{"id":18687402,"url":"https://github.com/alfresco/alfresco-dockerfiles-bakery","last_synced_at":"2025-04-12T05:26:53.682Z","repository":{"id":260075636,"uuid":"790064205","full_name":"Alfresco/alfresco-dockerfiles-bakery","owner":"Alfresco","description":"Alfresco Dockerfiles Bakery 🍞 - a tool designed to simplify the deployment of the Alfresco platform and assist you in building tailored container images, with the help of Docker Bake.","archived":false,"fork":false,"pushed_at":"2025-04-09T06:04:34.000Z","size":383,"stargazers_count":8,"open_issues_count":4,"forks_count":6,"subscribers_count":31,"default_branch":"main","last_synced_at":"2025-04-09T07:22:08.598Z","etag":null,"topics":["alfresco","docker","docker-bake","docker-images"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Alfresco.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":"audit-storage/Dockerfile","citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-04-22T07:42:39.000Z","updated_at":"2025-03-31T10:39:41.000Z","dependencies_parsed_at":"2024-11-12T16:27:25.224Z","dependency_job_id":"baa3f1b6-65dc-4d7b-9408-fa91722d978b","html_url":"https://github.com/Alfresco/alfresco-dockerfiles-bakery","commit_stats":null,"previous_names":["alfresco/alfresco-dockerfiles-bakery"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alfresco%2Falfresco-dockerfiles-bakery","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alfresco%2Falfresco-dockerfiles-bakery/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alfresco%2Falfresco-dockerfiles-bakery/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Alfresco%2Falfresco-dockerfiles-bakery/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Alfresco","download_url":"https://codeload.github.com/Alfresco/alfresco-dockerfiles-bakery/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248521352,"owners_count":21118054,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["alfresco","docker","docker-bake","docker-images"],"created_at":"2024-11-07T10:32:42.338Z","updated_at":"2025-04-12T05:26:53.670Z","avatar_url":"https://github.com/Alfresco.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Alfresco Dockerfiles Bakery 🍞\n\n[![release](https://img.shields.io/github/v/release/Alfresco/alfresco-dockerfiles-bakery?display_name=release)](https://github.com/Alfresco/alfresco-dockerfiles-bakery/releases/latest)\n[![CI](https://github.com/Alfresco/alfresco-dockerfiles-bakery/actions/workflows/build_and_test.yml/badge.svg)](https://github.com/Alfresco/alfresco-dockerfiles-bakery/actions/workflows/build_and_test.yml)\n[![CI from forks](https://github.com/Alfresco/alfresco-dockerfiles-bakery/actions/workflows/build_forks.yml/badge.svg)](https://github.com/Alfresco/alfresco-dockerfiles-bakery/actions/workflows/build_forks.yml)\n\nAs outlined in the [Hyland Alfresco support\npolicy](https://docs.alfresco.com/support/latest/policies/deployment/),\npre-built container images are intended as reference for creating your own\ncustomized images, incorporating deployment guidelines, security best practices,\nand any necessary custom extensions. While this policy remains unchanged, we are\nsupporting the community further by open-sourcing the Alfresco Dockerfiles\nBakery, a tool designed to simplify the deployment of the Alfresco platform and\nassist you in building tailored container images, with the help of [Docker\nBake](https://docs.docker.com/build/bake/).\n\n- [Alfresco Dockerfiles Bakery 🍞](#alfresco-dockerfiles-bakery-)\n  - [Prerequisites](#prerequisites)\n    - [Nexus authentication](#nexus-authentication)\n  - [Getting started quickly](#getting-started-quickly)\n  - [Customizing the images](#customizing-the-images)\n    - [Customizing the Alfresco Content Repository image](#customizing-the-alfresco-content-repository-image)\n  - [Supported Architectures](#supported-architectures)\n    - [Targeting a specific architecture](#targeting-a-specific-architecture)\n    - [Multi-arch images](#multi-arch-images)\n  - [Building older versions](#building-older-versions)\n  - [Testing locally](#testing-locally)\n    - [Testing with helm](#testing-with-helm)\n    - [Testing with docker compose](#testing-with-docker-compose)\n  - [Security scanning](#security-scanning)\n  - [Release](#release)\n\n## Prerequisites\n\nBuilding images requires the following tools:\n\n- A recent enough Docker installation (with `buildx` support)\n- Credentials to access the Alfresco artifacts (Nexus server), if building\n  Enterprise images\n- Some common unix tools: `jq`, `yq`, `wget`, `make`\n- Python 3 with pyyaml (`pip install pyyaml`) for fetching artifacts via the\n  `fetch-artifacts.py` script\n\n### Nexus authentication\n\nConfiguring the authentication to Alfresco Nexus server must be done using one\nof the standard `wget` configuration files, like `~/.netrc`.\n\nUsing your preferred editor, create `~/.netrc` with the following contents:\n\n```sh\nmachine nexus.alfresco.com\nlogin myuser\npassword mypassword\n```\n\nMake sure to make the file non-world readable:\n\n```sh\nchmod 600 ~/.netrc\n```\n\n## Getting started quickly\n\nIf you do not plan on applying specific customizations but just want to get\nAlfresco images updated (e.g. with the latest OS security patches), you can\nsimply run the command below from the root of this project:\n\n```sh\nmake enterprise\n```\n\nor for Community edition:\n\n```sh\nmake community\n```\n\nThis command will build locally all the docker images this project offers.\n\nFor more information on the available images, browse the top level folders,\nexcluding `artifacts_cache`, `scripts` and `test`.\n\nFor more information on the available targets, run:\n\n```sh\nmake help\n```\n\nBelow are some environment variables which can be used to customize the build\nprocess:\n\n- `REGISTRY`: The registry where the images will be pushed (authentication is\n  ensured by the `make` wrapper)\n- `REGISTRY_NAMESPACE`: The namespace where the images will be pushed (e.g.\n  REGISTRY/REGISTRY_NAMESPACE/IMAGE_NAME:TAG)\n- `TAG`: The tag to use for the images (default is `latest`)\n- `TARGETARCH`: The architecture to build the images for (default is the\n  architecture of the system where the build is run). See [Supported\n  Architectures](#supported-architectures) for more information.\n- `BAKE_NO_CACHE`: Set to `1` to disable the cache during the build process\n- `BAKE_NO_PROVENANCE`: Set to `1` to not add provenance metadata during the build\n  process. This is mostly useful if your registry do not support it.\n\nFor example, to build multi-arch images for ARM64 and X86_64 and push them to a\ncustom registry, you can run the following command:\n\n```sh\nexport REGISTRY=myecr.domain.tld REGISTRY_NAMESPACE=myalfrescobuilds TARGETARCH=linux/amd64,linux/arm64\nmake all\n```\n\n## Customizing the images\n\n### Customizing the Alfresco Content Repository image\n\nThe Alfresco Content Repository image can be customized by adding different\ntypes of files in the right locations:\n\n- Alfresco Module Packages (AMPs) files in the [amps](repository/amps/README.md)\n  folder\n  - Enterprise-only AMPs files in the [amps-enterprise](repository/amps_enterprise/README.md)\n    folder\n  - Community-only AMPs files in the [amps-community](repository/amps_community/README.md)\n    folder\n- Additional JAR files for the JRE in the [libs](repository/libs/README.md) folder\n\n## Supported Architectures\n\nDepending on the environment where you plan to run the docker images you build,\nit is possible to build Alfresco images the following architectures:\n\n- X86_64 (linux/amd64): Regular intel processor based systems\n- ARM64 (linux/arm64): ARM processor based systems (e.g. Apple Silicon or AWS\n  Graviton)\n\nBy default, the images are built for the architecture of the system where the\nbuild is run.\n\n### Targeting a specific architecture\n\nTo build images for a specific architecture, you can set the `TARGETARCH`\nenvironment variable to the desired architecture.\nFor example, to build all Alfresco images for ARM64, you can run the following\ncommand:\n\n```sh\nexport TARGETARCH=linux/arm64\nmake all\n```\n\nTo build just a specific image use you'll need to use `docker buildx bake`\ndirectly, but the `TARGETARCH` environment variable also works:\n\n```sh\nexport TARGETARCH=linux/arm64\ndocker buildx bake tengine_imagemagick\n```\n\n### Multi-arch images\n\nImages can be built with multi-arch support. This is done by using the\nsame environment variable as above, and passing target architectures as a\ncomma-separated list.\nBy doing so, you're not solely build an image and its manifest, but a list of\nmanifests for each target architecture. That makes it possible to reference the\nsame image name and tag, and have the right image pulled for the right\narchitecture.\n\n```sh\nexport TARGETARCH=linux/amd64,linux/arm64\nmake all\n```\n\nIt's important to note that building multi-arch images requires the use of\nDocker BuildKit, which is enabled by default in Docker 20.10 and later and\nalso requires images to be pushed to a registry that supports multi-arch.\n\n:warning: Multi-arch build cannot be loaded into the local docker image cache.\nThis is due to a limitation of the `docker` exporter in BuildKit.\nIn order to produce multi-arch images one needs to:\n\n- Set the REGISTRY environment variable to the target registry\n- Set the REGISTRY_NAMESPACE environment variable to the target namespace\n\nThe `make` wrapper would handle the authentication part for you:\n\n```sh\nexport REGISTRY=myecr.domain.tld REGISTRY_NAMESPACE=myalfrescobuilds TARGETARCH=linux/amd64,linux/arm64\nmake repo\n```\n\nYou can also run bake directly but you need to be sure to have done the\nauthentication before running the `docker buildx bake` command with an\nadditional argument to tell the tool to push the images to the registry:\n\n```sh\nexport REGISTRY=myecr.domain.tld REGISTRY_NAMESPACE=myalfrescobuilds TARGETARCH=linux/amd64,linux/arm64\ndocker buildx bake repo --set *.output=type=registry,push=true\n```\n\n## Building older versions\n\nVersions of artifacts being downloaded specific to the ACS version are defined\nin `artifacts-XX.yaml` files for each component.\n\nTo build older version pass `ACS_VERSION` env to make command.\n- ACS 23  - `ACS_VERSION=23` - Will use `artifacts-23.yaml` files\n- ACS 7.4 - `ACS_VERSION=74` - Will use `artifacts-74.yaml` files\n- ACS 7.3 - `ACS_VERSION=73` - Will use `artifacts-73.yaml` files\n\n```sh\nmake enterprise ACS_VERSION=74\n```\n\nWhen using `make`, it sets the correct version of Tomcat based on the ACS version.\nIf you want to build older version of images using `docker buildx bake` it is\nrequired to set the Tomcat versions manually in bake file or using env\nvariables.\n\n```sh\nexport TOMCAT_VERSIONS_FILE=tomcat/tomcat_versions.yaml\nexport TOMCAT_MAJOR=$(yq e '.tomcat9.major' $TOMCAT_VERSIONS_FILE)\nexport TOMCAT_VERSION=$(yq e '.tomcat9.version' $TOMCAT_VERSIONS_FILE)\nexport TOMCAT_SHA512=$(yq e '.tomcat9.sha512' $TOMCAT_VERSIONS_FILE)\ndocker buildx bake tomcat_base\n```\n\nBefore switching build to other version clean the artifacts using `make clean`\nthen fetch correct version with e.g.:\n\n```sh\nmake clean prepare ACS_VERSION=74\n```\n\nArtifacts set in the artifacts file are fetched from the Nexus repository and\ntheir checksum is verified, provided the artifact has a checksum value which is\na concatenation of the algorithm and optionally the checksum in the format\n`\u003calgorithm\u003e:\u003cchecksum\u003e`. If the checksum is not provided, the script will\ntry to fetch it from the Nexus repository reusing the computed artifact url and\nappending the `.algorithm` extension to it.\n\n## Testing locally\n\nOnce the images are built, you can test them locally using either Helm or Docker Compose.\n\n### Testing with helm\n\nFollow the general instructions for [installing Alfresco on\nKinD](https://alfresco.github.io/acs-deployment/docs/helm/kind-deployment.html)\nuntil the point where you have to run `helm install`.\n\nIf the images has not been pushed to a remote repository, you can easily load\nall the locally built images in the local KinD cluster with:\n\n```sh\nkind load docker-image $(docker images --format \"{{.Repository}}\" | grep \"^localhost/alfresco\" | xargs)\n```\n\nBefore running the `helm install` command, you need adjust the registry and\nimage namespace references in the provided\n[test-overrides.yaml](test/helm/test-overrides.yaml) file:\n\n```sh\nREGISTRY=localhost REGISTRY_NAMESPACE=alfresco TAG=latest\nsed -i \"s|localhost/alfresco/|${REGISTRY}/${REGISTRY_NAMESPACE}/|g\" test/helm/test-overrides.yaml\nsed -i \"s|tag: latest|tag: ${TAG}|g\" test/helm/test-overrides.yaml\n```\n\nIf you are testing the community edition, you also need to adjust the image\nreferences for the Share and Repository images:\n\n```sh\nsed -i \"s|/alfresco-content-repository|/alfresco-content-repository-community|g\" test/helm/test-overrides.yaml\nsed -i \"s|/alfresco-share|/alfresco-share-community|g\" test/helm/test-overrides.yaml\n```\n\nThen you can finally run `helm install` passing as values the provided files.\n\nFor enterprise edition:\n\n```sh\nhelm install acs alfresco/alfresco-content-services \\\n  --values=test/helm/enterprise-integration-test-values.yaml \\\n  --values=test/helm/test-overrides.yaml \\\n  --values=test/helm/test-overrides-enterprise.yaml \\\n  --atomic \\\n  --timeout 10m0s \\\n  --namespace alfresco\n```\n\nFor community edition:\n\n```sh\nhelm install acs alfresco/alfresco-content-services \\\n  --values=test/helm/community_values.yaml \\\n  --values=test/helm/community-integration-test-values.yaml \\\n  --values=test/helm/test-overrides.yaml \\\n  --values=test/helm/test-overrides-community.yaml \\\n  --set global.search.sharedSecret=$(openssl rand -hex 24) \\\n  --atomic \\\n  --timeout 10m0s \\\n  --namespace=alfresco\n```\n\n### Testing with docker compose\n\nYou can use Docker Compose to test the built images locally as follows:\n\n1. Fetch upstream compose definitions from acs-deployment repository:\n\n   ```sh\n   git clone https://github.com/Alfresco/acs-deployment.git\n   ```\n\n2. Copy the compose files from the acs-deployment repository to the test folder\n   of this repository:\n\n   ```sh\n   cp -r acs-deployment/docker-compose/* test/\n   ```\n\n3. Run compose together with one of the available override files, which allow\n   you to easily reference built images using\n   `$REGISTRY/$REGISTRY_NAMESPACE/component-name:$TAG` format:\n\n   ```sh\n   REGISTRY=localhost REGISTRY_NAMESPACE=alfresco TAG=latest\n   docker compose -f test/compose.yaml -f test/enterprise-override.yaml up -d\n   ```\n\n   For community edition instead:\n\n    ```sh\n    REGISTRY=localhost REGISTRY_NAMESPACE=alfresco TAG=latest\n    docker compose -f test/community-compose.yaml -f test/community-override.yaml up -d\n    ```\n\n## Security scanning\n\nThe images built by this project may be scanned for vulnerabilities using Grype,\nif the `grype` binary is available in the PATH.\n\n\u003e Grype is an open-source scanner for container images, ideal for identifying\n\u003e recent vulnerabilities, especially within base OS images. While it supports\n\u003e application libraries, it lacks reachability analysis, meaning it cannot\n\u003e confirm whether vulnerabilities are actually exploitable in the context of the\n\u003e application. For accurate insights, refer to Alfresco Security bulletins and\n\u003e contact Hyland support, as these sources provide vetted information after\n\u003e manual triaging of scanner findings within the application code. Remember to\n\u003e always assess findings within the context of your specific deployment.\n\nIf you want to run the security scan manually, you can use the following command:\n\n```sh\nmake grype GRYPE_TARGET=repo GRYPE_OPTS=\"-f high --only-fixed --ignore-states wont-fix\"\n```\n\nYou can pass `GRYPE_OPTS` to override the default options passed to Grype, which\nby default exit with a non-zero status if any vulnerability greater than high is\nfound and is filtering out known issues for which a fix is not available (yet or\never).\n\nYou can also run grype automatically at the end of the build process by setting\n`GRYPE_ONBUILD`:\n\n```sh\nmake all GRYPE_ONBUILD=1\n```\n\n## Release\n\n- Ensure that the\n  [supported-matrix](https://github.com/Alfresco/alfresco-updatecli/blob/master/deployments/values/supported-matrix.yaml)\n  reflects the status of the currently released Alfresco products and update if\n  necessary before proceeding.\n- Ensure that every `updatecli_amps_release_branch` is in sync with the related\n  acs version in every `artifacts-*.yaml` files for both `repository` and\n  `share` images.\n- Run the [updatecli\n  workflow](https://github.com/Alfresco/alfresco-dockerfiles-bakery/actions/workflows/bumpVersions.yml)\n  and review the changes.\n- Agree on a name for the release and make sure to add it to the release notes.\n\nOnce everything has been merged to master, you can proceed to create a release with:\n\n```sh\ngh release create v0.2.0 -t \"🍞 Fougasse v0.2.0\" --generate-notes -d\n```\n\nFinally review the autogenerated release notes, remove not so interesting\nchanges (e.g. GHA tuning and dependabot), highlight most interesting ones for\nthe end users and publish the release.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falfresco%2Falfresco-dockerfiles-bakery","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falfresco%2Falfresco-dockerfiles-bakery","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falfresco%2Falfresco-dockerfiles-bakery/lists"}