From 33fe53963919420f515d4cce72e46673150701f4 Mon Sep 17 00:00:00 2001
From: William Brown <firstyear@redhat.com>
Date: Mon, 3 Apr 2017 14:17:16 +1000
Subject: [PATCH] Ticket 49207 - Supply docker POC build for DS.

Fix Description:  Supply a proof of concept docker build file for
389 Directory Server. This container will contain a single instance
of directory server with no backends. It should be administered
with dsconf / ldif.

https://pagure.io/389-ds-base/issue/49207

Author: wibrown

Review by: ???
---
 docker/389ds_poc/Dockerfile | 62 +++++++++++++++++++++++++++++++++++++++++++++
 docker/README.md            | 52 +++++++++++++++++++++++++++++++++++++
 2 files changed, 114 insertions(+)
 create mode 100644 docker/389ds_poc/Dockerfile
 create mode 100644 docker/README.md

diff --git a/docker/389ds_poc/Dockerfile b/docker/389ds_poc/Dockerfile
new file mode 100644
index 0000000..145d783
--- /dev/null
+++ b/docker/389ds_poc/Dockerfile
@@ -0,0 +1,62 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2017 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+
+FROM centos:7
+MAINTAINER 389-devel@lists.fedoraproject.org
+EXPOSE 389 636
+ENV container docker
+
+RUN yum install -y epel-release && \
+    yum install -y git autoconf autoconf automake automake bind-utils bzip2-devel cyrus-sasl-devel \
+    cyrus-sasl-gssapi cyrus-sasl-lib cyrus-sasl-md5 cyrus-sasl-plain db4 db4-devel db4-utils doxygen \
+    gcc-c++ gperftools-devel gperftools-libs icu krb5-libs krb5-server krb5-workstation libasan \
+    libasan libcmocka-devel libdb libdb-devel libdb-utils libevent libevent-devel libicu-devel \
+    libsemanage-python libtool libtool llvm lm_sensors-devel mozldap-devel mozldap-devel \
+    mozldap-tools mozldap-tools net-snmp-devel nspr nspr nspr-devel nspr-devel nspr-devel nspr-devel \
+    nss nss nss-devel nss-devel nss-devel nss-devel nss-tools openldap openldap-clients openldap-devel \
+    openldap-devel openssl-devel pam-devel pcre-devel perl-Archive-Tar perl-DB_File perl-Mozilla-LDAP \
+    perl-NetAddr-IP perl-Socket perl-Socket6 pkgconfig pkgconfig pkgconfig policycoreutils-python \
+    pytest python python2 python2-dateutil python2-devel python2-devel python2-lib389 python2-pyasn1 \
+    python2-pyasn1-modules python2-pytest python2-setuptools python2-setuptools python2-six \
+    python-dateutil python-devel python-devel python-ldap python-pyasn1 python-pyasn1-modules \
+    python-setuptools python-setuptools python-six svrcore-devel svrcore-devel systemd-devel \
+    systemd-libs systemd-libs systemd-units systemd-units systemd-units systemd-units \
+    tcp_wrappers zlib-devel \
+    make \
+    && \
+yum clean all
+
+# groupadd -f -g 389 -r dirsrv && \
+RUN useradd -d /usr/share/dirsrv -u 389 -M -r -s /bin/nologin dirsrv && \
+mkdir -p /usr/local/src && \
+cd /usr/local/src && \
+git clone --depth=1 https://pagure.io/lib389.git lib389 && \
+git clone --depth=1 https://pagure.io/389-ds-base.git ds && \
+make -C lib389 build && \
+make -C lib389 install && \
+cd ds && \
+autoreconf -fiv && \
+./configure --with-fhs --enable-gcc-security --with-openldap --enable-cmocka --enable-silent-rules && \
+make && \
+make check && \
+make install && \
+setcap CAP_NET_BIND_SERVICE=pe /usr/sbin/ns-slapd
+
+# Create the example setup inf. It's valid for containers!
+# Build the instance from the new installer tools.
+RUN /usr/sbin/dscreate example > /root/ds-setup.inf && /usr/sbin/dscreate -v fromfile /root/ds-setup.inf --IsolemnlyswearthatIamuptonogood --containerised
+
+# Finally add the volumes, they will inherit the contents of these directories.
+VOLUME /etc/dirsrv
+VOLUME /var/log/dirsrv
+VOLUME /var/lib/dirsrv
+
+# Or, run them as dirsrv
+USER dirsrv
+CMD ["/usr/sbin/ns-slapd", "-d", "0", "-D", "/etc/dirsrv/slapd-localhost", "-i", "/var/run/dirsrv/slapd-localhost.pid"]
+
diff --git a/docker/README.md b/docker/README.md
new file mode 100644
index 0000000..d37b9f0
--- /dev/null
+++ b/docker/README.md
@@ -0,0 +1,52 @@
+
+#### Issue Description
+This folder contains proof of concept dockerfiles for 389 Directory Server. This utilises many of our latest developments for installing instances and configuring them. We have developed native, clean, and powerful container integration. This container image is usable on CentOS / RHEL / Fedora atomic host, and pure docker implementations. Please note this image will not currently work in openshift due to a reliance on volume features that openshift does not support, but we will correct this.
+
+
+#### Using the files
+These docker files are designed to be build from docker hub as the will do a remote git fetch during the build process. They are not currently designed to operate on a local source tree (we may add this later).
+
+```
+cd docker/389ds_poc;
+docker build -t 389ds_poc:latest .
+```
+
+#### Deploying and using the final product
+
+```
+docker create -h ldap.example.com 389ds_poc:latest
+docker start <name>
+docker inspect <name> | grep IPAddress
+ldapsearch -H ldap://<address> -b '' -s base -x +
+....
+supportedLDAPVersion: 3
+vendorName: 389 Project
+vendorVersion: 389-Directory/1.3.6.3 B2017.093.354
+
+```
+
+To expose the ports you may consider adding:
+
+```
+-P
+OR
+-p 127.0.0.1:$HOSTPORT:$CONTAINERPORT
+```
+
+You can not currently use a persistent volume with the 389ds_poc image due to an issue with docker volumes. This will be corrected by https://pagure.io/389-ds-base/issue/49213
+
+#### Warnings
+
+The 389ds_poc container is supplied with a static Directory Manager password. This is HIGHLY INSECURE and should not be used in production. The password is "directory manager password".
+
+The 389ds_poc container has some issues with volume over-rides due to our use of a pre-built instance. We are working to resolve this, but until a solution is derived, you can not override the datavolumes. 
+
+#### Other ideas
+
+* We could develop a dockerfile that builds and runs DS tests in an isolated environment.
+* Make a container image that allows mounting an arbitrary 389-ds repo into it for simple development purposes. 
+
+#### NOTE of 389 DS project support
+
+This is not a "supported" method of deployment to a production system and may result in data loss. This should be considered an experimental deployment method until otherwise announced. 
+
-- 
1.8.3.1

