Add air-gapped environment adaptation summary
- Comprehensive documentation of all 7 Dockerfile adaptations - Configuration parameters for internal infrastructure - Before/after comparison examples - Verification checklist Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Entire-Checkpoint: 01M6PCXJR0ZV3V8XWBEKT0Z32X
This commit is contained in:
1 file changed
+175
@@ -0,0 +1,175 @@
|
|||||||
|
# Air-Gapped Environment Adaptation Summary
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
All 7 Dockerfiles in `./external-dependencies/` have been adapted for air-gapped environment deployment using internal infrastructure.
|
||||||
|
|
||||||
|
## Adapted Dockerfiles
|
||||||
|
|
||||||
|
| Package | Version | Status |
|
||||||
|
|---------|---------|--------|
|
||||||
|
| ubuntu-26.04-build-container | base | ✅ Adapted |
|
||||||
|
| qt6-framework | 6.10.2 | ✅ Adapted |
|
||||||
|
| log4qt | 2.0.0 | ✅ Adapted |
|
||||||
|
| grantlee | 5.3.1 | ✅ Adapted |
|
||||||
|
| googletest | 1.15.2 | ✅ Adapted |
|
||||||
|
| postgresql | 16 | ✅ Adapted |
|
||||||
|
| kdreports | 2.3.0 | ✅ Adapted |
|
||||||
|
|
||||||
|
## Air-Gap Configuration Applied
|
||||||
|
|
||||||
|
### 1. Internal Nexus Repositories
|
||||||
|
```
|
||||||
|
http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu
|
||||||
|
http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Proxy Configuration
|
||||||
|
```
|
||||||
|
HTTP_PROXY=http://10.198.80.130:3128
|
||||||
|
HTTPS_PROXY=http://10.198.80.130:3128
|
||||||
|
NO_PROXY=localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Harbor Registry for Base Images
|
||||||
|
```
|
||||||
|
harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. User Creation
|
||||||
|
- **ctc**: uid 1445, gid 1445, home: /shd/CTC/TOOLS
|
||||||
|
- **rme**: uid 1001, gid 1001, home: /home/rme
|
||||||
|
|
||||||
|
### 5. CA Certificates and Signing Keys
|
||||||
|
```
|
||||||
|
http://10.198.80.75/rme/SL-Netz.crt
|
||||||
|
http://10.198.80.75/rme/deb_and_rpm_signage_key.pub
|
||||||
|
```
|
||||||
|
|
||||||
|
### 6. Shell Configuration
|
||||||
|
```dockerfile
|
||||||
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||||
|
```
|
||||||
|
|
||||||
|
### 7. Labels Standardization
|
||||||
|
- Changed from `maintainer` to `author` (lowercase)
|
||||||
|
- Added `project` label
|
||||||
|
- Standardized format across all Dockerfiles
|
||||||
|
|
||||||
|
## Changes Made to Each Dockerfile
|
||||||
|
|
||||||
|
### Before (Public Environment)
|
||||||
|
```dockerfile
|
||||||
|
FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04
|
||||||
|
|
||||||
|
LABEL maintainer="Legatus Team"
|
||||||
|
LABEL description="..."
|
||||||
|
LABEL version="..."
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
|
ARG HTTP_PROXY=""
|
||||||
|
ARG HTTPS_PROXY=""
|
||||||
|
ARG NO_PROXY="localhost,127.0.0.1,.sl.defence-elec.de"
|
||||||
|
|
||||||
|
ENV http_proxy=${HTTP_PROXY}
|
||||||
|
ENV https_proxy=${HTTPS_PROXY}
|
||||||
|
ENV no_proxy=${NO_PROXY}
|
||||||
|
```
|
||||||
|
|
||||||
|
### After (Air-Gapped Environment)
|
||||||
|
```dockerfile
|
||||||
|
FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04
|
||||||
|
|
||||||
|
ARG RME_USERPASS=ctc
|
||||||
|
ARG RME_ADMINSRV=10.198.80.75
|
||||||
|
ARG RME_PROJECT=guez
|
||||||
|
|
||||||
|
# Proxy configuration for air-gapped environments
|
||||||
|
ARG http_proxy="http://10.198.80.130:3128"
|
||||||
|
ARG no_proxy="localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158"
|
||||||
|
ARG HTTP_PROXY=${http_proxy}
|
||||||
|
ARG https_proxy=${http_proxy}
|
||||||
|
ARG HTTPS_PROXY=${http_proxy}
|
||||||
|
ARG NO_PROXY=${no_proxy}
|
||||||
|
|
||||||
|
LABEL author="Legatus Team"
|
||||||
|
LABEL project=${RME_PROJECT}
|
||||||
|
LABEL version="..."
|
||||||
|
LABEL description="..."
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
|
# OS and PATH configuration
|
||||||
|
ENV LANG=C.UTF-8 \
|
||||||
|
LC_ALL=C.UTF-8
|
||||||
|
|
||||||
|
# Shell global auf Bash mit sicheren Pipes umstellen
|
||||||
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||||
|
|
||||||
|
# Originale Repositories durch Nexus Proxies ersetzen
|
||||||
|
RUN echo : > /etc/apt/sources.list && \
|
||||||
|
echo -e "Types: deb\n\
|
||||||
|
URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu\n\
|
||||||
|
Suites: resolute resolute-updates resolute-backports\n\
|
||||||
|
Components: main restricted universe multiverse\n\
|
||||||
|
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n\
|
||||||
|
\n\
|
||||||
|
Types: deb\n\
|
||||||
|
URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security\n\
|
||||||
|
Suites: resolute-security\n\
|
||||||
|
Components: main restricted universe multiverse\n\
|
||||||
|
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" > /etc/apt/sources.list.d/ubuntu.sources
|
||||||
|
|
||||||
|
# Create users (install openssl first for password hashing)
|
||||||
|
RUN apt-get update && apt-get install -y openssl \
|
||||||
|
&& groupadd ctc -g 1445 || true \
|
||||||
|
&& groupadd rme -g 1001 || true \
|
||||||
|
&& useradd -d /shd/CTC/TOOLS -u 1445 -g ctc -m -p $(openssl passwd -5 ${RME_USERPASS}) ctc || true \
|
||||||
|
&& useradd -d /home/rme -u 1001 -g rme -m -p $(openssl passwd -5 ${RME_USERPASS}) rme || true \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
RUN curl -fsSL http://${RME_ADMINSRV}/rme/deb_and_rpm_signage_key.pub --output /etc/apt/keyrings/deb_and_rpm_signage_key.asc \
|
||||||
|
&& curl -fsSL http://${RME_ADMINSRV}/rme/SL-Netz.crt --output /usr/local/share/ca-certificates/SL-Netz.crt \
|
||||||
|
&& update-ca-certificates
|
||||||
|
```
|
||||||
|
|
||||||
|
## Reference Documentation
|
||||||
|
|
||||||
|
- **Reference Dockerfile**: `prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile`
|
||||||
|
- **Detailed Adaptation Guide**: `external-dependencies/qt6-framework/AIRGAP-ADAPTATION.md`
|
||||||
|
- **Dependency Inventory**: `external-dependencies/DEPENDENCIES-INVENTORY.md`
|
||||||
|
|
||||||
|
## Git Commits
|
||||||
|
|
||||||
|
1. `50e0485fe` - Adapt remaining 5 Dockerfiles for air-gapped environment
|
||||||
|
2. Previous commits for qt6-framework and ubuntu-26.04-build-container
|
||||||
|
|
||||||
|
## Verification
|
||||||
|
|
||||||
|
All Dockerfiles now contain:
|
||||||
|
- ✅ Internal Nexus APT repositories
|
||||||
|
- ✅ Proxy configuration with comprehensive no_proxy list
|
||||||
|
- ✅ User creation (ctc and rme)
|
||||||
|
- ✅ CA certificates installation
|
||||||
|
- ✅ APT signing keys
|
||||||
|
- ✅ Standardized labels (lowercase)
|
||||||
|
- ✅ Shell configuration with pipefail
|
||||||
|
- ✅ Harbor registry for base images
|
||||||
|
|
||||||
|
## Next Steps
|
||||||
|
|
||||||
|
1. Build and test each Dockerfile in the air-gapped environment
|
||||||
|
2. Verify SBOM generation works with internal repositories
|
||||||
|
3. Update Jenkins pipeline configurations to use new Dockerfiles
|
||||||
|
4. Document any environment-specific adjustments needed
|
||||||
|
|
||||||
|
## Environment Parameters
|
||||||
|
|
||||||
|
| Parameter | Value |
|
||||||
|
|-----------|-------|
|
||||||
|
| Nexus Repository | remote-repo.sl.defence-elec.de:8081 |
|
||||||
|
| Proxy Server | 10.198.80.130:3128 |
|
||||||
|
| Admin Server | 10.198.80.75 |
|
||||||
|
| Harbor Registry | harbor.sl.defence-elec.de/proxydockerhub |
|
||||||
|
| PIP Index URL | http://remote-repo.sl.defence-elec.de:8081/repository/proxypipy/ |
|
||||||
Reference in new issue
Block a user