
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Tool to build and install Docker containers with Chef, Dockerfile and other provisioning tools.
Features:
Other tools:
Docker-builder is similar to docker-compose but has some more functionality to customize installation of servers on the host.
Process of installing server in Docker container consists of the following stages:
Process of building and running container on the host machine:
Build Docker image
Run Docker container
docker run
Install systemd service on the host machine to run Docker container automatically (optional)
Start/Stop container
Destroy container
Destroy image
Concepts of running Docker containers:
Build Docker image:
Provision during installation container on the host machine by:
gem install docker-builder
We will build and run a simple Docker container with Nginx server.
gem install docker-builder
docker-builder generate --name=nginx --type=chef
it will create a folder nginx
with necessary directory structure inside.
config.rb
with common settingscommon({
'prefix' => "example-",
'image_prefix' => 'example-',
'dir_data' => '/disk3/data/my-examples/',
})
servers({
'nginx'=>{
# some server options here
},
})
base({
})
servers/nginx/config.rb
add 'build', {
"image_name" => "nginx",
'build_type' => 'chef',
"base_image" => { "name" => "nginx", "repository" => "nginx", "tag" => "1.10" },
}
add 'install', {
"host" => { 'script_type' => 'chef_recipe', 'script' => 'install_host', },
"node" => { 'script_type' => 'chef_recipe', 'script' => 'install', }
}
add 'docker', {
"command"=> "nginx -g 'daemon off;'",
'ports' => [
[8080,80],
],
'volumes' => [
['html', '/usr/share/nginx/html'],
['log/nginx', '/var/log/nginx/'],
],
'links' => [ ]
}
add 'attributes', {
'nginx' =>{
"sitename" =>"mysite.local"
},
}
# from the folder with project
docker-builder build
docker-builder up
docker ps
# see container named example-nginx
docker exec -ti example-nginx /bin/bash
http://localhost:8080
Process:
Create container - docker create
setup network and other settings for container
run provision to setup host machine. Script is running on the host machine.
{
'provision'=>{
'setup' => [
{type: 'shell', ..},
..
]
...
}
{
'provision'=>{
'setup'=> [
{type: 'ruby', <<script_options>>},
..
]
...
}
docker run
. Specify env variables, hostname and other options{
'provision'=>{
'bootstrap'=> [
{type: 'chef', ..},
..
]
}
{
'provision'=>{
'init'=> [
{type: 'chef'},
..
]
}
/path/to/project/ <<server_name>> / scripts / install.sh
Process of building and running container on the host machine:
Build Docker image
Run Docker container
Install systemd service to run Docker container (optional)
Start/Stop container
Destroy container
Destroy image
docker-builder generate --name=nginx --type=chef
it will create a folder nginx
config.rb
with common settings
servers/nginx/config.rb
# from the folder with project
docker-builder build
docker-builder up
docker ps
http://localhost:8080
cd /path/to/servers
docker-builder build -s server_name
cd /path/to/servers
docker-builder run -s server_name
it will run container.
access container:
docker exec -ti container_name /bin/bash
Run from outside container
'provision' => {
"bootstrap" => [
{'type' => 'shell', 'run_from'=>'host', 'script'=>'name=myserver ruby myprovision1.rb' }
]
}
it will run script name=myserver ruby myprovision1.rb
from the host machine.
'provision' => {
"bootstrap" => [
{'type' => 'chef', "script"=>"", "dir_base"=>"/opt/bootstrap", "recipe"=>"server::bootstrap" },
]
},
it will run chef provisioning:
cd /opt/bootstrap/ && chef-client -z -j /opt/bootstrap/config.json --override-runlist "recipe[server::bootstrap]"
config file with attributes (/opt/bootstrap/config.json
) for chef-client is generated automatically.
After checking out the repo, run bin/setup
to install dependencies.
You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
You can put all settings in this config.rb file and/or use config.rb file in each server's folder.
Config files:
/path/to/project/config.rb
/path/to/project/servers/server1/config.rb
/path/to/project/servers/server2/config.rb
Build types:
in folder with servers:
# /path/to/my/servers/.chef/knife.rb
cookbook_path cookbook_path+[
'/path/to/my/cookbooks',
'/path/to/my/other/cookbooks',
]
Example of building Docker container with Chef.
Assume that our server name is 'nginx'.
####
Chef recipes
cookbooks/nginx/recipes/build.rb place chef resources to be included in the Docker image
cookbooks/nginx/recipes/install.rb
cookbooks/nginx/recipes/install_host.rb
build
# run from the folder
docker-builder build['nginx']
data for nginx server:
/etc/nginx/conf.d
/var/www/html
/var/log/nginx
Main site - /var/www/html ==> /disk3/data/server-api/nginx-front/var/www/html
Config
'build' => {
'build_type' => 'Dockerfile',
"image_name" => "myname",
"base_image" => {} # not used
},
'build' => {
'build_type' => 'packer',
"image_name" => "myname",
"base_image" => {
"name" => "nginx",
"repository" => "nginx",
"tag" => "1.10"
},
"packer" => { options for packer }
},
options for packer
cookbook_paths - list of paths
recipe_name
examples:
'build' => {
'build_type' => 'none',
"image_name" => "myname",
"base_image" => {
"name" => "mysql",
"repository" => "mysql",
"tag" => "3.4.9"
},
},
it will NOT build a new Docker image.
docker-builder start -s server_name
it starts docker container which was previously created.
Process:
docker start ..
Packer is a tool for creating machine images for multiple platforms from a single source configuration.
run_extra_options
- additional options for docker run command
hostname
{
..
servers({
'zookeeper'=>{
...
'docker'=> {
...
'run_extra_options'=>'--hostname zookeeper'
}
}
Sometimes you need to clear cache with server info in chef-zero server
docker-builder clear_cache
docker-builder :up_swarm
docker-builder :destroy_swarm
docker: {
# options here...
}
prefix for image names, container names, and service names (for swarm mode)
prefix - common prefix. Added to all names
container_prefix - prefix for containers
image_prefix - prefix for images
service_prefix - prefix for services
Example:
prefix='my-'
container_prefix='test-'
container name will be like
my-test-redis
'provision' => {
"setup" => [
{ 'type' => 'shell', 'script' => 'scripts/mysetup.sh', },
]
},
scripts/mysetup.sh
Dockerfile
include script /opt/bootstrap/bootstrap.sh in container
ADD scripts/bootstrap.sh /opt/bootstrap/
RUN chmod +x /opt/bootstrap/bootstrap.sh
'provision' => {
"bootstrap" => [
{ 'type' => 'shell', 'script' => '/opt/bootstrap/bootstrap.sh', },
]
},
docker-builder up -s server_name
Process:
Docker networks can be created using docker command docker network create
Docker-builder allows you to manage networks for your container.
define IP in each network.
it assumes that networks 'my_bridge1' and 'my_overlay1' exist.
'docker'=> {
..
'network': {
default_gateway: '192.168.1.1',
networks: {
{net: 'bridge'}, # default docker bridge
{net: 'my_bridge1', ip: '10.1.0.12'},
{net: 'my_overlay1', ip: '51.1.0.15'},
}
}
}
in this example container will be connected to three networks: * docker default bridge named 'bridge' * custom docker network named 'my_bridge1' with ip='10.1.0.12' * custom docker network named 'my_overlay1'
create networks:
docker network create --driver bridge --subnet=51.1.0.0/16 --gateway=51.1.0.1 my_bridge1
docker network create -d macvlan --subnet=10.1.0.0/16 --gateway=10.1.0.1 --ip-range=10.1.12.0/24 -o parent=eth0 my_overlay1
see docker networks:
docker network ls
docker exec -ti mycontainer bash
ip route
# sample output
...
'docker'=> {
..
'network': {
networks: {
{net: 'bridge', action: 'remove'}, # remove default docker bridge
{net: 'mybridge1', ip: '10.1.0.12'},
{net: 'my_overlay1', ip: '51.1.0.15'},
}
}
}
FAQs
Unknown package
We found that docker-builder demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.