19071ec6c6
Backups are per-site and not part of the base stack, so they ship as a separate compose overlay with an isolated restic REST server the app can only reach through the backup utility (no shell or db creds). The sidecar image trusts the corporate proxy root CA at build time so its Oracle yum, github, and PyPI fetches succeed behind TLS interception; shell scripts are pinned to LF via .gitattributes so the container entrypoints do not die on a CRLF shebang.
39 lines
1.9 KiB
Docker
39 lines
1.9 KiB
Docker
# Backup sidecar image: mysql:8.4 (for a version-matched mysqldump) plus restic
|
|
# (for deduped, encrypted, destination-agnostic file snapshots) and a small
|
|
# Python for the manifest writer.
|
|
#
|
|
# WHY mysql:8.4 as the base: the dump tool must match the server major/minor so
|
|
# the SQL it emits restores cleanly onto the same engine. Reusing the exact
|
|
# image the db service runs removes version drift as a failure mode.
|
|
FROM mysql:8.4
|
|
|
|
# Track 1 local build unblock: trust the corporate proxy (Zscaler/GE) root CA so
|
|
# the build-time fetches below (Oracle yum, github.com, PyPI) succeed behind TLS
|
|
# interception. This is a local convenience only; the shipping build vendors
|
|
# these deps instead of fetching them (pinned restic + SHA256, vendored
|
|
# bzip2/python3/alembic or a base image that carries them) so the release image
|
|
# needs no outbound calls and no embedded cert. The cert is gitignored (*.pem)
|
|
# and must be staged at scripts/backup/zscaler-root-ca.pem before building.
|
|
COPY scripts/backup/zscaler-root-ca.pem /etc/pki/ca-trust/source/anchors/zscaler-root-ca.pem
|
|
RUN update-ca-trust
|
|
|
|
# restic from the distro is often stale; pull the pinned release binary so the
|
|
# snapshot format and retention flags are predictable across sites.
|
|
ARG RESTIC_VERSION=0.17.3
|
|
RUN microdnf install -y bzip2 python3 python3-pip ca-certificates \
|
|
&& curl -fsSL -o /tmp/restic.bz2 \
|
|
"https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2" \
|
|
&& bunzip2 /tmp/restic.bz2 \
|
|
&& install -m 0755 /tmp/restic /usr/local/bin/restic \
|
|
&& rm -f /tmp/restic \
|
|
&& microdnf clean all
|
|
|
|
# alembic so the manifest writer can read the current schema head. pip does not
|
|
# read the system trust store, so point it at the extracted system CA bundle
|
|
# (now including the proxy root) to get through TLS interception.
|
|
RUN python3 -m pip install --no-cache-dir \
|
|
--cert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
|
|
alembic
|
|
|
|
ENTRYPOINT ["/opt/backup/backup.sh"]
|