mirror of
https://github.com/bitnami/containers.git
synced 2026-10-17 22:50:16 +02:00
[bitnami/couchdb] Release 3.5.2-debian-12-r7 (#94314)
Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
This commit is contained in:
Bitnami Bot
@@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith"
|
||||
ARG TARGETARCH
|
||||
|
||||
LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
|
||||
org.opencontainers.image.created="2026-05-26T07:12:15Z" \
|
||||
org.opencontainers.image.created="2026-06-04T13:53:08Z" \
|
||||
org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
|
||||
org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/couchdb/README.md" \
|
||||
org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/couchdb" \
|
||||
@@ -28,20 +28,20 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
|
||||
DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
|
||||
mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
|
||||
COMPONENTS=( \
|
||||
"wait-for-port-1.0.10-10-linux-${OS_ARCH}-debian-12" \
|
||||
"ini-file-1.4.9-10-linux-${OS_ARCH}-debian-12" \
|
||||
"wait-for-port-1.0.10-11-linux-${OS_ARCH}-debian-12" \
|
||||
"ini-file-1.4.9-11-linux-${OS_ARCH}-debian-12" \
|
||||
"erlang-28.5.0-0-linux-${OS_ARCH}-debian-12" \
|
||||
"couchdb-3.5.2-1-linux-${OS_ARCH}-debian-12" \
|
||||
) ; \
|
||||
for COMPONENT in "${COMPONENTS[@]}"; do \
|
||||
if [ ! -f "${COMPONENT}.tar.gz" ]; then \
|
||||
curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
|
||||
curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \
|
||||
fi ; \
|
||||
sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \
|
||||
sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \
|
||||
tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \
|
||||
rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \
|
||||
done
|
||||
rm -rf "${COMPONENT}".tar.gz ; \
|
||||
done ; \
|
||||
rm -rf /opt/bitnami/checksums ;
|
||||
RUN apt-get update && apt-get upgrade -y && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives
|
||||
RUN chmod g+rwX /opt/bitnami
|
||||
@@ -51,8 +51,8 @@ COPY rootfs /
|
||||
RUN /opt/bitnami/scripts/couchdb/postunpack.sh
|
||||
ENV APP_VERSION="3.5.2" \
|
||||
BITNAMI_APP_NAME="couchdb" \
|
||||
IMAGE_REVISION="6" \
|
||||
LD_LIBRARY_PATH="/opt/bitnami/common/lib:$LD_LIBRARY_PATH" \
|
||||
IMAGE_REVISION="7" \
|
||||
LD_LIBRARY_PATH="/opt/bitnami/common/lib" \
|
||||
PATH="/opt/bitnami/common/bin:/opt/bitnami/erlang/bin:/opt/bitnami/couchdb/bin:$PATH"
|
||||
|
||||
VOLUME [ "/bitnami/couchdb" ]
|
||||
|
||||
+1
@@ -0,0 +1 @@
|
||||
f1341d1d1342e7ef1a1ab631e183296fcf812ec314990d1fc1ae71a87d8a6dc4 couchdb-3.5.2-1-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
2d212f47a0112cbd2435ad9029def10a14d770165ff80001bbe657e17a902bcc couchdb-3.5.2-1-linux-arm64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
77dc55bd65133a48d2a894bb9a55fc04700a8728e14bdb8e93466157f621eebb erlang-28.5.0-0-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
8db9f7267db1428069925b4c70c17c6b4df21531d393e05e2b04c69dccebcb0b erlang-28.5.0-0-linux-arm64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
4134a42e91271bd0a48f2d6d172910afdfbcaf5251bb8c8bd49e9700aa66d99f ini-file-1.4.9-11-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
caafc64b69e970f938d535c3aaf7e66420e0dba2c5cbd332e55ccdfd926eed66 ini-file-1.4.9-11-linux-arm64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
b8a9cd842e95ae16de5bbf157cc7e246c79a24d3b5b626bcce32f6904a895383 wait-for-port-1.0.10-11-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
ae2e822f8c673eb66a2cadbc6dc5fe9c8c0791564751e453a04a416ab9bd6f61 wait-for-port-1.0.10-11-linux-arm64-debian-12.tar.gz
|
||||
@@ -131,6 +131,7 @@ relativize() {
|
||||
# -d|--dir-mode - mode for files.
|
||||
# -u|--user - user
|
||||
# -g|--group - group
|
||||
# -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs)
|
||||
# Returns:
|
||||
# None
|
||||
#########################
|
||||
@@ -140,6 +141,7 @@ configure_permissions_ownership() {
|
||||
local file_mode=""
|
||||
local user=""
|
||||
local group=""
|
||||
local follow_symlinks="yes"
|
||||
|
||||
# Validate arguments
|
||||
shift 1
|
||||
@@ -161,6 +163,9 @@ configure_permissions_ownership() {
|
||||
shift
|
||||
group="${1:?missing group}"
|
||||
;;
|
||||
-n | --no-dereference)
|
||||
follow_symlinks="no"
|
||||
;;
|
||||
*)
|
||||
echo "Invalid command line flag $1" >&2
|
||||
return 1
|
||||
@@ -169,22 +174,29 @@ configure_permissions_ownership() {
|
||||
shift
|
||||
done
|
||||
|
||||
# -L: follow symlinks and emits the target path
|
||||
# This is dangerous at runtime, given a co-located lower-privileged process with write access
|
||||
# to the target path can redirect the chown/chmod to arbitrary paths. Example:
|
||||
# Lower-privileged process run: ln -s /etc /tmp/etc
|
||||
# Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp
|
||||
local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L")
|
||||
# -h: changes symlink inode ownership without touching the target.
|
||||
local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h")
|
||||
read -r -a filepaths <<<"$paths"
|
||||
for p in "${filepaths[@]}"; do
|
||||
if [[ -e "$p" ]]; then
|
||||
find -L "$p" -printf ""
|
||||
if [[ -n $dir_mode ]]; then
|
||||
find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode"
|
||||
find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode"
|
||||
fi
|
||||
if [[ -n $file_mode ]]; then
|
||||
find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode"
|
||||
find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode"
|
||||
fi
|
||||
if [[ -n $user ]] && [[ -n $group ]]; then
|
||||
find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}"
|
||||
find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}"
|
||||
elif [[ -n $user ]] && [[ -z $group ]]; then
|
||||
find -L "$p" -print0 | xargs -r -0 chown "${user}"
|
||||
find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}"
|
||||
elif [[ -z $user ]] && [[ -n $group ]]; then
|
||||
find -L "$p" -print0 | xargs -r -0 chgrp "${group}"
|
||||
find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}"
|
||||
fi
|
||||
else
|
||||
stderr_print "$p does not exist"
|
||||
|
||||
@@ -39,6 +39,7 @@ couchdb_env_vars=(
|
||||
COUCHDB_TLS_CERT_FILE
|
||||
COUCHDB_TLS_KEY_FILE
|
||||
COUCHDB_TLS_CA_FILE
|
||||
COUCHDB_TLS_SERVER_NAME_INDICATION
|
||||
)
|
||||
for env_var in "${couchdb_env_vars[@]}"; do
|
||||
file_env_var="${env_var}_FILE"
|
||||
@@ -86,5 +87,6 @@ export COUCHDB_INTERNODE_TLS_ENABLED="${COUCHDB_INTERNODE_TLS_ENABLED:-no}"
|
||||
export COUCHDB_TLS_CERT_FILE="${COUCHDB_TLS_CERT_FILE:-}"
|
||||
export COUCHDB_TLS_KEY_FILE="${COUCHDB_TLS_KEY_FILE:-}"
|
||||
export COUCHDB_TLS_CA_FILE="${COUCHDB_TLS_CA_FILE:-}"
|
||||
export COUCHDB_TLS_SERVER_NAME_INDICATION="${COUCHDB_TLS_SERVER_NAME_INDICATION:-}"
|
||||
|
||||
# Custom environment variables may be defined below
|
||||
|
||||
@@ -64,6 +64,13 @@ couchdb_validate() {
|
||||
fi
|
||||
done
|
||||
|
||||
# CouchDB TLS server name indication validations
|
||||
if is_boolean_yes "${COUCHDB_INTERNODE_TLS_ENABLED:-no}"; then
|
||||
if [[ "${COUCHDB_TLS_SERVER_NAME_INDICATION:-}" = "disable" ]]; then
|
||||
warn "COUCHDB_TLS_SERVER_NAME_INDICATION=disable suppresses hostname verification and makes internode TLS vulnerable to MITM. Only use this for troubleshooting, never in production."
|
||||
fi
|
||||
fi
|
||||
|
||||
# CouchDB create database validations
|
||||
if ! is_yes_no_value "$COUCHDB_CREATE_DATABASES"; then
|
||||
print_validation_error "The allowed values for COUCHDB_CREATE_DATABASES are [yes, no]"
|
||||
@@ -154,6 +161,12 @@ couchdb_update_vm_args_file() {
|
||||
fi
|
||||
if is_boolean_yes "${COUCHDB_INTERNODE_TLS_ENABLED:-no}"; then
|
||||
local ssl_dist_cfg="${COUCHDB_CONF_DIR}/ssl_dist.cfg"
|
||||
local sni_option=""
|
||||
if [[ "${COUCHDB_TLS_SERVER_NAME_INDICATION:-}" = "disable" ]]; then
|
||||
print -v sni_option ',\n {server_name_indication, disable}'
|
||||
elif [[ -n "${COUCHDB_TLS_SERVER_NAME_INDICATION:-}" ]]; then
|
||||
printf -v sni_option ',\n {server_name_indication, "%s"}' "${COUCHDB_TLS_SERVER_NAME_INDICATION}"
|
||||
fi
|
||||
cat > "${ssl_dist_cfg}" << EOF
|
||||
[{server,
|
||||
[{certfile, "${COUCHDB_TLS_CERT_FILE}"},
|
||||
@@ -165,8 +178,7 @@ couchdb_update_vm_args_file() {
|
||||
[{certfile, "${COUCHDB_TLS_CERT_FILE}"},
|
||||
{keyfile, "${COUCHDB_TLS_KEY_FILE}"},
|
||||
{cacertfile, "${COUCHDB_TLS_CA_FILE}"},
|
||||
{verify, verify_peer},
|
||||
{server_name_indication, disable}]}].
|
||||
{verify, verify_peer}${sni_option}]}].
|
||||
EOF
|
||||
couchdb_vm_args_set "-proto_dist" "couch"
|
||||
couchdb_vm_args_set "-couch_dist no_tls" "false"
|
||||
|
||||
+18
-17
@@ -76,23 +76,24 @@ The following tables list the main variables you can set.
|
||||
|
||||
#### Customizable environment variables
|
||||
|
||||
| Name | Description | Default Value |
|
||||
|---------------------------------|-------------------------------------------------------------------------------------------------------|---------------|
|
||||
| `COUCHDB_NODENAME` | Name of the CouchDB node. | `nil` |
|
||||
| `COUCHDB_PORT_NUMBER` | Port number used by CouchDB. | `nil` |
|
||||
| `COUCHDB_CLUSTER_PORT_NUMBER` | Port number used by CouchDB for clustering. | `nil` |
|
||||
| `COUCHDB_BIND_ADDRESS` | Address to which the CouchDB process will bind to. | `nil` |
|
||||
| `COUCHDB_CREATE_DATABASES` | Whether to create CouchDB system databases during initialization. Useful for clustering. | `yes` |
|
||||
| `COUCHDB_IGNORE_INITDB_SCRIPTS` | Skip execution of init scripts from COUCHDB_INITSCRIPTS_DIR. Set to yes on non-primary cluster nodes. | `no` |
|
||||
| `COUCHDB_USER` | CouchDB admin username. | `admin` |
|
||||
| `COUCHDB_PASSWORD` | Password for the CouchDB admin user. | `nil` |
|
||||
| `COUCHDB_SECRET` | CouchDB secret/token used for proxy and cookie authentication. | `nil` |
|
||||
| `COUCHDB_ERLANG_HMAX` | Per-process Erlang heap cap in bytes. Used to compute +hmax (value / 8 = word count). | `nil` |
|
||||
| `COUCHDB_EXTRA_VM_ARGS` | Additional Erlang VM arguments appended to vm.args. | `nil` |
|
||||
| `COUCHDB_INTERNODE_TLS_ENABLED` | Enable TLS encryption for the Erlang distribution protocol (inter-node communication). | `no` |
|
||||
| `COUCHDB_TLS_CERT_FILE` | Path to the TLS certificate file used for Erlang distribution encryption. | `nil` |
|
||||
| `COUCHDB_TLS_KEY_FILE` | Path to the TLS private key file used for Erlang distribution encryption. | `nil` |
|
||||
| `COUCHDB_TLS_CA_FILE` | Path to the CA certificate file used to verify peers during Erlang distribution. | `nil` |
|
||||
| Name | Description | Default Value |
|
||||
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
|
||||
| `COUCHDB_NODENAME` | Name of the CouchDB node. | `nil` |
|
||||
| `COUCHDB_PORT_NUMBER` | Port number used by CouchDB. | `nil` |
|
||||
| `COUCHDB_CLUSTER_PORT_NUMBER` | Port number used by CouchDB for clustering. | `nil` |
|
||||
| `COUCHDB_BIND_ADDRESS` | Address to which the CouchDB process will bind to. | `nil` |
|
||||
| `COUCHDB_CREATE_DATABASES` | Whether to create CouchDB system databases during initialization. Useful for clustering. | `yes` |
|
||||
| `COUCHDB_IGNORE_INITDB_SCRIPTS` | Skip execution of init scripts from COUCHDB_INITSCRIPTS_DIR. Set to yes on non-primary cluster nodes. | `no` |
|
||||
| `COUCHDB_USER` | CouchDB admin username. | `admin` |
|
||||
| `COUCHDB_PASSWORD` | Password for the CouchDB admin user. | `nil` |
|
||||
| `COUCHDB_SECRET` | CouchDB secret/token used for proxy and cookie authentication. | `nil` |
|
||||
| `COUCHDB_ERLANG_HMAX` | Per-process Erlang heap cap in bytes. Used to compute +hmax (value / 8 = word count). | `nil` |
|
||||
| `COUCHDB_EXTRA_VM_ARGS` | Additional Erlang VM arguments appended to vm.args. | `nil` |
|
||||
| `COUCHDB_INTERNODE_TLS_ENABLED` | Enable TLS encryption for the Erlang distribution protocol (inter-node communication). | `no` |
|
||||
| `COUCHDB_TLS_CERT_FILE` | Path to the TLS certificate file used for Erlang distribution encryption. | `nil` |
|
||||
| `COUCHDB_TLS_KEY_FILE` | Path to the TLS private key file used for Erlang distribution encryption. | `nil` |
|
||||
| `COUCHDB_TLS_CA_FILE` | Path to the CA certificate file used to verify peers during Erlang distribution. | `nil` |
|
||||
| `COUCHDB_TLS_SERVER_NAME_INDICATION` | SNI hostname sent in the TLS client hello for internode connections (leave unset to derive it automatically from the peer node name, set to an explicit hostname, or set to "disable" that suppresses hostname verification | `nil` |
|
||||
|
||||
#### Read-only environment variables
|
||||
|
||||
|
||||
Reference in New Issue
Block a user