ENV JMX_EXPORTER_PATH /opt/jmx-exporter
ENV JMX_EXPORTER_JAR jmx_prometheus_javaagent-${JMX_EXPORTER_VERSION}.jar
ENV JMX_EXPORTER_AGENT ${JMX_EXPORTER_PATH}/${JMX_EXPORTER_JAR}
ENV JMX_EXPORTER_CONFIG ${JMX_EXPORTER_PATH}/cassandra.yml
ENV JMX_EXPORTER_LICENSE ${JMX_EXPORTER_PATH}/LICENSE
ENV JMX_EXPORTER_NOTICE ${JMX_EXPORTER_PATH}/NOTICE

RUN set -x; \
		echo "deb http://deb.debian.org/debian unstable main non-free non-free-firmware contrib" > /etc/apt/sources.list.d/debian-unstable.list; \
		apt-get update \
		&& apt-get -y install openjdk-11-jdk

COPY docker-entrypoint.sh /docker-entrypoint.sh
ENTRYPOINT ["/docker-entrypoint.sh"]

VOLUME /var/lib/cassandra

RUN test ${C2D_RELEASE} = $(cassandra -v) \
        || { echo "Version check failed"; exit 1; }


# Download Licenses
COPY components.csv /components.csv
COPY download-licenses.sh /download-licenses.sh
RUN mkdir -p /usr/src && \
		/download-licenses.sh /components.csv /usr/src/licenses

# 7000: intra-node communication
# 7001: TLS intra-node communication
# 7199: JMX
# 9042: CQL
# 9160: thrift service
# 9404: JMX Exporter for Prometheus metrics
EXPOSE 7000 7001 7199 9042 9160 9404

CMD ["cassandra", "-f"]