[bitnami/solr] Release 10.0.0-debian-12-r10 (#94065)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
2026-10-19 20:32:34 +02:00 · 2026-05-29 19:19:37 +02:00
parent 654bd1c80b
commit ae343ca751
13 changed files with 120 additions and 68 deletions
@@ -8,7 +8,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security"
 ARG TARGETARCH

 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-05-23T11:39:27Z" \
+      org.opencontainers.image.created="2026-05-29T16:44:54Z" \
      org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
      org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/solr/README.md" \
      org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/solr" \
@@ -35,12 +35,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
    for COMPONENT in "${COMPONENTS[@]}"; do \
      if [ ! -f "${COMPONENT}.tar.gz" ]; then \
        curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
-        curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \
      fi ; \
-      sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \
+      sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \
      tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \
-      rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \
-    done
+      rm -rf "${COMPONENT}".tar.gz ; \
+    done ; \
+    rm -rf /opt/bitnami/checksums ;
 RUN apt-get update && apt-get upgrade -y && \
    apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives
 RUN chmod g+rwX /opt/bitnami
@@ -51,7 +51,7 @@ RUN /opt/bitnami/scripts/java/postunpack.sh
 RUN /opt/bitnami/scripts/solr/postunpack.sh
 ENV APP_VERSION="10.0.0" \
    BITNAMI_APP_NAME="solr" \
-    IMAGE_REVISION="9" \
+    IMAGE_REVISION="10" \
    JAVA_HOME="/opt/bitnami/java" \
    PATH="/opt/bitnami/java/bin:/opt/bitnami/solr/bin:/opt/bitnami/solr/prometheus-exporter/bin:/opt/bitnami/solr/contrib/prometheus-exporter/bin:$PATH"

@@ -6,6 +6,7 @@ services:
    image: docker.io/bitnami/solr:10
    environment:
      - SOLR_ENABLE_AUTHENTICATION=yes
+      - SOLR_ADMIN_PASSWORD=bitnami
    ports:
      - '8983:8983'
    volumes:
@@ -0,0 +1 @@
+190f3814d0362c10bc2373945a5fe00ff46aa2980ac2224528a32c7766a2b72d  jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz
@@ -0,0 +1 @@
+08f71653cfeafd8e168835acfa95678ad52649c0b8c3512d285cedead2ea0a62  jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz
@@ -0,0 +1 @@
+ecc43e1256883245225cbfd8540876d98831ead4e92779dbea977f6aacca13f3  solr-10.0.0-2-linux-amd64-debian-12.tar.gz
@@ -0,0 +1 @@
+9f881d4aec698e7a2afced8ce2aace63fee9567c8981057a8a79ae8af42e7c55  solr-10.0.0-2-linux-arm64-debian-12.tar.gz
@@ -139,3 +139,40 @@ wait_for_log_entry() {
        return 1
    fi
 }
+
+########################
+# Creates a secure temporary file containing the provided secret
+# Arguments:
+#   $1 - secret to write to the temporary file
+# Returns:
+#   String
+#########################
+credential_to_temp_file() {
+    local secret="$1"
+    local tmp_file
+
+    # Use mktemp with a specific prefix for easier debugging if something lingers
+    if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then
+        echo "Error: Failed to create temp file" >&2
+        return 1
+    fi
+
+    # Restrict permissions before writing the secret
+    chmod 0600 "$tmp_file"
+    # Write secret and ensure it's flushed to disk
+    printf "%s" "$secret" > "$tmp_file"
+    # Output the filename so the caller can capture it
+    echo "$tmp_file"
+}
+
+########################
+# Cleans up temporary files created by credential_to_temp_file
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+cleanup_credentials() {
+    debug "Cleaning up temporary files containing credentials"
+    rm -rf "${TMPDIR:-/tmp}"/at.cred.*
+}
@@ -131,6 +131,7 @@ relativize() {
 #   -d|--dir-mode - mode for files.
 #   -u|--user - user
 #   -g|--group - group
+#   -n|--no-dereference - do not follow symlinks (use for runtime root chown of daemon-writable dirs)
 # Returns:
 #   None
 #########################
@@ -140,6 +141,7 @@ configure_permissions_ownership() {
    local file_mode=""
    local user=""
    local group=""
+    local follow_symlinks="yes"

    # Validate arguments
    shift 1
@@ -161,6 +163,9 @@ configure_permissions_ownership() {
            shift
            group="${1:?missing group}"
            ;;
+        -n | --no-dereference)
+            follow_symlinks="no"
+            ;;
        *)
            echo "Invalid command line flag $1" >&2
            return 1
@@ -169,22 +174,29 @@ configure_permissions_ownership() {
        shift
    done

+    # -L: follow symlinks and emits the target path
+    # This is dangerous at runtime, given a co-located lower-privileged process with write access
+    # to the target path can redirect the chown/chmod to arbitrary paths. Example:
+    # Lower-privileged process run: ln -s /etc /tmp/etc
+    # Then, setup.sh runs: configure_permissions_ownership --dir-mode 775 /tmp
+    local find_L_flag=(); [[ "$follow_symlinks" == "yes" ]] && find_L_flag=("-L")
+    # -h: changes symlink inode ownership without touching the target.
+    local chown_flags=(); [[ "$follow_symlinks" == "no" ]] && chown_flags=("-h")
    read -r -a filepaths <<<"$paths"
    for p in "${filepaths[@]}"; do
        if [[ -e "$p" ]]; then
-            find -L "$p" -printf ""
            if [[ -n $dir_mode ]]; then
-                find -L "$p" -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode"
+                find "${find_L_flag[@]}" "$p" -not -type l -type d ! -perm "$dir_mode" -print0 | xargs -r -0 chmod "$dir_mode"
            fi
            if [[ -n $file_mode ]]; then
-                find -L "$p" -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode"
+                find "${find_L_flag[@]}" "$p" -not -type l -type f ! -perm "$file_mode" -print0 | xargs -r -0 chmod "$file_mode"
            fi
            if [[ -n $user ]] && [[ -n $group ]]; then
-                find -L "$p" -print0 | xargs -r -0 chown "${user}:${group}"
+                find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}:${group}"
            elif [[ -n $user ]] && [[ -z $group ]]; then
-                find -L "$p" -print0 | xargs -r -0 chown "${user}"
+                find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chown "${chown_flags[@]}" "${user}"
            elif [[ -z $user ]] && [[ -n $group ]]; then
-                find -L "$p" -print0 | xargs -r -0 chgrp "${group}"
+                find "${find_L_flag[@]}" "$p" -print0 | xargs -r -0 chgrp "${chown_flags[@]}" "${group}"
            fi
        else
            stderr_print "$p does not exist"
@@ -24,13 +24,15 @@
 #   None
 #########################
 solr_generate_initial_security() {
+    local pw_hash
+    pw_hash="$(solr_hash_password "$SOLR_ADMIN_PASSWORD")"
    info "Generating initial security file"
    cat >"${SOLR_BASE_DIR}/server/solr/security.json" <<EOF
 {
 "authentication":{
   "blockUnknown": true,
   "class":"solr.BasicAuthPlugin",
-   "credentials":{"${SOLR_ADMIN_USERNAME}":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="},
+   "credentials":{"${SOLR_ADMIN_USERNAME}":"${pw_hash}"},
   "forwardCredentials": false
 },
 "authorization":{
@@ -42,7 +44,7 @@ solr_generate_initial_security() {
 EOF

    if am_i_root; then
-        configure_permissions_ownership "${SOLR_BASE_DIR}/server/solr/security.json" -u "$SOLR_DAEMON_USER" -g "$SOLR_DAEMON_GROUP"
+        configure_permissions_ownership "${SOLR_BASE_DIR}/server/solr/security.json" -u "$SOLR_DAEMON_USER" -g "$SOLR_DAEMON_GROUP" -n
    fi
 }

@@ -208,38 +210,6 @@ solr_create_cores() {
    done
 }

-#########################
-# Update user password
-# Globals:
-#   SOLR_*
-# Arguments:
-#   $1 - username
-#   $2 - password
-# Returns:
-#   None
-#########################
-solr_update_password() {
-    local -r exec="curl"
-    local -r default_password="SolrRocks"
-    local -r username="${1:?user is required}"
-    local -r password="${2:?password is required}"
-    local protocol="http"
-    local command_args=()
-
-    is_boolean_yes "$SOLR_SSL_ENABLED" && protocol="https" && command_args+=("-k")
-
-    command_args+=("--silent" "--user" "${username}:${default_password}" "${protocol}://localhost:${SOLR_PORT_NUMBER}/api/cluster/security/authentication" "-H" "'Content-type:application/json'" "-d" "{\"set-user\":{\"${username}\":\"${password}\"}}")
-
-    info "Updating user password"
-
-    if ! debug_execute "$exec" "${command_args[@]}"; then
-        error "There was an error when updating the user password"
-        exit 1
-    else
-        info "Password updated"
-    fi
-}
-
 #########################
 # Check if the API is ready
 # Globals:
@@ -325,22 +295,23 @@ solr_auth_already_enabled() {
 #   None
 #########################
 solr_create_cloud_user() {
-    local -r exec="${SOLR_BIN_DIR}/solr"
    local -r username="${1:?user is required}"
    local -r password="${2:?password is required}"
+    # We can't pass the credentials using a pipe nor read them from a temporary file
+    # to avoid plaintext-on-cmdline exposure (CLI limitations)
    local command_args=("auth" "enable" "-type" "basicAuth" "-credentials" "${username}:${password}" "-block-unknown" "true" "-z" "${SOLR_ZK_HOSTS}${SOLR_ZK_CHROOT}")

    info "Creating user: ${username}"

    if ! solr_auth_already_enabled; then
-      if ! debug_execute "$exec" "${command_args[@]}"; then
-          error "There was an error when creating the user"
-          exit 1
-      else
-          info "User created"
-      fi
+        if ! debug_execute "${SOLR_BIN_DIR}/solr" "${command_args[@]}"; then
+            error "There was an error when creating the user"
+            exit 1
+        else
+            info "User created"
+        fi
    else
-      info "Skipping. Security is already enabled."
+        info "Skipping. Security is already enabled."
    fi
 }

@@ -587,7 +558,7 @@ solr_migrate_old_data() {
        warn "Persisted data detected in old location. Migrating and changing permissions"
        ensure_dir_exists "${SOLR_VOLUME_DIR}/server"
        debug_execute "$exec" "${command_args[@]}"
-        configure_permissions_ownership "${SOLR_VOLUME_DIR}/server/solr" -d 775 -f 664 -g "root"
+        configure_permissions_ownership "${SOLR_VOLUME_DIR}/server/solr" -d 775 -f 664 -g "root" -n
        warn "Data migrated."
    else
        error "Persisted data detected in old location. You will need to run first the container as root to migrate the data"
@@ -595,6 +566,31 @@ solr_migrate_old_data() {
    fi
 }

+#########################
+# Hash a password
+# Arguments:
+#   $1 - Password
+# Returns:
+#   Hashed password
+#########################
+solr_hash_password() {
+    local password="$1"
+    local tmp_dir
+    tmp_dir="$(mktemp -d)"
+    trap 'rm -rf "${tmp_dir}"' RETURN ERR
+
+    # Generate 32-byte random salt
+    dd if=/dev/urandom bs=32 count=1 2>/dev/null > "${tmp_dir}/salt.bin"
+    # h1 = SHA256(salt || password)
+    { cat "${tmp_dir}/salt.bin"; printf '%s' "$password"; } | openssl dgst -sha256 -binary > "${tmp_dir}/h1.bin"
+    # h2 = SHA256(h1) — matches Sha256AuthenticationProvider.getSaltedHashedValue()
+    openssl dgst -sha256 -binary < "${tmp_dir}/h1.bin" > "${tmp_dir}/h2.bin"
+
+    printf '%s %s\n' \
+        "$(openssl base64 -A < "${tmp_dir}/h2.bin")" \
+        "$(openssl base64 -A < "${tmp_dir}/salt.bin")"
+}
+
 #########################
 # Initialize SOLR
 # Globals:
@@ -631,15 +627,16 @@ solr_initialize() {

            if is_boolean_yes "$SOLR_CLOUD_BOOTSTRAP"; then
                solr_zk_initialize
+                # Security FIRST: write credentials to ZK before Solr binds to 0.0.0.0
+                is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && solr_create_cloud_user "$SOLR_ADMIN_USERNAME" "$SOLR_ADMIN_PASSWORD"

                solr_start_bg "cloud"
-
-                solr_wait_for_api "admin" "SolrRocks"
+                local api_password="SolrRocks"
+                is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && api_password="$SOLR_ADMIN_PASSWORD"
+                solr_wait_for_api "admin" "$api_password"

                is_boolean_yes "$SOLR_SSL_ENABLED" && solr_set_ssl_url_scheme
-
                [[ -n "$SOLR_COLLECTION" ]] && solr_create_collection
-                is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && solr_create_cloud_user "$SOLR_ADMIN_USERNAME" "$SOLR_ADMIN_PASSWORD"

                solr_stop
            else
@@ -659,10 +656,9 @@ solr_initialize() {
            is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && solr_generate_initial_security

            solr_start_bg
-
-            solr_wait_for_api "admin" "SolrRocks"
-
-            is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && solr_update_password "$SOLR_ADMIN_USERNAME" "$SOLR_ADMIN_PASSWORD"
+            local api_password="SolrRocks"
+            is_boolean_yes "$SOLR_ENABLE_AUTHENTICATION" && api_password="$SOLR_ADMIN_PASSWORD"
+            solr_wait_for_api "admin" "$api_password"

            [[ -n "$SOLR_CORES" ]] && solr_create_cores

@@ -96,11 +96,11 @@ export SOLR_COLLECTION_REPLICAS="${SOLR_COLLECTION_REPLICAS:-1}"
 export SOLR_COLLECTION_SHARDS="${SOLR_COLLECTION_SHARDS:-1}"
 export SOLR_ENABLE_AUTHENTICATION="${SOLR_ENABLE_AUTHENTICATION:-no}"
 export SOLR_ADMIN_USERNAME="${SOLR_ADMIN_USERNAME:-admin}"
-export SOLR_ADMIN_PASSWORD="${SOLR_ADMIN_PASSWORD:-bitnami}"
+export SOLR_ADMIN_PASSWORD="${SOLR_ADMIN_PASSWORD:-}"
 export SOLR_CLOUD_BOOTSTRAP="${SOLR_CLOUD_BOOTSTRAP:-no}"
 export SOLR_CORE_CONF_DIR="${SOLR_CORE_CONF_DIR:-${SOLR_SERVER_DIR}/solr/configsets/_default/conf}"
 export SOLR_SSL_ENABLED="${SOLR_SSL_ENABLED:-no}"
-export SOLR_SSL_CHECK_PEER_NAME="${SOLR_SSL_CHECK_PEER_NAME:-false}"
+export SOLR_SSL_CHECK_PEER_NAME="${SOLR_SSL_CHECK_PEER_NAME:-true}"
 export SOLR_SSL_KEY_STORE_PASSWORD="${SOLR_SSL_KEY_STORE_PASSWORD:-}"
 export SOLR_SSL_TRUST_STORE_PASSWORD="${SOLR_SSL_TRUST_STORE_PASSWORD:-}"

@@ -86,17 +86,17 @@ The following tables list the main variables you can set.
 | `SOLR_COLLECTION_SHARDS`        | Solar collection shards                                                       | `1`                                                |
 | `SOLR_ENABLE_AUTHENTICATION`    | Enables authentication                                                        | `no`                                               |
 | `SOLR_ADMIN_USERNAME`           | Administrator Username                                                        | `admin`                                            |
-| `SOLR_ADMIN_PASSWORD`           | Administrator password                                                        | `bitnami`                                          |
+| `SOLR_ADMIN_PASSWORD`           | Administrator password                                                        | `nil`                                              |
 | `SOLR_CLOUD_BOOTSTRAP`          | Indicates if this node is the one that performs the boostraping               | `no`                                               |
 | `SOLR_CORE_CONF_DIR`            | Solar CORE configuration directory                                            | `${SOLR_SERVER_DIR}/solr/configsets/_default/conf` |
 | `SOLR_SSL_ENABLED`              | Indicates if Solr starts with SSL enabled                                     | `no`                                               |
-| `SOLR_SSL_CHECK_PEER_NAME`      | Indicates if Solr should check the peer names                                 | `false`                                            |
+| `SOLR_SSL_CHECK_PEER_NAME`      | Indicates if Solr should check the peer names                                 | `true`                                             |
 | `SOLR_SSL_KEY_STORE_PASSWORD`   | Password for the Solr SSL keystore                                            | `nil`                                              |
 | `SOLR_SSL_TRUST_STORE_PASSWORD` | Password for the Solr SSL truststore                                          | `nil`                                              |
 | `SOLR_ZK_MAX_RETRIES`           | Maximum retries when waiting for zookeeper configuration operations to finish | `5`                                                |
 | `SOLR_ZK_SLEEP_TIME`            | Sleep time when waiting for zookeeper configuration operations to finish      | `5`                                                |
 | `SOLR_ZK_CHROOT`                | ZooKeeper ZNode chroot where to store solr data. Default: /solr               | `/solr`                                            |
-| `SOLR_ZK_HOSTS`                 | ZooKeeper nodes (comma-separated list of `host:port`\)                        | `nil`                                              |
+| `SOLR_ZK_HOSTS`                 | ZooKeeper nodes (comma-separated list of `host:port`)                         | `nil`                                              |

 #### Read-only environment variables

@@ -11,6 +11,7 @@ services:
      - SOLR_ZK_HOSTS=zk1:2181
      - SOLR_HOST=solrnode1
      - SOLR_ENABLE_AUTHENTICATION=yes
+      - SOLR_ADMIN_PASSWORD=bitnami
    ports:
      - '8983:8983'
    volumes:
@@ -6,6 +6,7 @@ services:
    image: docker.io/bitnami/solr:10
    environment:
      - SOLR_ENABLE_AUTHENTICATION=yes
+      - SOLR_ADMIN_PASSWORD=bitnami
    ports:
      - '8983:8983'
    volumes:
				`@@ -0,0 +1 @@`
				`190f3814d0362c10bc2373945a5fe00ff46aa2980ac2224528a32c7766a2b72d jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`08f71653cfeafd8e168835acfa95678ad52649c0b8c3512d285cedead2ea0a62 jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`ecc43e1256883245225cbfd8540876d98831ead4e92779dbea977f6aacca13f3 solr-10.0.0-2-linux-amd64-debian-12.tar.gz`
				`@@ -0,0 +1 @@`
				`9f881d4aec698e7a2afced8ce2aace63fee9567c8981057a8a79ae8af42e7c55 solr-10.0.0-2-linux-arm64-debian-12.tar.gz`