fix: improve docker set up (#3924)

Improves the docker set up and removes some unused files.

Closes #3914
Closes #3916
Closes #3685
Closes #3683

Author: aeneasr

.docker/Dockerfile-alpine

@@ -1,22 +1,22 @@
 FROM alpine:3.20
 
-RUN addgroup -S ory; \
-    adduser -S ory -G ory -D -H -s /bin/nologin && \
-    apk upgrade --no-cache && \
+RUN <<HEREDOC
     apk add --no-cache --upgrade ca-certificates
 
-COPY hydra /usr/bin/hydra
-
-# set up nsswitch.conf for Go's "netgo" implementation
-# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
-RUN echo 'hosts: files dns' > /etc/nsswitch.conf
+    # Add a user/group for nonroot with a stable UID + GID. Values are from nonroot from distroless
+    # for interoperability with other containers.
+    addgroup --system --gid 65532 nonroot
+    adduser --system --uid 65532 \
+      --gecos "nonroot User" \
+      --home /home/nonroot \
+      --ingroup nonroot \
+      --shell /sbin/nologin \
+      nonroot
+HEREDOC
 
-# By creating the sqlite folder as the ory user, the mounted volume will be owned by ory:ory, which
-# is required for read/write of SQLite.
-RUN mkdir -p /var/lib/sqlite && \
-    chown ory:ory /var/lib/sqlite
+COPY hydra /usr/bin/hydra
 
-USER ory
+USER nonroot
 
 ENTRYPOINT ["hydra"]
 CMD ["serve", "all"]

.docker/Dockerfile-hsm

@@ -3,7 +3,6 @@ FROM golang:1.22 AS builder
 WORKDIR /go/src/github.com/ory/hydra
 
 RUN apt-get update && apt-get upgrade -y &&\
-    mkdir -p /var/lib/sqlite &&\
     mkdir -p ./internal/httpclient
 
 COPY go.mod go.sum ./
@@ -18,13 +17,10 @@ RUN go build -ldflags="-extldflags=-static" -tags sqlite,sqlite_omit_load_extens
 
 #########################
 
-FROM gcr.io/distroless/static-debian12:nonroot AS runner
+FROM gcr.io/distroless/static-debian12:debug-nonroot AS runner
 
-COPY --from=builder --chown=nonroot:nonroot /var/lib/sqlite /var/lib/sqlite
 COPY --from=builder /usr/bin/hydra /usr/bin/hydra
 
-VOLUME /var/lib/sqlite
-
 # Declare the standard ports used by hydra (4444 for public service endpoint, 4445 for admin service endpoint)
 EXPOSE 4444 4445
 

.docker/Dockerfile-build .docker/Dockerfile-local-build.docker/Dockerfile-build renamed to .docker/Dockerfile-local-build

@@ -0,0 +1,32 @@
+FROM golang:1.23-alpine3.21 AS builder
+
+RUN apk add --no-cache build-base git gcc bash
+
+WORKDIR /go/src/github.com/ory/hydra
+RUN mkdir -p ./internal/httpclient
+
+COPY go.mod go.sum ./
+COPY internal/httpclient/go.* ./internal/httpclient
+
+ENV CGO_ENABLED 1
+
+RUN go mod download
+COPY . .
+
+RUN go build -tags sqlite,hsm -o /usr/bin/hydra
+
+ENV HSM_ENABLED=true
+ENV HSM_LIBRARY=/usr/lib/softhsm/libsofthsm2.so
+ENV HSM_TOKEN_LABEL=hydra
+ENV HSM_PIN=1234
+
+RUN apk add --no-cache softhsm opensc
+RUN pkcs11-tool --module "$HSM_LIBRARY" --slot 0 --init-token --so-pin 0000 --init-pin --pin "$HSM_PIN" --label "$HSM_TOKEN_LABEL"
+
+FROM builder as test-hsm
+
+RUN go test -p 1 -failfast -short -tags=sqlite,hsm ./...
+
+FROM builder AS test-refresh-hsm
+
+RUN UPDATE_SNAPSHOTS=true go test -p 1 -failfast -short -tags=sqlite,hsm,refresh ./...

.docker/Dockerfile-scratch

@@ -0,0 +1,6 @@
+This directory contains Dockerfiles for various targets:
+
+- `Dockerfile-distroless` and `Dockerfile-alpine` are published to Docker Hub
+  via GoReleaser.
+- The other `Dockerfile` variants are intended only for local development and
+  tests.

.docker/Dockerfile-sqlite

@@ -128,7 +128,7 @@ jobs:
           go-version: "1.22"
       - name: Setup HSM libs and packages
         run: |
-          sudo apt install -y softhsm opensc
+          sudo apt install -y softhsm2 opensc
           sudo rm -rf /var/lib/softhsm/tokens
           sudo mkdir -p /var/lib/softhsm/tokens
           sudo chmod -R a+rwx /var/lib/softhsm

.docker/Dockerfile-test-hsm

@@ -121,7 +121,7 @@ jobs:
         id: hadolint
         if: ${{ always() }}
         with:
-          dockerfile: .docker/Dockerfile-build
+          dockerfile: .docker/Dockerfile-local-build
           verbose: true
           format: "json"
           failure-threshold: "error"

.docker/README.md

@@ -1,3 +1,5 @@
+version: 2
+
 includes:
   - from_url:
       url: https://raw.githubusercontent.com/ory/xgoreleaser/master/build.tmpl.yml