Skip to content

Commit ce02f94

Browse files
MaxymVlasovantonbabenko
MaxymVlasov
and
antonbabenko
authored
fix: Dockerized pre-commit-terraform (antonbabenko#219)
Co-authored-by: Anton Babenko <[email protected]>
1 parent 5daffe8 commit ce02f94

File tree

2 files changed

+243
-65
lines changed

2 files changed

+243
-65
lines changed

‎Dockerfile

Lines changed: 156 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,166 @@
1-
FROM ubuntu:18.04
2-
3-
ARG PRE_COMMIT_VERSION="2.11.1"
4-
ARG TERRAFORM_VERSION="0.15.0"
5-
ARG TFSEC_VERSION="v0.39.21"
6-
ARG TERRAFORM_DOCS_VERSION="v0.12.0"
7-
ARG TFLINT_VERSION="v0.27.0"
8-
ARG CHECKOV_VERSION="1.0.838"
1+
FROM ubuntu:20.04 as builder
92

103
# Install general dependencies
114
RUN apt update && \
12-
apt install -y curl git gawk unzip software-properties-common
5+
DEBIAN_FRONTEND=noninteractive apt install -y \
6+
# Needed for pre-commit in next build stage
7+
git \
8+
libpcre2-8-0 \
9+
# Builder deps
10+
unzip \
11+
software-properties-common \
12+
curl \
13+
python3 \
14+
python3-pip && \
15+
# Upgrade pip for be able get latest Checkov
16+
python3 -m pip install --upgrade pip && \
17+
# Cleanup
18+
rm -rf /var/lib/apt/lists/*
1319

14-
# Install tools
15-
RUN add-apt-repository ppa:deadsnakes/ppa && \
16-
apt install -y python3.7 python3-pip && \
17-
pip3 install pre-commit==${PRE_COMMIT_VERSION} && \
18-
curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases | grep -o -E "https://.+?${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz")" > terraform-docs.tgz && tar xzf terraform-docs.tgz && chmod +x terraform-docs && mv terraform-docs /usr/bin/ && \
19-
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases | grep -o -E "https://.+?/${TFLINT_VERSION}/tflint_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && mv tflint /usr/bin/ && \
20-
curl -L "$(curl -s https://api.github.com/repos/tfsec/tfsec/releases | grep -o -E "https://.+?/${TFSEC_VERSION}/tfsec-linux-amd64")" > tfsec && chmod +x tfsec && mv tfsec /usr/bin/ && \
21-
python3.7 -m pip install -U checkov==${CHECKOV_VERSION}
20+
ARG PRE_COMMIT_VERSION=${PRE_COMMIT_VERSION:-latest}
21+
ARG TERRAFORM_VERSION=${TERRAFORM_VERSION:-latest}
22+
23+
# Install pre-commit
24+
RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-commit \
25+
|| pip3 install --no-cache-dir pre-commit==${PRE_COMMIT_VERSION}
2226

2327
# Install terraform because pre-commit needs it
2428
RUN curl -fsSL https://apt.releases.hashicorp.com/gpg | apt-key add - && \
2529
apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" && \
26-
apt-get update && apt-get install terraform=${TERRAFORM_VERSION}
27-
28-
# Checking all binaries are in the PATH
29-
RUN terraform --help
30-
RUN pre-commit --help
31-
RUN terraform-docs --help
32-
RUN tflint --help
33-
RUN tfsec --help
34-
RUN checkov --help
30+
apt update && \
31+
( \
32+
[ "$TERRAFORM_VERSION" = "latest" ] && apt install -y terraform \
33+
|| apt install -y terraform=${TERRAFORM_VERSION} \
34+
) && \
35+
# Cleanup
36+
rm -rf /var/lib/apt/lists/*
37+
38+
#
39+
# Install tools
40+
#
41+
WORKDIR /bin_dir
42+
43+
ARG CHECKOV_VERSION=${CHECKOV_VERSION:-false}
44+
ARG TERRAFORM_DOCS_VERSION=${TERRAFORM_DOCS_VERSION:-false}
45+
ARG TERRAGRUNT_VERSION=${TERRAGRUNT_VERSION:-false}
46+
ARG TERRASCAN_VERSION=${TERRASCAN_VERSION:-false}
47+
ARG TFLINT_VERSION=${TFLINT_VERSION:-false}
48+
ARG TFSEC_VERSION=${TFSEC_VERSION:-false}
49+
50+
51+
# Tricky thing to install all tools by set only one arg.
52+
# In RUN command below used `. /.env` <- this is sourcing vars that
53+
# specified in step below
54+
ARG INSTALL_ALL=${INSTALL_ALL:-false}
55+
RUN if [ "$INSTALL_ALL" != "false" ]; then \
56+
echo "export CHECKOV_VERSION=latest" >> /.env && \
57+
echo "export TERRAFORM_DOCS_VERSION=latest" >> /.env && \
58+
echo "export TERRAGRUNT_VERSION=latest" >> /.env && \
59+
echo "export TERRASCAN_VERSION=latest" >> /.env && \
60+
echo "export TFLINT_VERSION=latest" >> /.env && \
61+
echo "export TFSEC_VERSION=latest" >> /.env \
62+
; fi
63+
64+
65+
# Checkov
66+
RUN . /.env && \
67+
if [ "$CHECKOV_VERSION" != "false" ]; then \
68+
( \
69+
[ "$CHECKOV_VERSION" = "latest" ] && pip3 install --no-cache-dir checkov \
70+
|| pip3 install --no-cache-dir checkov==${CHECKOV_VERSION} \
71+
) \
72+
; fi
73+
74+
# Terraform docs
75+
RUN . /.env && \
76+
if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then \
77+
( \
78+
TERRAFORM_DOCS_RELEASES="https://api.github.com/repos/terraform-docs/terraform-docs/releases" && \
79+
[ "$TERRAFORM_DOCS_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRAFORM_DOCS_RELEASES}/latest | grep -o -E "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz \
80+
|| curl -L "$(curl -s ${TERRAFORM_DOCS_RELEASES} | grep -o -E "https://.+?v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz")" > terraform-docs.tgz \
81+
) && tar -xzf terraform-docs.tgz terraform-docs && chmod +x terraform-docs \
82+
; fi
83+
84+
# Terragrunt
85+
RUN . /.env \
86+
&& if [ "$TERRAGRUNT_VERSION" != "false" ]; then \
87+
( \
88+
TERRAGRUNT_RELEASES="https://api.github.com/repos/gruntwork-io/terragrunt/releases" && \
89+
[ "$TERRAGRUNT_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRAGRUNT_RELEASES}/latest | grep -o -E "https://.+?/terragrunt_linux_amd64" | head -n 1)" > terragrunt \
90+
|| curl -L "$(curl -s ${TERRAGRUNT_RELEASES} | grep -o -E "https://.+?v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" | head -n 1)" > terragrunt \
91+
) && chmod +x terragrunt \
92+
; fi
93+
94+
95+
# Terrascan
96+
RUN . /.env && \
97+
if [ "$TERRASCAN_VERSION" != "false" ]; then \
98+
( \
99+
TERRASCAN_RELEASES="https://api.github.com/repos/accurics/terrascan/releases" && \
100+
[ "$TERRASCAN_VERSION" = "latest" ] && curl -L "$(curl -s ${TERRASCAN_RELEASES}/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz \
101+
|| curl -L "$(curl -s ${TERRASCAN_RELEASES} | grep -o -E "https://.+?${TERRASCAN_VERSION}_Linux_x86_64.tar.gz")" > terrascan.tar.gz \
102+
) && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && \
103+
./terrascan init \
104+
; fi
105+
106+
# TFLint
107+
RUN . /.env && \
108+
if [ "$TFLINT_VERSION" != "false" ]; then \
109+
( \
110+
TFLINT_RELEASES="https://api.github.com/repos/terraform-linters/tflint/releases" && \
111+
[ "$TFLINT_VERSION" = "latest" ] && curl -L "$(curl -s ${TFLINT_RELEASES}/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip \
112+
|| curl -L "$(curl -s ${TFLINT_RELEASES} | grep -o -E "https://.+?/v${TFLINT_VERSION}/tflint_linux_amd64.zip")" > tflint.zip \
113+
) && unzip tflint.zip && rm tflint.zip \
114+
; fi
115+
116+
# TFSec
117+
RUN . /.env && \
118+
if [ "$TFSEC_VERSION" != "false" ]; then \
119+
( \
120+
TFSEC_RELEASES="https://api.github.com/repos/aquasecurity/tfsec/releases" && \
121+
[ "$TFSEC_VERSION" = "latest" ] && curl -L "$(curl -s ${TFSEC_RELEASES}/latest | grep -o -E "https://.+?/tfsec-linux-amd64" | head -n 1)" > tfsec \
122+
|| curl -L "$(curl -s ${TFSEC_RELEASES} | grep -o -E "https://.+?v${TFSEC_VERSION}/tfsec-linux-amd64" | head -n 1)" > tfsec \
123+
) && chmod +x tfsec \
124+
; fi
125+
126+
# Checking binaries versions
127+
RUN . /.env && \
128+
echo "\n\n" && \
129+
pre-commit --version && \
130+
terraform --version | head -n 1 && \
131+
(if [ "$CHECKOV_VERSION" != "false" ]; then echo -n "checkov " && checkov --version; else echo "checkov SKIPPED" ; fi) && \
132+
(if [ "$TERRAFORM_DOCS_VERSION" != "false" ]; then ./terraform-docs --version; else echo "terraform-docs SKIPPED"; fi) && \
133+
(if [ "$TERRAGRUNT_VERSION" != "false" ]; then ./terragrunt --version; else echo "terragrunt SKIPPED" ; fi) && \
134+
(if [ "$TERRASCAN_VERSION" != "false" ]; then echo -n "terrascan " && ./terrascan version; else echo "terrascan SKIPPED" ; fi) && \
135+
(if [ "$TFLINT_VERSION" != "false" ]; then ./tflint --version; else echo "tflint SKIPPED" ; fi) && \
136+
(if [ "$TFSEC_VERSION" != "false" ]; then echo -n "tfsec " && ./tfsec --version; else echo "tfsec SKIPPED" ; fi) && \
137+
echo "\n\n"
138+
139+
# based on debian:buster-slim
140+
# https://github.com/docker-library/python/blob/master/3.9/buster/slim/Dockerfile
141+
FROM python:3.9-slim-buster
142+
143+
# Python 3.8 (ubuntu 20.04) -> Python3.9 hacks
144+
COPY --from=builder /usr/local/lib/python3.8/dist-packages/ /usr/local/lib/python3.9/site-packages/
145+
COPY --from=builder /usr/lib/python3/dist-packages /usr/local/lib/python3.9/site-packages
146+
RUN mkdir /usr/lib/python3 && \
147+
ln -s /usr/local/lib/python3.9/site-packages /usr/lib/python3/site-packages && \
148+
ln -s /usr/local/bin/python3 /usr/bin/python3
149+
# Copy binaries needed for pre-commit
150+
COPY --from=builder /usr/lib/git-core/ /usr/lib/git-core/
151+
COPY --from=builder /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0 /usr/lib/x86_64-linux-gnu/
152+
# Copy tools
153+
COPY --from=builder \
154+
/bin_dir/ \
155+
/usr/bin/terraform \
156+
/usr/local/bin/checkov* \
157+
/usr/local/bin/pre-commit \
158+
/usr/bin/git \
159+
/usr/bin/git-shell \
160+
/usr/bin/
161+
# Copy terrascan policies
162+
COPY --from=builder /root/ /root/
163+
164+
ENV PRE_COMMIT_COLOR=${PRE_COMMIT_COLOR:-always}
35165

36166
ENTRYPOINT [ "pre-commit" ]

0 commit comments

Comments
 (0)