Improve Docker images (#5771)

* Improve Docker images

* Add alpine and distroless images

* Update docker workflow

dockerhub/Dockerfile-alpine

@@ -1,29 +0,0 @@
-# bun:alpine
-# Not officially supported (yet)
-
-ARG GLIBC_RELEASE=2.35-r0
-
-FROM alpine:latest AS build
-
-WORKDIR /tmp
-RUN apk --no-cache add unzip
-
-ARG GLIBC_RELEASE
-RUN wget https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
-wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_RELEASE}/glibc-${GLIBC_RELEASE}.apk
-
-ADD https://github.com/oven-sh/bun/releases/latest/download/bun-linux-x64.zip bun-linux-x64.zip
-RUN unzip bun-linux-x64.zip
-
-FROM alpine:latest
-
-ARG GLIBC_RELEASE
-COPY --from=build /tmp/sgerrand.rsa.pub /etc/apk/keys
-COPY --from=build /tmp/glibc-${GLIBC_RELEASE}.apk /tmp
-COPY --from=build /tmp/bun-linux-x64/bun /usr/local/bin
-
-RUN apk --no-cache --force-overwrite add /tmp/glibc-${GLIBC_RELEASE}.apk \
-&& rm /etc/apk/keys/sgerrand.rsa.pub \
-&& rm /tmp/glibc-${GLIBC_RELEASE}.apk
-
-RUN bun --version

dockerhub/Dockerfile-debian

@@ -1,77 +0,0 @@
-FROM debian:bullseye-slim AS build
-
-# https://github.com/oven-sh/bun/releases
-ARG BUN_VERSION=latest
-
-RUN apt-get update -qq \
-    && apt-get install -qq --no-install-recommends \
-      ca-certificates \
-      curl \
-      dirmngr \
-      gpg \
-      gpg-agent \
-      unzip \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* \
-    && arch="$(dpkg --print-architecture)" \
-    && case "${arch##*-}" in \
-      amd64) build="x64-baseline";; \
-      arm64) build="aarch64";; \
-      *) echo "error: unsupported architecture: ($arch)"; exit 1 ;; \
-    esac \
-    && version="$BUN_VERSION" \
-    && case "$version" in \
-      latest | canary | bun-v*) tag="$version"; ;; \
-      v*)                       tag="bun-$version"; ;; \
-      *)                        tag="bun-v$version"; ;; \
-    esac \
-    && case "$tag" in \
-      latest) release="latest/download"; ;; \
-      *)      release="download/$tag"; ;; \
-    esac \
-    && curl "https://github.com/oven-sh/bun/releases/$release/bun-linux-$build.zip" \
-      -fsSLO \
-      --compressed \
-      --retry 5 \
-      || (echo "error: unknown release: ($tag)" && exit 1) \
-    && for key in \
-      "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
-    ; do \
-      gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
-      || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
-    done \
-    && gpg --update-trustdb \
-    && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
-      -fsSLO \
-      --compressed \
-      --retry 5 \
-    && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
-    && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
-    && unzip "bun-linux-$build.zip" \
-    && mv "bun-linux-$build/bun" /usr/local/bin/bun \
-    && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
-    && chmod +x /usr/local/bin/bun \
-    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
-    && which bun \
-    && which bunx \
-    && bun --version
-
-FROM debian:bullseye-slim
-
-RUN groupadd bun \
-      --gid 1000 \
-    && useradd bun \
-      --uid 1000 \
-      --gid bun \
-      --shell /bin/sh \
-      --create-home
-
-COPY docker-entrypoint.sh /usr/local/bin
-COPY --from=build /usr/local/bin/bun /usr/local/bin
-COPY --from=build /usr/local/bin/bunx /usr/local/bin
-
-WORKDIR /home/bun/app
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-CMD ["/usr/local/bin/bun"]

dockerhub/alpine/Dockerfile

@@ -0,0 +1,113 @@
+FROM alpine:3.18 AS build
+
+# https://github.com/oven-sh/bun/releases
+ARG BUN_VERSION=latest
+
+# TODO: Instead of downloading glibc from a third-party source, we should
+#      build it from source. This is a temporary solution.
+#      See: https://github.com/sgerrand/alpine-pkg-glibc
+
+# https://github.com/sgerrand/alpine-pkg-glibc/releases
+# https://github.com/sgerrand/alpine-pkg-glibc/issues/176
+ARG GLIBC_VERSION=2.34-r0
+
+# https://github.com/oven-sh/bun/issues/5545#issuecomment-1722461083
+ARG GLIBC_VERSION_AARCH64=2.26-r1
+
+RUN apk --no-cache add \
+      ca-certificates \
+      curl \
+      dirmngr \
+      gpg \
+      gpg-agent \
+      unzip \
+    && arch="$(apk --print-arch)" \
+    && case "${arch##*-}" in \
+      x86_64) build="x64-baseline";; \
+      aarch64) build="aarch64";; \
+      *) echo "error: unsupported architecture: $arch"; exit 1 ;; \
+    esac \
+    && version="$BUN_VERSION" \
+    && case "$version" in \
+      latest | canary | bun-v*) tag="$version"; ;; \
+      v*)                       tag="bun-$version"; ;; \
+      *)                        tag="bun-v$version"; ;; \
+    esac \
+    && case "$tag" in \
+      latest) release="latest/download"; ;; \
+      *)      release="download/$tag"; ;; \
+    esac \
+    && curl "https://github.com/oven-sh/bun/releases/$release/bun-linux-$build.zip" \
+      -fsSLO \
+      --compressed \
+      --retry 5 \
+      || (echo "error: failed to download: $tag" && exit 1) \
+    && for key in \
+      "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
+    ; do \
+      gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
+      || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
+    done \
+    && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
+      -fsSLO \
+      --compressed \
+      --retry 5 \
+    && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
+      || (echo "error: failed to verify: $tag" && exit 1) \
+    && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
+      || (echo "error: failed to verify: $tag" && exit 1) \
+    && unzip "bun-linux-$build.zip" \
+    && mv "bun-linux-$build/bun" /usr/local/bin/bun \
+    && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
+    && chmod +x /usr/local/bin/bun \
+    && cd /tmp \
+    && case "${arch##*-}" in \
+      x86_64) curl "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk" \
+        -fsSLO \
+        --compressed \
+        --retry 5 \
+        || (echo "error: failed to download: glibc v${GLIBC_VERSION}" && exit 1) \
+      && mv "glibc-${GLIBC_VERSION}.apk" glibc.apk \
+      && curl "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-bin-${GLIBC_VERSION}.apk" \
+        -fsSLO \
+        --compressed \
+        --retry 5 \
+        || (echo "error: failed to download: glibc-bin v${GLIBC_VERSION}" && exit 1) \
+      && mv "glibc-bin-${GLIBC_VERSION}.apk" glibc-bin.apk ;; \
+      aarch64) curl "https://raw.githubusercontent.com/squishyu/alpine-pkg-glibc-aarch64-bin/master/glibc-${GLIBC_VERSION}.apk" \
+        -fsSLO \
+        --compressed \
+        --retry 5 \
+        || (echo "error: failed to download: glibc v${GLIBC_VERSION}" && exit 1) \
+      && mv "glibc-${GLIBC_VERSION}.apk" glibc.apk \
+      && curl "https://raw.githubusercontent.com/squishyu/alpine-pkg-glibc-aarch64-bin/master/glibc-bin-${GLIBC_VERSION}.apk" \
+        -fsSLO \
+        --compressed \
+        --retry 5 \
+        || (echo "error: failed to download: glibc-bin v${GLIBC_VERSION}" && exit 1) \
+      && mv "glibc-bin-${GLIBC_VERSION}.apk" glibc-bin.apk ;; \
+      *) echo "error: unsupported architecture '$arch'"; exit 1 ;; \
+    esac
+
+FROM alpine:3.18
+
+COPY --from=build /tmp/glibc.apk /tmp/
+COPY --from=build /tmp/glibc-bin.apk /tmp/
+COPY --from=build /usr/local/bin/bun /usr/local/bin/
+COPY docker-entrypoint.sh /usr/local/bin/
+
+RUN addgroup -g 1000 bun \
+    && adduser -u 1000 -G bun -s /bin/sh -D bun \
+    && apk --no-cache --force-overwrite --allow-untrusted add \
+      /tmp/glibc.apk \
+      /tmp/glibc-bin.apk \
+    && rm /tmp/glibc.apk \
+    && rm /tmp/glibc-bin.apk \
+    && ln /usr/local/bin/bun /usr/local/bin/bunx \
+    && which bun \
+    && which bunx \
+    && bun --version
+
+WORKDIR /home/bun/app
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+CMD ["/usr/local/bin/bun"]

dockerhub/debian-slim/Dockerfile

@@ -1,7 +1,7 @@
 FROM debian:bullseye-slim AS build
 
 # https://github.com/oven-sh/bun/releases
-ARG BUN_VERSION=0.5.7
+ARG BUN_VERSION=latest
 
 RUN apt-get update -qq \
     && apt-get install -qq --no-install-recommends \
@@ -17,7 +17,7 @@ RUN apt-get update -qq \
     && case "${arch##*-}" in \
       amd64) build="x64-baseline";; \
       arm64) build="aarch64";; \
-      *) echo "error: unsupported architecture: ($arch)"; exit 1 ;; \
+      *) echo "error: unsupported architecture: $arch"; exit 1 ;; \
     esac \
     && version="$BUN_VERSION" \
     && case "$version" in \
@@ -33,44 +33,44 @@ RUN apt-get update -qq \
       -fsSLO \
       --compressed \
       --retry 5 \
-      || (echo "error: unknown release: ($tag)" && exit 1) \
+      || (echo "error: failed to download: $tag" && exit 1) \
     && for key in \
       "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
     ; do \
       gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
       || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
     done \
-    && gpg --update-trustdb \
     && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
       -fsSLO \
       --compressed \
       --retry 5 \
     && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && unzip "bun-linux-$build.zip" \
     && mv "bun-linux-$build/bun" /usr/local/bin/bun \
     && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
     && chmod +x /usr/local/bin/bun \
-    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
     && which bun \
-    && which bunx \
     && bun --version
 
 FROM debian:bullseye-slim
 
+COPY docker-entrypoint.sh /usr/local/bin
+COPY --from=build /usr/local/bin/bun /usr/local/bin/bun
+
 RUN groupadd bun \
       --gid 1000 \
     && useradd bun \
       --uid 1000 \
       --gid bun \
       --shell /bin/sh \
-      --create-home
-
-COPY docker-entrypoint.sh /usr/local/bin
-COPY --from=build /usr/local/bin/bun /usr/local/bin
-COPY --from=build /usr/local/bin/bunx /usr/local/bin
+      --create-home \
+    && ln /usr/local/bin/bun /usr/local/bin/bunx \
+    && which bun \
+    && which bunx \
+    && bun --version
 
 WORKDIR /home/bun/app
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

dockerhub/debian/Dockerfile

@@ -1,7 +1,7 @@
 FROM debian:bullseye-slim AS build
 
 # https://github.com/oven-sh/bun/releases
-ARG BUN_VERSION=0.5.7
+ARG BUN_VERSION=latest
 
 RUN apt-get update -qq \
     && apt-get install -qq --no-install-recommends \
@@ -17,7 +17,7 @@ RUN apt-get update -qq \
     && case "${arch##*-}" in \
       amd64) build="x64-baseline";; \
       arm64) build="aarch64";; \
-      *) echo "error: unsupported architecture: ($arch)"; exit 1 ;; \
+      *) echo "error: unsupported architecture: $arch"; exit 1 ;; \
     esac \
     && version="$BUN_VERSION" \
     && case "$version" in \
@@ -33,44 +33,42 @@ RUN apt-get update -qq \
       -fsSLO \
       --compressed \
       --retry 5 \
-      || (echo "error: unknown release: ($tag)" && exit 1) \
+      || (echo "error: failed to download: $tag" && exit 1) \
     && for key in \
       "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
     ; do \
       gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
       || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
     done \
-    && gpg --update-trustdb \
     && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
       -fsSLO \
       --compressed \
       --retry 5 \
     && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && unzip "bun-linux-$build.zip" \
     && mv "bun-linux-$build/bun" /usr/local/bin/bun \
     && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
-    && chmod +x /usr/local/bin/bun \
-    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
-    && which bun \
-    && which bunx \
-    && bun --version
+    && chmod +x /usr/local/bin/bun
 
 FROM debian:bullseye
 
+COPY docker-entrypoint.sh /usr/local/bin
+COPY --from=build /usr/local/bin/bun /usr/local/bin/bun
+
 RUN groupadd bun \
       --gid 1000 \
     && useradd bun \
       --uid 1000 \
       --gid bun \
       --shell /bin/sh \
-      --create-home
-
-COPY docker-entrypoint.sh /usr/local/bin
-COPY --from=build /usr/local/bin/bun /usr/local/bin
-COPY --from=build /usr/local/bin/bunx /usr/local/bin
+      --create-home \
+    && ln /usr/local/bin/bun /usr/local/bin/bunx \
+    && which bun \
+    && which bunx \
+    && bun --version
 
 WORKDIR /home/bun/app
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

dockerhub/distroless/Dockerfile

@@ -1,5 +1,4 @@
 FROM debian:bullseye-slim AS build
-# Not officially supported (yet)
 
 # https://github.com/oven-sh/bun/releases
 ARG BUN_VERSION=latest
@@ -18,7 +17,7 @@ RUN apt-get update -qq \
     && case "${arch##*-}" in \
       amd64) build="x64-baseline";; \
       arm64) build="aarch64";; \
-      *) echo "error: unsupported architecture: ($arch)"; exit 1 ;; \
+      *) echo "error: unsupported architecture: $arch"; exit 1 ;; \
     esac \
     && version="$BUN_VERSION" \
     && case "$version" in \
@@ -34,36 +33,35 @@ RUN apt-get update -qq \
       -fsSLO \
       --compressed \
       --retry 5 \
-      || (echo "error: unknown release: ($tag)" && exit 1) \
+      || (echo "error: failed to download: $tag" && exit 1) \
     && for key in \
       "F3DCC08A8572C0749B3E18888EAB4D40A7B22B59" \
     ; do \
       gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" \
       || gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
     done \
-    && gpg --update-trustdb \
     && curl "https://github.com/oven-sh/bun/releases/$release/SHASUMS256.txt.asc" \
       -fsSLO \
       --compressed \
       --retry 5 \
     && gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && grep " bun-linux-$build.zip\$" SHASUMS256.txt | sha256sum -c - \
-      || (echo "error: failed to verify release: ($tag)" && exit 1) \
+      || (echo "error: failed to verify: $tag" && exit 1) \
     && unzip "bun-linux-$build.zip" \
     && mv "bun-linux-$build/bun" /usr/local/bin/bun \
     && rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
     && chmod +x /usr/local/bin/bun \
-    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
     && which bun \
-    && which bunx \
     && bun --version
 
 FROM gcr.io/distroless/base-nossl-debian11
 
-COPY --from=build /usr/local/bin/bun /usr/local/bin
-COPY --from=build /usr/local/bin/bunx /usr/local/bin
+COPY --from=build /usr/local/bin/bun /usr/local/bin/
+
+# Known issue: `bunx` is not available in distroless.
+#
+# If `ln` is used in the build image, the size of the final
+# image will be double, because of: https://github.com/oven-sh/bun/issues/5269
 
-WORKDIR /app
 ENTRYPOINT ["/usr/local/bin/bun"]
-CMD ["/usr/local/bin/bun"]