Dockerfile aktualisiert

.drone.yml

@@ -26,7 +26,7 @@ steps:
         fi
 
   - name: security-scan
-    image: aquasec/trivy:latest
+    image: aquasec/trivy:0.58.2
     commands:
       - trivy image --input image.tar --severity HIGH,CRITICAL --exit-code 1
 
@@ -46,8 +46,8 @@ steps:
       #- git remote set-url origin https://git.efi.th-nuernberg.de/gitea/freudenreichan/EinfuehrungInDocker_Pipeline2
 
       # Repo clonen
-      - git clone https://git.efi.th-nuernberg.de/gitea/freudenreichan/EinfuehrungInDocker_Pipeline2.git
-      - cd EinfuehrungInDocker_Pipeline
+      - git clone https://git.efi.th-nuernberg.de/gitea/kuerzdoerferta96614/EinfuehrungInDocker_Pipeline2.git
+      - cd EinfuehrungInDocker_Pipeline2
 
       # Branch wechseln oder erstellen
       - git checkout drone-artifacts || git checkout -b drone-artifacts

Dockerfile

@@ -1,22 +1,21 @@
-# Base-Image
-FROM ubuntu:latest
-
-# Pakete installieren
-RUN apt-get update
-RUN apt-get install -y build-essential gcc curl vim net-tools
-
-# Arbeitsverzeichnis setzen
+FROM alpine:3.13 AS builder
+RUN apk add --no-cache gcc musl-dev
 WORKDIR /app
+COPY deployment.c .
+RUN gcc -static -O2 -s -o deployment deployment.c && strip deployment
 
-# alles kopieren
-COPY . .
+FROM alpine:3.13
+RUN apk add --no-cache bash coreutils && rm -rf /var/cache/apk/*
+RUN addgroup -g 1000 appuser && adduser -u 1000 -G appuser -s /bin/bash -D appuser
+RUN mkdir -p /app /output && chown -R appuser:appuser /app /output
 
-# Code kompilieren
-RUN gcc -o deployment deployment.c
+COPY --from=builder --chown=appuser:appuser /app/deployment /app/
 
-# Verzeichnis für Ausgabe anlegen
-RUN mkdir /output
+WORKDIR /app
+VOLUME ["/output"]
+USER appuser
 
-# Ausgabe wird ins Container-Dateisystem geschrieben
-ENTRYPOINT ["/bin/bash", "-c"]
-CMD ["./deployment 10 > /output/output.txt && tail -f /output/output.txt"]
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD test -f /output/output.txt || exit 1
+
+CMD ["/bin/bash", "-c", "./deployment 10 > /output/output.txt && tail -f /output/output.txt"]