47 lines
1.8 KiB
Docker
47 lines
1.8 KiB
Docker
# Duo publishes no official image; build from their source tarball.
|
|
# Install flags match Duo's documented non-interactive install.
|
|
#
|
|
# Slimming option: switch BOTH stages to debian:bookworm-slim (~80MB less,
|
|
# and the base layer is shared with the openvpn image). Both must move
|
|
# together — the proxy links against the builder's glibc. Alpine/musl
|
|
# will not work.
|
|
#FROM debian:bookworm-slim AS build
|
|
|
|
FROM ubuntu:24.04 AS build
|
|
|
|
ARG DUO_VERSION=latest
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential libssl-dev libffi-dev perl zlib1g-dev wget ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN wget -q "https://dl.duosecurity.com/duoauthproxy-${DUO_VERSION}-src.tgz" -O /tmp/duo-src.tgz \
|
|
&& mkdir /tmp/duo \
|
|
&& tar xzf /tmp/duo-src.tgz -C /tmp/duo --strip-components=1
|
|
|
|
RUN groupadd -r -g 35505 duo \
|
|
&& useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo \
|
|
&& cd /tmp/duo && make \
|
|
&& cd duoauthproxy-build \
|
|
&& ./install --install-dir /opt/duoauthproxy --service-user duo \
|
|
--log-group duo --create-init-script no --enable-selinux no
|
|
|
|
# Slim variant (must match the build stage base — see note above):
|
|
#FROM debian:bookworm-slim
|
|
FROM ubuntu:24.04
|
|
|
|
# gettext-base = envsubst for rendering authproxy.cfg from env vars
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates gettext-base \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -r -g 35505 duo \
|
|
&& useradd -r -u 35505 -g duo -d /opt/duoauthproxy -s /usr/sbin/nologin duo
|
|
|
|
COPY --from=build --chown=duo:duo /opt/duoauthproxy /opt/duoauthproxy
|
|
COPY --chown=duo:duo authproxy.cfg.template /opt/duoauthproxy/conf/authproxy.cfg.template
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
USER duo
|
|
ENTRYPOINT ["/entrypoint.sh"]
|