Alpine as base image for Zookeeper to reduce vulnerabilities

3.9.2-alpine/Dockerfile

@@ -0,0 +1,82 @@
+FROM eclipse-temurin:17-jre-alpine
+
+ENV ZOO_CONF_DIR=/conf \
+    ZOO_DATA_DIR=/data \
+    ZOO_DATA_LOG_DIR=/datalog \
+    ZOO_LOG_DIR=/logs \
+    ZOO_TICK_TIME=2000 \
+    ZOO_INIT_LIMIT=5 \
+    ZOO_SYNC_LIMIT=2 \
+    ZOO_AUTOPURGE_PURGEINTERVAL=0 \
+    ZOO_AUTOPURGE_SNAPRETAINCOUNT=3 \
+    ZOO_MAX_CLIENT_CNXNS=60 \
+    ZOO_STANDALONE_ENABLED=true \
+    ZOO_ADMINSERVER_ENABLED=true
+
+# Add a user with an explicit UID/GID and create necessary directories
+RUN set -eux; \
+    addgroup -S zookeeper --gid=1000; \
+    adduser -S -G zookeeper --uid=1000 zookeeper; \
+    mkdir -p "$ZOO_DATA_LOG_DIR" "$ZOO_DATA_DIR" "$ZOO_CONF_DIR" "$ZOO_LOG_DIR"; \
+    chown zookeeper:zookeeper "$ZOO_DATA_LOG_DIR" "$ZOO_DATA_DIR" "$ZOO_CONF_DIR" "$ZOO_LOG_DIR"
+
+# Install required packges
+RUN set -eux; \
+    apk update && \
+    apk add --no-cache \
+        ca-certificates \
+        bash \
+        gnupg \
+        netcat-openbsd \
+        su-exec \
+        wget; \
+    rm -rf /var/cache/apk/*
+
+ARG GPG_KEY=AF3D175EC05DB249738D01AC8D8C3C3ED0B02E66
+ARG SHORT_DISTRO_NAME=zookeeper-3.9.2
+ARG DISTRO_NAME=apache-zookeeper-3.9.2-bin
+
+# Download Apache Zookeeper, verify its PGP signature, untar and clean up
+RUN set -eux; \
+    ddist() { \
+        local f="$1"; shift; \
+        local distFile="$1"; shift; \
+        local success=; \
+        local distUrl=; \
+        for distUrl in \
+            'https://www.apache.org/dyn/closer.cgi?action=download&filename=' \
+            https://www-us.apache.org/dist/ \
+            https://www.apache.org/dist/ \
+            https://archive.apache.org/dist/ \
+        ; do \
+            if wget -q -O "$f" "$distUrl$distFile" && [ -s "$f" ]; then \
+                success=1; \
+                break; \
+            fi; \
+        done; \
+        [ -n "$success" ]; \
+    }; \
+    ddist "$DISTRO_NAME.tar.gz" "zookeeper/$SHORT_DISTRO_NAME/$DISTRO_NAME.tar.gz"; \
+    ddist "$DISTRO_NAME.tar.gz.asc" "zookeeper/$SHORT_DISTRO_NAME/$DISTRO_NAME.tar.gz.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
+    gpg --keyserver hkps://keyserver.pgp.com --recv-key "$GPG_KEY" || \
+    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "$GPG_KEY" || \
+    gpg --keyserver hkps://pgp.mit.edu --recv-keys "$GPG_KEY"; \
+    gpg --batch --verify "$DISTRO_NAME.tar.gz.asc" "$DISTRO_NAME.tar.gz"; \
+    tar -zxf "$DISTRO_NAME.tar.gz"; \
+    mv "$DISTRO_NAME/conf/"* "$ZOO_CONF_DIR"; \
+    rm -rf "$GNUPGHOME" "$DISTRO_NAME.tar.gz" "$DISTRO_NAME.tar.gz.asc"; \
+    chown -R zookeeper:zookeeper "/$DISTRO_NAME"
+
+WORKDIR $DISTRO_NAME
+VOLUME ["$ZOO_DATA_DIR", "$ZOO_DATA_LOG_DIR", "$ZOO_LOG_DIR"]
+
+EXPOSE 2181 2888 3888 8080
+
+ENV PATH=$PATH:/$DISTRO_NAME/bin \
+    ZOOCFGDIR=$ZOO_CONF_DIR
+
+COPY docker-entrypoint.sh /
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["zkServer.sh", "start-foreground"]

3.9.2-alpine/docker-entrypoint.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+# Allow the container to be started with `--user`
+if [[ "$1" = 'zkServer.sh' && "$(id -u)" = '0' ]]; then
+    chown -R zookeeper "$ZOO_DATA_DIR" "$ZOO_DATA_LOG_DIR" "$ZOO_LOG_DIR"
+    su-exec zookeeper "$0" "$@"
+fi
+
+# Generate the config only if it doesn't exist
+if [[ ! -f "$ZOO_CONF_DIR/zoo.cfg" ]]; then
+    CONFIG="$ZOO_CONF_DIR/zoo.cfg"
+    {
+        echo "dataDir=$ZOO_DATA_DIR"
+        echo "dataLogDir=$ZOO_DATA_LOG_DIR"
+
+        echo "tickTime=$ZOO_TICK_TIME"
+        echo "initLimit=$ZOO_INIT_LIMIT"
+        echo "syncLimit=$ZOO_SYNC_LIMIT"
+
+        echo "autopurge.snapRetainCount=$ZOO_AUTOPURGE_SNAPRETAINCOUNT"
+        echo "autopurge.purgeInterval=$ZOO_AUTOPURGE_PURGEINTERVAL"
+        echo "maxClientCnxns=$ZOO_MAX_CLIENT_CNXNS"
+        echo "standaloneEnabled=$ZOO_STANDALONE_ENABLED"
+        echo "admin.enableServer=$ZOO_ADMINSERVER_ENABLED"
+    } >> "$CONFIG"
+    if [[ -z $ZOO_SERVERS ]]; then
+      ZOO_SERVERS="server.1=localhost:2888:3888;2181"
+    fi
+
+    for server in $ZOO_SERVERS; do
+        echo "$server" >> "$CONFIG"
+    done
+
+    if [[ -n $ZOO_4LW_COMMANDS_WHITELIST ]]; then
+        echo "4lw.commands.whitelist=$ZOO_4LW_COMMANDS_WHITELIST" >> "$CONFIG"
+    fi
+
+    for cfg_extra_entry in $ZOO_CFG_EXTRA; do
+        echo "$cfg_extra_entry" >> "$CONFIG"
+    done
+fi
+
+# Write myid only if it doesn't exist
+if [[ ! -f "$ZOO_DATA_DIR/myid" ]]; then
+    echo "${ZOO_MY_ID:-1}" > "$ZOO_DATA_DIR/myid"
+fi
+
+exec "$@"