Skip to content

Commit 698862f

Browse files
dkorunicdkorunic
committed
Major changes for 3.x images:
- Start building with AWS-LC instead of OpenSSL - Stop shipping dataplaneapi v2 - Stop building dataplaneapi v3 and use prebuilt packages - Add 3.4 branch - Set 3.3 as base/default/stable branch
1 parent 2f44bdf commit 698862f

33 files changed

Lines changed: 1168 additions & 297 deletions

File tree

‎.github/workflows/docker_auto.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
env:
1414
DOCKER_PLATFORMS: linux/amd64,linux/arm/v7,linux/arm64
1515
DOCKER_IMAGE: haproxytech/haproxy-debian
16-
STABLE_BRANCH: "3.2"
16+
STABLE_BRANCH: "3.3"
1717
steps:
1818
- name: Login to Docker Hub
1919
id: login_docker

‎.github/workflows/docker_manual.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ jobs:
99
packages: write
1010
strategy:
1111
matrix:
12-
branch: ["2.4", "2.6", "2.8", "3.0", "3.1", "3.2", "3.3"]
12+
branch: ["2.4", "2.6", "2.8", "3.0", "3.1", "3.2", "3.3", "3.4"]
1313
env:
1414
DOCKER_PLATFORMS: linux/amd64,linux/arm/v7,linux/arm64
1515
DOCKER_IMAGE: haproxytech/haproxy-debian
16-
STABLE_BRANCH: "3.2"
16+
STABLE_BRANCH: "3.3"
1717
steps:
1818
- name: Login to Docker Hub
1919
id: login_docker

‎3.0/Dockerfile‎

Lines changed: 77 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,48 @@
1-
FROM golang:alpine AS builder
1+
FROM debian:trixie-slim AS awslc-builder
22

3-
ENV DATAPLANE_MINOR 3.0.16
4-
ENV DATAPLANE_V2_MINOR 2.9.20
5-
ENV DATAPLANE_URL https://github.com/haproxytech/dataplaneapi.git
6-
7-
RUN apk add --no-cache ca-certificates git make && \
8-
git clone "${DATAPLANE_URL}" "${GOPATH}/src/github.com/haproxytech/dataplaneapi" && \
9-
cd "${GOPATH}/src/github.com/haproxytech/dataplaneapi" && \
10-
git checkout "v${DATAPLANE_MINOR}" && \
11-
make build && cp build/dataplaneapi /dataplaneapi && \
12-
make clean && \
13-
git checkout "v${DATAPLANE_V2_MINOR}" && \
14-
make build && cp build/dataplaneapi /dataplaneapi-v2
3+
ENV AWSLC_URL https://github.com/aws/aws-lc.git
4+
ENV AWSLC_TAG v1.65.1
5+
6+
ENV DEBIAN_FRONTEND noninteractive
7+
8+
RUN apt-get update && \
9+
apt-get install -y --no-install-recommends build-essential ca-certificates git cmake ninja-build golang && \
10+
git clone --depth 1 --branch "${AWSLC_TAG}" "${AWSLC_URL}" /tmp/aws-lc && \
11+
mkdir /tmp/aws-lc/build && \
12+
cd /tmp/aws-lc/build && \
13+
cmake -G Ninja -DCMAKE_INSTALL_PREFIX=/opt/aws-lc -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON .. && \
14+
ninja install && \
15+
rm -rf /tmp/aws-lc
16+
17+
FROM debian:trixie-slim AS hapce-builder
18+
19+
ENV HAPROXY_BRANCH 3.0
20+
ENV HAPROXY_MINOR 3.0.12
21+
ENV HAPROXY_SHA256 cd2bade59a7e2d61f2d62be7c6c4cfc0e2b3a90431023720cae7c43843b0570b
22+
ENV HAPROXY_SRC_URL http://www.haproxy.org/download
23+
24+
COPY --from=awslc-builder /opt/aws-lc /opt/aws-lc
25+
26+
ENV DEBIAN_FRONTEND noninteractive
27+
28+
RUN apt-get update && \
29+
apt-get install -y --no-install-recommends procps libssl3t64 zlib1g "libpcre2-*" liblua5.4-0 libatomic1 tar curl socat ca-certificates libjemalloc2 && \
30+
apt-get install -y --no-install-recommends gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
31+
c_rehash && \
32+
curl -sfSL "${HAPROXY_SRC_URL}/${HAPROXY_BRANCH}/src/haproxy-${HAPROXY_MINOR}.tar.gz" -o haproxy.tar.gz && \
33+
echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c - && \
34+
mkdir -p /tmp/haproxy && \
35+
tar -xzf haproxy.tar.gz -C /tmp/haproxy --strip-components=1 && \
36+
rm -f haproxy.tar.gz && \
37+
make -C /tmp/haproxy -j"$(nproc)" TARGET=linux-glibc CPU=generic USE_PCRE2=1 USE_PCRE2_JIT=1 \
38+
USE_TFO=1 USE_LINUX_TPROXY=1 USE_LUA=1 USE_GETADDRINFO=1 \
39+
USE_PROMEX=1 USE_SLZ=1 \
40+
USE_OPENSSL_AWSLC=1 USE_PTHREAD_EMULATION=1 \
41+
SSL_INC=/opt/aws-lc/include SSL_LIB=/opt/aws-lc/lib USE_QUIC=1 \
42+
LDFLAGS="-L/opt/aws-lc/lib -Wl,-rpath,/opt/aws-lc/lib" \
43+
ADDLIB=-ljemalloc \
44+
all && \
45+
make -C /tmp/haproxy TARGET=linux-glibc install-bin
1546

1647
FROM debian:trixie-slim
1748

@@ -31,46 +62,54 @@ ENV HAPROXY_SRC_URL http://www.haproxy.org/download
3162
ENV HAPROXY_UID haproxy
3263
ENV HAPROXY_GID haproxy
3364

65+
ENV DATAPLANE_MINOR 3.0.16
66+
ENV DATAPLANE_URL https://github.com/haproxytech/dataplaneapi/releases/download
67+
3468
ENV DEBIAN_FRONTEND noninteractive
3569

36-
COPY --from=builder /dataplaneapi /usr/local/bin/dataplaneapi
37-
COPY --from=builder /dataplaneapi-v2 /usr/local/bin/dataplaneapi-v2
70+
ARG TARGETPLATFORM
71+
72+
COPY --from=awslc-builder /opt/aws-lc /opt/aws-lc
73+
COPY --from=hapce-builder /usr/local/sbin/haproxy /usr/local/sbin/haproxy
74+
COPY --from=hapce-builder /tmp/haproxy/examples/errorfiles/ /usr/local/etc/haproxy/errors
3875

3976
RUN apt-get update && \
4077
apt-get install -y --no-install-recommends procps libssl3t64 zlib1g "libpcre2-*" liblua5.4-0 libatomic1 tar curl socat ca-certificates libjemalloc2 && \
41-
apt-get install -y --no-install-recommends gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
4278
c_rehash && \
43-
curl -sfSL "${HAPROXY_SRC_URL}/${HAPROXY_BRANCH}/src/haproxy-${HAPROXY_MINOR}.tar.gz" -o haproxy.tar.gz && \
44-
echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c - && \
4579
groupadd "$HAPROXY_GID" && \
4680
useradd -g "$HAPROXY_GID" "$HAPROXY_UID" && \
47-
mkdir -p /tmp/haproxy && \
48-
tar -xzf haproxy.tar.gz -C /tmp/haproxy --strip-components=1 && \
49-
rm -f haproxy.tar.gz && \
50-
make -C /tmp/haproxy -j"$(nproc)" TARGET=linux-glibc CPU=generic USE_PCRE2=1 USE_PCRE2_JIT=1 \
51-
USE_TFO=1 USE_LINUX_TPROXY=1 USE_LUA=1 USE_GETADDRINFO=1 \
52-
USE_PROMEX=1 USE_SLZ=1 \
53-
USE_OPENSSL=1 USE_PTHREAD_EMULATION=1 \
54-
USE_QUIC=1 USE_QUIC_OPENSSL_COMPAT=1 \
55-
ADDLIB=-ljemalloc \
56-
all && \
57-
make -C /tmp/haproxy TARGET=linux-glibc install-bin install-man && \
81+
chmod +x /usr/local/sbin/haproxy && \
5882
ln -s /usr/local/sbin/haproxy /usr/sbin/haproxy && \
5983
mkdir -p /var/lib/haproxy && \
6084
chown "$HAPROXY_UID:$HAPROXY_GID" /var/lib/haproxy && \
6185
mkdir -p /usr/local/etc/haproxy && \
6286
ln -s /usr/local/etc/haproxy /etc/haproxy && \
63-
cp -R /tmp/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors && \
64-
rm -rf /tmp/haproxy && \
65-
apt-get purge -y --auto-remove gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
66-
apt-get clean && \
67-
rm -rf /var/lib/apt/lists/* && \
87+
case "${TARGETPLATFORM}" in \
88+
"linux/arm64") API_ARCH=arm64 ;; \
89+
"linux/amd64") API_ARCH=x86_64 ;; \
90+
"linux/arm/v6") API_ARCH=arm ;; \
91+
"linux/arm/v7") API_ARCH=arm ;; \
92+
*) echo "ARG TARGETPLATFORM undeclared" >&2 && exit 1 ;; \
93+
esac && \
94+
curl -sfSL "${DATAPLANE_URL}/v${DATAPLANE_MINOR}/dataplaneapi_${DATAPLANE_MINOR}_linux_${API_ARCH}.tar.gz" -o dataplaneapi.tar.gz && \
95+
mkdir -p /tmp/dataplaneapi && \
96+
tar -xzf dataplaneapi.tar.gz -C /tmp/dataplaneapi && \
97+
rm -f dataplaneapi.tar.gz && \
98+
cp /tmp/dataplaneapi/dataplaneapi /usr/local/bin/dataplaneapi && \
6899
chmod +x /usr/local/bin/dataplaneapi && \
69-
ln -s /usr/local/bin/dataplaneapi /usr/bin/dataplaneapi && \
70-
chmod +x /usr/local/bin/dataplaneapi-v2 && \
71-
ln -s /usr/local/bin/dataplaneapi-v2 /usr/bin/dataplaneapi-v2 && \
72100
touch /usr/local/etc/haproxy/dataplaneapi.yml && \
73-
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/etc/haproxy/dataplaneapi.yml
101+
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/etc/haproxy/dataplaneapi.yml && \
102+
mkdir -p /usr/local/var/lib/dataplaneapi && \
103+
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/var/lib/dataplaneapi && \
104+
ln -s /usr/local/var/lib/dataplaneapi /var/lib/dataplaneapi && \
105+
rm -rf /tmp/dataplaneapi && \
106+
apt-get clean && \
107+
rm -rf /var/lib/apt/lists/* && \
108+
echo "/opt/aws-lc/lib" > /etc/ld.so.conf.d/awslc.conf && \
109+
mkdir -p /opt/aws-lc/ssl && \
110+
rm -rf /opt/aws-lc/ssl/certs && \
111+
ln -s /etc/ssl/certs /opt/aws-lc/ssl/certs && \
112+
ldconfig
74113

75114
COPY haproxy.cfg /usr/local/etc/haproxy
76115
COPY docker-entrypoint.sh /

‎3.0/Dockerfile.api‎

Lines changed: 67 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,49 @@
1+
FROM debian:trixie-slim AS awslc-builder
2+
3+
ENV AWSLC_URL https://github.com/aws/aws-lc.git
4+
ENV AWSLC_TAG v1.65.1
5+
6+
ENV DEBIAN_FRONTEND noninteractive
7+
8+
RUN apt-get update && \
9+
apt-get install -y --no-install-recommends build-essential ca-certificates git cmake ninja-build golang && \
10+
git clone --depth 1 --branch "${AWSLC_TAG}" "${AWSLC_URL}" /tmp/aws-lc && \
11+
mkdir /tmp/aws-lc/build && \
12+
cd /tmp/aws-lc/build && \
13+
cmake -G Ninja -DCMAKE_INSTALL_PREFIX=/opt/aws-lc -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON .. && \
14+
ninja install && \
15+
rm -rf /tmp/aws-lc
16+
17+
FROM debian:trixie-slim AS hapce-builder
18+
19+
ENV HAPROXY_BRANCH 3.0
20+
ENV HAPROXY_MINOR 3.0.12
21+
ENV HAPROXY_SHA256 cd2bade59a7e2d61f2d62be7c6c4cfc0e2b3a90431023720cae7c43843b0570b
22+
ENV HAPROXY_SRC_URL http://www.haproxy.org/download
23+
24+
COPY --from=awslc-builder /opt/aws-lc /opt/aws-lc
25+
26+
ENV DEBIAN_FRONTEND noninteractive
27+
28+
RUN apt-get update && \
29+
apt-get install -y --no-install-recommends procps libssl3t64 zlib1g "libpcre2-*" liblua5.4-0 libatomic1 tar curl socat ca-certificates libjemalloc2 && \
30+
apt-get install -y --no-install-recommends gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
31+
c_rehash && \
32+
curl -sfSL "${HAPROXY_SRC_URL}/${HAPROXY_BRANCH}/src/haproxy-${HAPROXY_MINOR}.tar.gz" -o haproxy.tar.gz && \
33+
echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c - && \
34+
mkdir -p /tmp/haproxy && \
35+
tar -xzf haproxy.tar.gz -C /tmp/haproxy --strip-components=1 && \
36+
rm -f haproxy.tar.gz && \
37+
make -C /tmp/haproxy -j"$(nproc)" TARGET=linux-glibc CPU=generic USE_PCRE2=1 USE_PCRE2_JIT=1 \
38+
USE_TFO=1 USE_LINUX_TPROXY=1 USE_LUA=1 USE_GETADDRINFO=1 \
39+
USE_PROMEX=1 USE_SLZ=1 \
40+
USE_OPENSSL_AWSLC=1 USE_PTHREAD_EMULATION=1 \
41+
SSL_INC=/opt/aws-lc/include SSL_LIB=/opt/aws-lc/lib USE_QUIC=1 \
42+
LDFLAGS="-L/opt/aws-lc/lib -Wl,-rpath,/opt/aws-lc/lib" \
43+
ADDLIB=-ljemalloc \
44+
all && \
45+
make -C /tmp/haproxy TARGET=linux-glibc install-bin
46+
147
FROM debian:trixie-slim
248

349
MAINTAINER Dinko Korunic <dkorunic@haproxy.com>
@@ -16,48 +62,35 @@ ENV HAPROXY_SRC_URL http://www.haproxy.org/download
1662
ENV HAPROXY_UID haproxy
1763
ENV HAPROXY_GID haproxy
1864

19-
ENV DEBIAN_FRONTEND noninteractive
20-
2165
ENV DATAPLANE_MINOR 3.0.16
2266
ENV DATAPLANE_URL https://github.com/haproxytech/dataplaneapi/releases/download
2367

68+
ENV DEBIAN_FRONTEND noninteractive
69+
2470
ARG TARGETPLATFORM
2571

26-
ARG S6_OVERLAY_VERSION=3.2.1.0
27-
ENV S6_OVERLAY_VERSION $S6_OVERLAY_VERSION
28-
ENV S6_READ_ONLY_ROOT=1
29-
ENV S6_USER=haproxy
30-
ENV S6_GROUP=haproxy
72+
COPY --from=awslc-builder /opt/aws-lc /opt/aws-lc
73+
COPY --from=hapce-builder /usr/local/sbin/haproxy /usr/local/sbin/haproxy
74+
COPY --from=hapce-builder /tmp/haproxy/examples/errorfiles/ /usr/local/etc/haproxy/errors
75+
76+
ENV S6_OVERLAY_VERSION 3.2.1.0
77+
ENV S6_READ_ONLY_ROOT 1
78+
ENV S6_USER haproxy
79+
ENV S6_GROUP haproxy
3180

3281
COPY /fs /
3382

3483
RUN apt-get update && \
3584
apt-get install -y --no-install-recommends procps libssl3t64 zlib1g "libpcre2-*" liblua5.4-0 libatomic1 tar xz-utils curl socat ca-certificates libjemalloc2 && \
36-
apt-get install -y --no-install-recommends gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
3785
c_rehash && \
38-
curl -sfSL "${HAPROXY_SRC_URL}/${HAPROXY_BRANCH}/src/haproxy-${HAPROXY_MINOR}.tar.gz" -o haproxy.tar.gz && \
39-
echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c - && \
4086
groupadd "$HAPROXY_GID" && \
4187
useradd -g "$HAPROXY_GID" "$HAPROXY_UID" && \
42-
mkdir -p /tmp/haproxy && \
43-
tar -xzf haproxy.tar.gz -C /tmp/haproxy --strip-components=1 && \
44-
rm -f haproxy.tar.gz && \
45-
make -C /tmp/haproxy -j"$(nproc)" TARGET=linux-glibc CPU=generic USE_PCRE2=1 USE_PCRE2_JIT=1 \
46-
USE_TFO=1 USE_LINUX_TPROXY=1 USE_LUA=1 USE_GETADDRINFO=1 \
47-
USE_PROMEX=1 USE_SLZ=1 \
48-
USE_OPENSSL=1 USE_PTHREAD_EMULATION=1 \
49-
USE_QUIC=1 USE_QUIC_OPENSSL_COMPAT=1 \
50-
ADDLIB=-ljemalloc \
51-
all && \
52-
make -C /tmp/haproxy TARGET=linux-glibc install-bin install-man && \
88+
chmod +x /usr/local/sbin/haproxy && \
5389
ln -s /usr/local/sbin/haproxy /usr/sbin/haproxy && \
5490
mkdir -p /var/lib/haproxy && \
5591
chown "$HAPROXY_UID:$HAPROXY_GID" /var/lib/haproxy && \
5692
mkdir -p /usr/local/etc/haproxy && \
57-
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/etc/haproxy && \
5893
ln -s /usr/local/etc/haproxy /etc/haproxy && \
59-
cp -R /tmp/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors && \
60-
rm -rf /tmp/haproxy && \
6194
case "${TARGETPLATFORM}" in \
6295
"linux/arm64") API_ARCH=arm64 ;; \
6396
"linux/amd64") API_ARCH=x86_64 ;; \
@@ -70,11 +103,20 @@ RUN apt-get update && \
70103
tar -xzf dataplaneapi.tar.gz -C /tmp/dataplaneapi && \
71104
rm -f dataplaneapi.tar.gz && \
72105
cp /tmp/dataplaneapi/dataplaneapi /usr/local/bin/dataplaneapi && \
106+
chmod +x /usr/local/bin/dataplaneapi && \
107+
touch /usr/local/etc/haproxy/dataplaneapi.yml && \
73108
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/etc/haproxy/dataplaneapi.yml && \
74109
mkdir -p /usr/local/var/lib/dataplaneapi && \
75110
chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/var/lib/dataplaneapi && \
76111
ln -s /usr/local/var/lib/dataplaneapi /var/lib/dataplaneapi && \
77112
rm -rf /tmp/dataplaneapi && \
113+
apt-get clean && \
114+
rm -rf /var/lib/apt/lists/* && \
115+
echo "/opt/aws-lc/lib" > /etc/ld.so.conf.d/awslc.conf && \
116+
mkdir -p /opt/aws-lc/ssl && \
117+
rm -rf /opt/aws-lc/ssl/certs && \
118+
ln -s /etc/ssl/certs /opt/aws-lc/ssl/certs && \
119+
ldconfig && \
78120
case "${TARGETPLATFORM}" in \
79121
"linux/arm64") S6_ARCH=aarch64 ;; \
80122
"linux/amd64") S6_ARCH=x86_64 ;; \
@@ -88,10 +130,7 @@ RUN apt-get update && \
88130
tar -C / -Jxpf /tmp/s6-overlay-binaries.tar.xz && \
89131
rm -f /tmp/s6-overlay-scripts.tar.xz /tmp/s6-overlay-binaries.tar.xz && \
90132
chown -R "${S6_USER}:${S6_GROUP}" /init /etc/s6-overlay && \
91-
chmod u+x /init /etc/s6-overlay/scripts/* && \
92-
apt-get purge -y --auto-remove gcc make libc6-dev libssl-dev libpcre2-dev zlib1g-dev liblua5.4-dev libjemalloc-dev && \
93-
apt-get clean && \
94-
rm -rf /var/lib/apt/lists/*
133+
chmod u+x /init /etc/s6-overlay/scripts/*
95134

96135
EXPOSE 80
97136
EXPOSE 443

0 commit comments

Comments
 (0)