54 lines
2.7 KiB
Docker
54 lines
2.7 KiB
Docker
# Backup sidecar image: mysql:8.4 (for a version-matched mysqldump) plus restic
|
|
# (for deduped, encrypted, destination-agnostic file snapshots) and a small
|
|
# Python for the manifest writer.
|
|
#
|
|
# WHY mysql:8.4 as the base: the dump tool must match the server major/minor so
|
|
# the SQL it emits restores cleanly onto the same engine. Reusing the exact
|
|
# image the db service runs removes version drift as a failure mode.
|
|
FROM mysql:8.4
|
|
|
|
# Track 1 local build unblock: trust the corporate proxy (Zscaler/GE) root CA so
|
|
# the build-time fetches below (Oracle yum, github.com, PyPI) succeed behind TLS
|
|
# interception. This is a local convenience only; the shipping build vendors
|
|
# these deps instead of fetching them (pinned restic + SHA256, vendored
|
|
# bzip2/python3/alembic or a base image that carries them) so the release image
|
|
# needs no outbound calls and no embedded cert. The cert is gitignored (*.pem)
|
|
# and must be staged at scripts/backup/zscaler-root-ca.pem before building.
|
|
#
|
|
# Copied via the directory rather than by name, because the cert is OPTIONAL: it
|
|
# is gitignored, so a plain `COPY scripts/backup/zscaler-root-ca.pem` fails the
|
|
# build outright and nobody outside a TLS-intercepting network - another site,
|
|
# or our own CI - could build this image at all. A trailing glob does not fix
|
|
# that either: BuildKit fails a COPY whose pattern matches nothing, which is
|
|
# precisely the case being handled. Copying a directory that always exists and
|
|
# testing for the file inside it is the form that works both ways.
|
|
COPY scripts/backup/ /tmp/buildctx/
|
|
RUN if [ -f /tmp/buildctx/zscaler-root-ca.pem ]; then \
|
|
echo "staging corporate root CA"; \
|
|
cp /tmp/buildctx/zscaler-root-ca.pem /etc/pki/ca-trust/source/anchors/; \
|
|
update-ca-trust; \
|
|
else \
|
|
echo "no corporate root CA staged - using the public trust store"; \
|
|
fi \
|
|
&& rm -rf /tmp/buildctx
|
|
|
|
# restic from the distro is often stale; pull the pinned release binary so the
|
|
# snapshot format and retention flags are predictable across sites.
|
|
ARG RESTIC_VERSION=0.17.3
|
|
RUN microdnf install -y bzip2 python3 python3-pip ca-certificates \
|
|
&& curl -fsSL -o /tmp/restic.bz2 \
|
|
"https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2" \
|
|
&& bunzip2 /tmp/restic.bz2 \
|
|
&& install -m 0755 /tmp/restic /usr/local/bin/restic \
|
|
&& rm -f /tmp/restic \
|
|
&& microdnf clean all
|
|
|
|
# alembic so the manifest writer can read the current schema head. pip does not
|
|
# read the system trust store, so point it at the extracted system CA bundle
|
|
# (now including the proxy root) to get through TLS interception.
|
|
RUN python3 -m pip install --no-cache-dir \
|
|
--cert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
|
|
alembic
|
|
|
|
ENTRYPOINT ["/opt/backup/backup.sh"]
|