50 lines
2.5 KiB
Docker
50 lines
2.5 KiB
Docker
|
# ===========================================================================
|
||
|
|
# OSM taxiway bastion — self-contained OSM export box (broker mode)
|
||
|
|
# ===========================================================================
|
||
|
|
# A whitelisted SSH box for an OSM taxiway export pipeline. A client may run ONLY
|
||
|
|
# the three taxiway commands (allowed-commands.list), validated whole-line and
|
||
|
|
# exec'd shell-free by bastion-broker — the same broker the base docker-bastion
|
||
|
|
# image uses.
|
||
|
|
#
|
||
|
|
# WHY UBUNTU 22.04 (not the Alpine base image): the export needs `osmium`
|
||
|
|
# (osmium-tool), which Alpine does not package (only header-only libosmium). And
|
||
|
|
# GDAL matters: newer ogr2ogr (Debian trixie's GDAL 3.10) SEGFAULTS on the
|
||
|
|
# OSM→GeoJSON step, while Ubuntu 22.04's GDAL 3.4.1 + osmium 1.14 is exactly the
|
||
|
|
# known-good toolchain that produced the existing exports. So this flavor is a
|
||
|
|
# small standalone image that vendors the broker + a broker-only sshd entrypoint.
|
||
|
|
#
|
||
|
|
# taxiways-list → ls the "<ICAO>-taxiways.geojson" exports present
|
||
|
|
# taxiways-export <ICAO> → run export-icao-geojson.sh <ICAO> (osmium/ogr2ogr/jq)
|
||
|
|
# taxiways-cat <ICAO> → base64 the export so it tunnels over ssh cleanly
|
||
|
|
# ===========================================================================
|
||
|
|
FROM ubuntu:22.04
|
||
|
|
|
||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
|
|
openssh-server \
|
||
|
|
osmium-tool \
|
||
|
|
gdal-bin \
|
||
|
|
jq \
|
||
|
|
bash \
|
||
|
|
coreutils \
|
||
|
|
tini \
|
||
|
|
ca-certificates \
|
||
|
|
&& rm -rf /var/lib/apt/lists/* \
|
||
|
|
&& mkdir -p /run/sshd /etc/bastion \
|
||
|
|
&& useradd -m -u 1000 -s /bin/sh agent \
|
||
|
|
# Unlock the account (useradd leaves the password '!'-locked). Debian's
|
||
|
|
# glibc openssh with UsePAM no refuses a locked account even for pubkey;
|
||
|
|
# '*' = valid-but-passwordless, so pubkey login works (password auth is
|
||
|
|
# off anyway). Alpine's musl build doesn't need this, hence the base image.
|
||
|
|
&& usermod -p '*' agent
|
||
|
|
|
||
|
|
# The broker (allowlist gate, verbatim from docker-bastion/scripts) + the three
|
||
|
|
# wrappers it may exec + the broker-only entrypoint.
|
||
|
|
COPY bastion-broker /usr/local/bin/bastion-broker
|
||
|
|
COPY bin/taxiways-list bin/taxiways-export bin/taxiways-cat /usr/local/bin/
|
||
|
|
COPY entrypoint /usr/local/bin/entrypoint
|
||
|
|
RUN chmod 0755 /usr/local/bin/bastion-broker /usr/local/bin/taxiways-list \
|
||
|
|
/usr/local/bin/taxiways-export /usr/local/bin/taxiways-cat /usr/local/bin/entrypoint
|
||
|
|
|
||
|
|
EXPOSE 22
|
||
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint"]
|