root/build-tools/build-docker-images
Davlet Panech ac49affe33 stx-debian: remove python 2.x NSS module
Remove python-nss, which is based on python 2.x and triggers CVE scans.
We don't use python2 in any docker containers any more, so this module,
and python 2.x itself is not required here.

TESTS
================================
Rebuild all StarlingX and OpenStack containers that inherit from
stx-debian

Story: 2011159
Task: 50404

Signed-off-by: Davlet Panech <davlet.panech@windriver.com>
Change-Id: Ifc6e6c8778b2f7438ea76adb8c4f6e08a822ce7c
2024-06-26 13:26:48 -04:00
..
2022-09-14 10:56:06 -04:00
2019-03-24 21:03:21 -04:00

## Example commands for building StarlingX images

PRIVATE_REGISTRY_USERID=myuser
PRIVATE_REGISTRY=xxx.xxx.xxx.xxx:9001
VERSION=2018.11.13
OS=centos
OS_VERSION=7.5.1804
BUILD_STREAM=stable
HOST_PORT=8088

## Step 1: Build stx-centos
time $MY_REPO/build-tools/build-docker-images/build-stx-base.sh \
    --os ${OS} \
    --os-version ${OS_VERSION} \
    --version ${VERSION} \
    --user ${PRIVATE_REGISTRY_USERID} \
    --registry ${PRIVATE_REGISTRY} \
    --push \
    --repo stx-local-build,http://${HOSTNAME}:${HOST_PORT}/${MY_WORKSPACE}/std/rpmbuild/RPMS \
    --repo stx-mirror-distro,http://${HOSTNAME}:${HOST_PORT}/${MY_REPO}/cgcs-root/cgcs-${OS}-repo/Binary \
    --clean


## Step 2: Build wheels (output as tarball)
time $MY_REPO/build-tools/build-wheels/build-wheel-tarball.sh \
    --os ${OS} \
    --os-version ${OS_VERSION} \
    --stream ${BUILD_STREAM}

## Step 3: Build images
time $MY_REPO/build-tools/build-docker-images/build-stx-images.sh \
    --os ${OS} \
    --version ${VERSION} \
    --stream ${BUILD_STREAM} \
    --base ${PRIVATE_REGISTRY}/${PRIVATE_REGISTRY_USERID}/stx-${OS}:${VERSION} \
    --wheels http://${HOSTNAME}:${HOST_PORT}/${MY_WORKSPACE}/std/build-wheels-${OS}-${BUILD_STREAM}/stx-${OS}-${BUILD_STREAM}-wheels.tar \
    --user ${PRIVATE_REGISTRY_USERID} \
    --registry ${PRIVATE_REGISTRY} \
    --push --latest \
    --clean


## Note: Verify that lighttpd is not bound to "localhost"
vi /etc/lighttpd/lighttpd.conf
# server.bind = "localhost"
systemctl restart lighttpd

## Note: You may need to add an iptables rule to allow the docker
## containers to access the http server on your host. For example:
iptables -I INPUT 6 -i docker0 -p tcp --dport ${HOST_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT