Switch to NodeRed build

Dockerfile

@@ -1,52 +1,100 @@
-FROM node:lts-bullseye-slim as build
-
-RUN apt-get update \
-  && apt-get install -y build-essential python perl-modules
-
-RUN deluser --remove-home node \
-  && groupadd --gid 1000 nodered \
-  && useradd --gid nodered --uid 1000 --shell /bin/bash --create-home nodered
-
-RUN mkdir -p /data && chown 1000 /data
-
-USER 1000
-WORKDIR /data
-
-COPY ./package.json /data/
-RUN npm install
-
-## Release image
-FROM node:lts-bullseye-slim
-
-RUN apt-get update && apt-get install -y perl-modules && rm -rf /var/lib/apt/lists/*
-
-RUN deluser --remove-home node \
-  && groupadd --gid 1000 nodered \
-  && useradd --gid nodered --uid 1000 --shell /bin/bash --create-home nodered
-
-RUN mkdir -p /data && chown 1000 /data
-
-USER 1000
-
-COPY ./server.js /data/
-COPY ./settings.js /data/
-COPY ./flows.json /data/
-COPY ./flows_cred.json /data/
-COPY ./package.json /data/
-COPY --from=build /data/node_modules /data/node_modules
-
-USER 0
-
-RUN chgrp -R 0 /data \
-  && chmod -R g=u /data
-
-USER 1000
-
-WORKDIR /data
-
-ENV PORT 1880
-ENV NODE_ENV=production
-ENV NODE_PATH=/data/node_modules
+ARG ARCH=amd64
+ARG NODE_VERSION=14
+ARG OS=alpine3.12
+
+#### Stage BASE ########################################################################################################
+FROM ${ARCH}/node:${NODE_VERSION}-${OS} AS base
+
+# Copy scripts
+COPY scripts/*.sh /tmp/
+
+# Install tools, create Node-RED app and data dir, add user and set rights
+RUN set -ex && \
+    apk add --no-cache \
+        bash \
+        tzdata \
+        iputils \
+        curl \
+        nano \
+        git \
+        openssl \
+        openssh-client \
+        ca-certificates && \
+    mkdir -p /usr/src/node-red /data && \
+    deluser --remove-home node && \
+    adduser -h /usr/src/node-red -D -H node-red -u 1000 && \
+    chown -R node-red:root /data && chmod -R g+rwX /data && \
+    chown -R node-red:root /usr/src/node-red && chmod -R g+rwX /usr/src/node-red
+    # chown -R node-red:node-red /data && \
+    # chown -R node-red:node-red /usr/src/node-red
+
+# Set work directory
+WORKDIR /usr/src/node-red
+
+# Setup SSH known_hosts file
+COPY known_hosts.sh .
+RUN ./known_hosts.sh /etc/ssh/ssh_known_hosts && rm /usr/src/node-red/known_hosts.sh
+
+# package.json contains Node-RED NPM module and node dependencies
+COPY package.json .
+COPY flows.json /data
+COPY settings.js /data
+
+#### Stage BUILD #######################################################################################################
+FROM base AS build
+
+# Install Build tools
+RUN apk add --no-cache --virtual buildtools build-base linux-headers udev python2 && \
+    npm install --unsafe-perm --no-update-notifier --no-fund --only=production && \
+    /tmp/remove_native_gpio.sh && \
+    cp -R node_modules prod_node_modules
+
+#### Stage RELEASE #####################################################################################################
+FROM base AS RELEASE
+ARG BUILD_DATE
+ARG BUILD_VERSION
+ARG BUILD_REF
+ARG NODE_RED_VERSION
+ARG ARCH
+ARG TAG_SUFFIX=minimal
+
+LABEL org.label-schema.build-date=${BUILD_DATE} \
+    org.label-schema.docker.dockerfile=".docker/Dockerfile.alpine" \
+    org.label-schema.license="Apache-2.0" \
+    org.label-schema.name="Node-RED" \
+    org.label-schema.version=${BUILD_VERSION} \
+    org.label-schema.description="Low-code programming for event-driven applications." \
+    org.label-schema.url="https://nodered.org" \
+    org.label-schema.vcs-ref=${BUILD_REF} \
+    org.label-schema.vcs-type="Git" \
+    org.label-schema.vcs-url="https://github.com/node-red/node-red-docker" \
+    org.label-schema.arch=${ARCH} \
+    authors="Dave Conway-Jones, Nick O'Leary, James Thomas, Raymond Mouthaan"
+
+COPY --from=build /usr/src/node-red/prod_node_modules ./node_modules
+
+# Chown, install devtools & Clean up
+#RUN chown -R node-red:root /usr/src/node-red && \
+#    /tmp/install_devtools.sh && \
+#    rm -r /tmp/*
+RUN chown -R node-red:root /usr/src/node-red && \
+    rm -r /tmp/*
+
+USER node-red
+
+# Env variables
+ENV NODE_RED_VERSION=$NODE_RED_VERSION \
+    NODE_PATH=/usr/src/node-red/node_modules:/data/node_modules \
+    PATH=/usr/src/node-red/node_modules/.bin:${PATH} \
+    FLOWS=flows.json
+
+# ENV NODE_RED_ENABLE_SAFE_MODE=true    # Uncomment to enable safe start mode (flows not running)
+# ENV NODE_RED_ENABLE_PROJECTS=true     # Uncomment to enable projects option
+
+# Expose the listening port of node-red
 EXPOSE 1880
 
-CMD ["node", "/data/server.js", "/data/flows.json"]
+# Add a healthcheck (default every 30 secs)
+# HEALTHCHECK CMD curl http://localhost:1880/ || exit 1
+
+ENTRYPOINT ["npm", "start", "--cache", "/data/.npm", "--", "--userDir", "/data"]

docker-alpine.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+export NODE_RED_VERSION=$(grep -oE "\"node-red\": \"(\w*.\w*.\w*.\w*.\w*.)" package.json | cut -d\" -f4)
+
+echo "#########################################################################"
+echo "node-red version: ${NODE_RED_VERSION}"
+echo "#########################################################################"
+
+docker build --rm --no-cache \
+    --build-arg ARCH=amd64 \
+    --build-arg NODE_VERSION=14 \
+    --build-arg NODE_RED_VERSION=${NODE_RED_VERSION} \
+    --build-arg OS=alpine3.12 \
+    --build-arg BUILD_DATE="$(date +"%Y-%m-%dT%H:%M:%SZ")" \
+    --build-arg TAG_SUFFIX=default \
+    --file Dockerfile \
+    --tag testing:node-red-build .

docker-compose.yaml

@@ -3,7 +3,9 @@ version: "3.7"
 services:
   subscriber_mqtt_1:
     container_name: subscriber_mqtt_1
-    image: golfvert/wis2globalbrokernodered
+#    image: golfvert/wis2globalbrokernodered
+#    image: docker.io/library/testing:WIS2-GlobalBrokerAntiLoop
+    image: docker.io/library/testing:node-red-build
     env_file:
       - ./publisher.env
     environment:

known_hosts.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+
+# Originally taken from the Flux project (https://github.com/fluxcd/flux/tree/master/docker) where is under an
+# Apache-2.0 license
+
+set -eu
+
+known_hosts_file=${1}
+known_hosts_file=${known_hosts_file:-/etc/ssh/ssh_known_hosts}
+hosts="github.com gitlab.com bitbucket.org ssh.dev.azure.com vs-ssh.visualstudio.com"
+hosts_2022="source.developers.google.com"
+
+# The heredoc below was generated by constructing a known_hosts using
+#
+#     ssh-keyscan github.com gitlab.com bitbucket.org ssh.dev.azure.com vs-ssh.visualstudio.com > ./known_hosts
+#
+# then generating the sorted fingerprints with
+#
+#     ssh-keygen -l -f ./known_hosts | LC_ALL=C sort
+#
+# then checking against the published fingerprints from:
+#  - github.com: https://help.github.com/articles/github-s-ssh-key-fingerprints/
+#  - gitlab.com: https://docs.gitlab.com/ee/user/gitlab_com/#ssh-host-keys-fingerprints
+#  - bitbucket.org: https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html
+#  - ssh.dev.azure.com & vs-ssh.visualstudio.com: sign in, then go to User settings -> SSH Public Keys
+#    (this is where the public key fingerprint is shown; it's not a setting)
+#  - source.developers.google.com: https://cloud.google.com/source-repositories/docs/cloning-repositories
+
+fingerprints=$(mktemp -t)
+cleanup() {
+    rm -f "$fingerprints"
+}
+trap cleanup EXIT
+
+# make sure sorting is in the same locale as the heredoc
+export LC_ALL=C
+
+generate() {
+    ssh-keyscan ${hosts} > ${known_hosts_file}
+    ssh-keyscan -p 2022 ${hosts_2022} >> ${known_hosts_file}
+}
+
+validate() {
+ssh-keygen -l -f ${known_hosts_file} | sort > "$fingerprints"
+
+diff - "$fingerprints" <<EOF
+2048 SHA256:ROQFvPThGrW4RuWLoL9tq9I9zJ42fK4XywyRtbOz/EQ gitlab.com (RSA)
+2048 SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 github.com (RSA)
+2048 SHA256:ohD8VZEXGWo6Ez8GSEJQ9WpafgLFsOfLOtGGQCQo6Og ssh.dev.azure.com (RSA)
+2048 SHA256:ohD8VZEXGWo6Ez8GSEJQ9WpafgLFsOfLOtGGQCQo6Og vs-ssh.visualstudio.com (RSA)
+2048 SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A bitbucket.org (RSA)
+256 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU github.com (ED25519)
+256 SHA256:AGvEpqYNMqsRNIviwyk4J4HM0lEylomDBKOWZsBn434 [source.developers.google.com]:2022 (ECDSA)
+256 SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw gitlab.com (ECDSA)
+256 SHA256:eUXGGm1YGsMAS7vkcx6JOJdOGHPem5gQp4taiCfCLB8 gitlab.com (ED25519)
+256 SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM github.com (ECDSA)
+EOF
+
+}
+
+retries=10
+count=0
+ok=false
+wait=2
+until ${ok}; do
+    generate && validate && ok=true || ok=false
+    count=$(($count + 1))
+    if [[ ${count} -eq ${retries} ]]; then
+        echo "ssh-keyscan failed, no more retries left"
+        exit 1
+    fi
+    sleep ${wait}
+done

package.json

@@ -2,12 +2,15 @@
     "name": "more-node-red",
     "description": "A Node-RED Project",
     "version": "0.0.1",
+    "main": "node_modules/node-red/red/red.js",
+    "scripts": {
+        "start": "node $NODE_OPTIONS node_modules/node-red/red.js $FLOWS",
+        "debug": "node --inspect=0.0.0.0:9229 $NODE_OPTIONS node_modules/node-red/red.js $FLOWS",
+        "debug_brk": "node --inspect=0.0.0.0:9229 --inspect-brk $NODE_OPTIONS node_modules/node-red/red.js $FLOWS"
+    },
     "dependencies": {
         "@cloudnative/health-connect": "^2.0.0",
         "express": "4.17.1",
-        "nopt": "5.0.0",
-        "abbrev": "1.1.1",
-        "bcryptjs": "2.4.3",
         "node-red-dashboard": "^2.16.3",
         "node-red-contrib-redis": "1.3.9",
         "node-red-contrib-prometheus-exporter": "1.0.5"
@@ -23,4 +26,4 @@
             "credentialsFile": "flows_cred.json"
         }
     }
-}
+}

scripts/install_devtools.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -ex
+
+# Installing Devtools
+if [[ ${TAG_SUFFIX} != *"minimal" ]]; then
+  echo "Installing devtools"
+  apk add --no-cache --virtual devtools build-base linux-headers udev python2 python3
+else
+  echo "Skip installing devtools"
+fi

scripts/remove_native_gpio.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -ex
+
+# Remove native GPIO node if exists
+if [[ -d "/usr/src/node-red/node_modules/@node-red/nodes/core/hardware" ]]; then
+  echo "Removing native GPIO node"
+  rm -r /usr/src/node-red/node_modules/@node-red/nodes/core/hardware
+else
+  echo "Skip removing native GPIO node"
+fi