mirror of
https://github.com/jwetzell/docker-guacamole.git
synced 2026-08-20 14:39:07 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jwetzell
|
cabf2a5eca |
@@ -0,0 +1,41 @@
|
||||
# Security Policies and Procedures
|
||||
|
||||
This document outlines security procedures and general policies for the `docker-guacamole` project.
|
||||
|
||||
* [Reporting a Bug](#reporting-a-bug)
|
||||
* [Disclosure Policy](#disclosure-policy)
|
||||
* [Comments on this Policy](#comments-on-this-policy)
|
||||
|
||||
## Reporting a Bug
|
||||
|
||||
The `docker-guacamole` team and community take all security bugs in `docker-guacamole`
|
||||
seriously. Thank you for improving the security of `docker-guacamole`. We appreciate
|
||||
your efforts and responsible disclosure and will make every effort to acknowledge
|
||||
your contributions.
|
||||
|
||||
Report security bugs by emailing the maintainer at dev@oz.nu
|
||||
|
||||
The maintainer will acknowledge your email within 48 hours, and will send a
|
||||
more detailed response within 48 hours indicating the next steps in handling
|
||||
your report. After the initial reply to your report, the security team will
|
||||
endeavor to keep you informed of the progress towards a fix and full
|
||||
announcement, and may ask for additional information or guidance.
|
||||
|
||||
Report security bugs in third-party modules to the person or team maintaining
|
||||
the module.
|
||||
|
||||
## Disclosure Policy
|
||||
|
||||
When the security team receives a security bug report, they will assign it to a
|
||||
primary handler. This person will coordinate the fix and release process,
|
||||
involving the following steps:
|
||||
|
||||
* Confirm the problem and determine the affected versions.
|
||||
* Audit code to find any potential similar problems.
|
||||
* Prepare fixes for all releases still under maintenance. These fixes will be
|
||||
released as fast as possible to npm.
|
||||
|
||||
## Comments on this Policy
|
||||
|
||||
If you have suggestions on how this process could be improved please submit a
|
||||
pull request.
|
||||
@@ -1,6 +0,0 @@
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: 'github-actions'
|
||||
directory: '/'
|
||||
schedule:
|
||||
interval: 'weekly'
|
||||
@@ -1,31 +0,0 @@
|
||||
name: build-base
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
paths:
|
||||
- 'Dockerfile.base'
|
||||
branches:
|
||||
- 'master'
|
||||
jobs:
|
||||
docker:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
push: true
|
||||
file: Dockerfile.base
|
||||
tags: jwetzell/guacamole:base
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
platforms: linux/amd64,linux/arm64,linux/arm/v7
|
||||
@@ -1,30 +0,0 @@
|
||||
name: build-latest
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
paths:
|
||||
- 'Dockerfile'
|
||||
- 'root/**'
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
push: true
|
||||
tags: jwetzell/guacamole:latest
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
platforms: linux/amd64,linux/arm64,linux/arm/v7
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
language: bash
|
||||
|
||||
os: linux
|
||||
|
||||
services:
|
||||
- docker
|
||||
|
||||
matrix:
|
||||
include:
|
||||
# amd64
|
||||
- os: linux
|
||||
arch: amd64
|
||||
env:
|
||||
- DOCKERFILE="Dockerfile"
|
||||
- TAG_SUFFIX="latest"
|
||||
- ALT_SUFFIX="amd64"
|
||||
|
||||
# arm32v5
|
||||
- os: linux
|
||||
arch: arm64
|
||||
env:
|
||||
- DOCKERFILE="Dockerfile.raspberry-pi"
|
||||
- TAG_SUFFIX="arm32v5"
|
||||
- ALT_SUFFIX="armhf"
|
||||
|
||||
script:
|
||||
- export TARGET_IMAGE_TAG=$(if [ "$TRAVIS_BRANCH" = "master" ]; then if [ "$TAG_SUFFIX" = "" ]; then echo "latest"; else echo "$TAG_SUFFIX"; fi; else if [ "$TAG_SUFFIX" = "" ]; then echo "$TRAVIS_BRANCH"; else echo "$TRAVIS_BRANCH-$TAG_SUFFIX"; fi; fi)
|
||||
- docker pull $TARGET_IMAGE:$TARGET_IMAGE_TAG && export IMAGE_CACHE="--cache-from $TARGET_IMAGE:$TARGET_IMAGE_TAG" || export IMAGE_CACHE=""
|
||||
- docker build -f $DOCKERFILE $IMAGE_CACHE -t $TARGET_IMAGE:$TARGET_IMAGE_TAG .
|
||||
- docker login --username $DOCKER_USERNAME --password $DOCKER_PASSWORD
|
||||
- docker push $TARGET_IMAGE:$TARGET_IMAGE_TAG
|
||||
|
||||
# push alternate tags
|
||||
- if [ -z "$ALT_SUFFIX" ]; then
|
||||
echo "No alternate tags set for this build.";
|
||||
else
|
||||
echo "Tagging with alternate tag '$ALT_SUFFIX'";
|
||||
export ALT_IMAGE_TAG=$(if [ "$TRAVIS_BRANCH" = "master" ]; then if [ "$ALT_SUFFIX" = "" ]; then echo "error"; else echo "$ALT_SUFFIX"; fi; else if [ "$ALT_SUFFIX" = "" ]; then echo "$TRAVIS_BRANCH"; else echo "$TRAVIS_BRANCH-$ALT_SUFFIX"; fi; fi);
|
||||
docker tag $TARGET_IMAGE:$TARGET_IMAGE_TAG $TARGET_IMAGE:$ALT_IMAGE_TAG;
|
||||
docker push $TARGET_IMAGE:$ALT_IMAGE_TAG;
|
||||
fi
|
||||
|
||||
@@ -1,4 +1,39 @@
|
||||
FROM jwetzell/guacamole:base
|
||||
FROM library/tomcat:9-jre11-openjdk-bullseye
|
||||
|
||||
ENV ARCH=amd64 \
|
||||
GUAC_VER=1.5.4 \
|
||||
GUACAMOLE_HOME=/app/guacamole \
|
||||
LIBSSH2_VER=1.11.0
|
||||
|
||||
# Install dependencies
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y curl ca-certificates gnupg \
|
||||
libcairo2-dev libjpeg62-turbo-dev libpng-dev libavformat-dev \
|
||||
libossp-uuid-dev libavcodec-dev libavutil-dev \
|
||||
libswscale-dev freerdp2-dev libfreerdp-client2-2 libpango1.0-dev \
|
||||
libtelnet-dev libvncserver-dev \
|
||||
libpulse-dev libssl-dev libvorbis-dev libwebp-dev libwebsockets-dev \
|
||||
ghostscript build-essential libreadline-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Build & install libssh2
|
||||
ADD https://www.libssh2.org/download/libssh2-${LIBSSH2_VER}.tar.gz /tmp
|
||||
RUN tar -xzvf /tmp/libssh2-${LIBSSH2_VER}.tar.gz \
|
||||
&& cd libssh2-${LIBSSH2_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/libssh2-${LIBSSH2_VER}*
|
||||
|
||||
# Apply the s6-overlay
|
||||
ADD https://github.com/just-containers/s6-overlay/releases/download/v2.2.0.3/s6-overlay-amd64.tar.gz /tmp
|
||||
RUN tar -xzf /tmp/s6-overlay-amd64.tar.gz -C / \
|
||||
&& tar -xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin \
|
||||
&& rm -rf /tmp/s6-overlay-amd64.tar.gz
|
||||
|
||||
RUN mkdir -p ${GUACAMOLE_HOME} \
|
||||
${GUACAMOLE_HOME}/lib \
|
||||
${GUACAMOLE_HOME}/extensions
|
||||
|
||||
WORKDIR ${GUACAMOLE_HOME}
|
||||
|
||||
@@ -21,15 +56,15 @@ RUN curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/source/guac
|
||||
# Create directory for extensions
|
||||
RUN mkdir ${GUACAMOLE_HOME}/extensions-available
|
||||
|
||||
# Install guacamole-client and postgres auth adapter
|
||||
RUN set -xe \
|
||||
# Install guacamole-client
|
||||
RUN set -x \
|
||||
&& rm -rf ${CATALINA_HOME}/webapps/ROOT \
|
||||
&& curl -SLo ${CATALINA_HOME}/webapps/ROOT.war "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${GUAC_VER}.war" \
|
||||
&& curl -SLo ${GUACAMOLE_HOME}/lib/postgresql-42.1.4.jar "https://jdbc.postgresql.org/download/postgresql-42.2.24.jar" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-jdbc-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-auth-jdbc-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/postgresql/guacamole-auth-jdbc-postgresql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions/ \
|
||||
&& cp -R guacamole-auth-jdbc-${GUAC_VER}/postgresql/schema ${GUACAMOLE_HOME}/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/postgresql/guacamole-auth-jdbc-postgresql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/mysql/guacamole-auth-jdbc-mysql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/sqlserver/guacamole-auth-jdbc-sqlserver-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-auth-jdbc-${GUAC_VER} guacamole-auth-jdbc-${GUAC_VER}.tar.gz
|
||||
|
||||
# add auth-sso to available extensions folder structur differs from other extensions
|
||||
@@ -42,7 +77,7 @@ RUN set -xe \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/saml/guacamole-auth-sso-saml-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-auth-sso-${GUAC_VER} guacamole-auth-sso-${GUAC_VER}.tar.gz
|
||||
|
||||
# add vault to available extensions, folder structur differs from other extensions
|
||||
# add vault to available extensions folder structur differs from other extensions
|
||||
RUN set -xe \
|
||||
&& echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
@@ -52,7 +87,7 @@ RUN set -xe \
|
||||
|
||||
# Add optional extensions
|
||||
RUN set -xe \
|
||||
&& for i in auth-ban auth-duo auth-header auth-json auth-ldap auth-quickconnect auth-totp auth-restrict history-recording-storage; do \
|
||||
&& for i in auth-duo auth-header auth-json auth-ldap auth-quickconnect auth-totp history-recording-storage; do \
|
||||
echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-${i}-${GUAC_VER}.tar.gz \
|
||||
@@ -0,0 +1,123 @@
|
||||
FROM library/tomcat:9-jre11-openjdk-bullseye
|
||||
|
||||
ENV GUAC_VER=1.5.4 \
|
||||
GUACAMOLE_HOME=/app/guacamole \
|
||||
PG_VER=9.6.24 \
|
||||
LIBSSH2_VER=1.11.0 \
|
||||
PGDATA=/config/postgres \
|
||||
POSTGRES_USER=guacamole \
|
||||
POSTGRES_DB=guacamole_db
|
||||
|
||||
# Install dependencies
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y curl ca-certificates gnupg \
|
||||
libcairo2-dev libjpeg62-turbo-dev libpng-dev libavformat-dev \
|
||||
libossp-uuid-dev libavcodec-dev libavutil-dev \
|
||||
libswscale-dev freerdp2-dev libfreerdp-client2-2 libpango1.0-dev \
|
||||
libtelnet-dev libvncserver-dev \
|
||||
libpulse-dev libssl-dev libvorbis-dev libwebp-dev libwebsockets-dev \
|
||||
ghostscript build-essential libreadline-dev
|
||||
|
||||
# Build & install libssh2
|
||||
ADD https://www.libssh2.org/download/libssh2-${LIBSSH2_VER}.tar.gz /tmp
|
||||
RUN tar -xzvf /tmp/libssh2-${LIBSSH2_VER}.tar.gz \
|
||||
&& cd libssh2-${LIBSSH2_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/libssh2-${LIBSSH2_VER}*
|
||||
|
||||
# Build & install postgresql
|
||||
ADD https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.gz /tmp
|
||||
RUN tar -xzvf /tmp/postgresql-${PG_VER}.tar.gz \
|
||||
&& cd postgresql-${PG_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/postgresql-${PG_VER}*
|
||||
|
||||
RUN useradd postgres
|
||||
|
||||
# Apply the s6-overlay
|
||||
ADD https://github.com/just-containers/s6-overlay/releases/download/v2.2.0.3/s6-overlay-armhf.tar.gz /tmp
|
||||
RUN tar -xzf /tmp/s6-overlay-armhf.tar.gz -C / \
|
||||
&& tar -xzf /tmp/s6-overlay-armhf.tar.gz -C /usr ./bin \
|
||||
&& rm -rf /tmp/s6-overlay-armhf.tar.gz
|
||||
|
||||
RUN mkdir -p ${GUACAMOLE_HOME} \
|
||||
${GUACAMOLE_HOME}/lib \
|
||||
${GUACAMOLE_HOME}/extensions
|
||||
|
||||
WORKDIR ${GUACAMOLE_HOME}
|
||||
|
||||
# Link FreeRDP to where guac expects it to be
|
||||
RUN ln -s /usr/local/lib/freerdp /usr/lib/arm-linux-gnueabihf/freerdp || exit 0
|
||||
|
||||
# Install guacamole-server
|
||||
|
||||
RUN curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/source/guacamole-server-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-server-${GUAC_VER}.tar.gz \
|
||||
&& cd guacamole-server-${GUAC_VER} \
|
||||
&& export LDFLAGS="-lrt" \
|
||||
&& ./configure --enable-allow-freerdp-snapshots \
|
||||
&& make -j$(getconf _NPROCESSORS_ONLN) \
|
||||
&& make install \
|
||||
&& cd .. \
|
||||
&& rm -rf guacamole-server-${GUAC_VER}.tar.gz guacamole-server-${GUAC_VER} \
|
||||
&& ldconfig
|
||||
|
||||
# Create directory for extensions
|
||||
RUN mkdir ${GUACAMOLE_HOME}/extensions-available
|
||||
|
||||
# Install guacamole-client and postgres auth adapter
|
||||
RUN set -x \
|
||||
&& rm -rf ${CATALINA_HOME}/webapps/ROOT \
|
||||
&& curl -SLo ${CATALINA_HOME}/webapps/ROOT.war "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${GUAC_VER}.war" \
|
||||
&& curl -SLo ${GUACAMOLE_HOME}/lib/postgresql-42.1.4.jar "https://jdbc.postgresql.org/download/postgresql-42.2.24.jar" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-jdbc-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-auth-jdbc-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/postgresql/guacamole-auth-jdbc-postgresql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/postgresql/guacamole-auth-jdbc-postgresql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/mysql/guacamole-auth-jdbc-mysql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-jdbc-${GUAC_VER}/sqlserver/guacamole-auth-jdbc-sqlserver-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp -R guacamole-auth-jdbc-${GUAC_VER}/postgresql/schema ${GUACAMOLE_HOME}/ \
|
||||
&& rm -rf guacamole-auth-jdbc-${GUAC_VER} guacamole-auth-jdbc-${GUAC_VER}.tar.gz
|
||||
|
||||
# add auth-sso to available extensions folder structur differs from other extensions
|
||||
RUN set -xe \
|
||||
&& echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-sso-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-sso-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-auth-sso-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/cas/guacamole-auth-sso-cas-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/openid/guacamole-auth-sso-openid-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/saml/guacamole-auth-sso-saml-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-auth-sso-${GUAC_VER} guacamole-auth-sso-${GUAC_VER}.tar.gz
|
||||
|
||||
# add vault to available extensions folder structur differs from other extensions
|
||||
RUN set -xe \
|
||||
&& echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-vault-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-vault-${GUAC_VER}/ksm/guacamole-vault-ksm-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-vault-${GUAC_VER} guacamole-vault-${GUAC_VER}.tar.gz
|
||||
|
||||
# Add optional extensions
|
||||
RUN set -xe \
|
||||
&& for i in auth-duo auth-header auth-json auth-ldap auth-quickconnect auth-totp history-recording-storage; do \
|
||||
echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-${i}-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-${i}-${GUAC_VER}/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-${i}-${GUAC_VER} guacamole-${i}-${GUAC_VER}.tar.gz \
|
||||
;done
|
||||
|
||||
ENV PATH="/usr/local/pgsql/bin:$PATH"
|
||||
ENV GUACAMOLE_HOME=/config/guacamole
|
||||
|
||||
WORKDIR /config
|
||||
|
||||
COPY root /
|
||||
|
||||
EXPOSE 8080
|
||||
|
||||
ENTRYPOINT [ "/init" ]
|
||||
@@ -1,61 +0,0 @@
|
||||
FROM tomcat:9.0.111-jdk17-temurin-noble
|
||||
ARG TARGETPLATFORM
|
||||
|
||||
ENV GUAC_VER=1.6.0 \
|
||||
GUACAMOLE_HOME=/app/guacamole \
|
||||
PG_VER=9.6.24 \
|
||||
LIBSSH2_VER=1.11.0 \
|
||||
PGDATA=/config/postgres \
|
||||
POSTGRES_USER=guacamole \
|
||||
POSTGRES_DB=guacamole_db
|
||||
|
||||
# Add user for postgres
|
||||
RUN useradd postgres
|
||||
|
||||
# Cleanup default tomcat stuff
|
||||
RUN rm -rf /usr/local/tomcat/webapps.dist
|
||||
|
||||
RUN echo $TARGETPLATFORM
|
||||
|
||||
# Apply the s6-overlay
|
||||
RUN if [ "$TARGETPLATFORM" = "linux/amd64" ]; then ARCHITECTURE=amd64; elif [ "$TARGETPLATFORM" = "linux/arm/v7" ]; then ARCHITECTURE=armhf; elif [ "$TARGETPLATFORM" = "linux/arm/v8" ]; then ARCHITECTURE=aarch64; elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then ARCHITECTURE=aarch64; fi \
|
||||
&& curl -sS -L -O --output-dir /tmp/ --create-dirs "https://github.com/just-containers/s6-overlay/releases/download/v2.2.0.3/s6-overlay-${ARCHITECTURE}-installer" \
|
||||
&& chmod +x /tmp/s6-overlay-${ARCHITECTURE}-installer && /tmp/s6-overlay-${ARCHITECTURE}-installer / \
|
||||
&& rm -rf /tmp/s6-overlay-${ARCHITECTURE}-installer
|
||||
|
||||
# make dirs for guacamole install
|
||||
RUN mkdir -p ${GUACAMOLE_HOME} \
|
||||
${GUACAMOLE_HOME}/lib \
|
||||
${GUACAMOLE_HOME}/extensions
|
||||
|
||||
# Install dependencies
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y curl ca-certificates gnupg \
|
||||
libcairo2-dev libjpeg-turbo8-dev libpng-dev libavformat-dev \
|
||||
libossp-uuid-dev libavcodec-dev libavutil-dev \
|
||||
libswscale-dev freerdp2-dev libpango1.0-dev \
|
||||
libtelnet-dev libvncserver-dev \
|
||||
libpulse-dev libssl-dev libvorbis-dev libwebp-dev libwebsockets-dev \
|
||||
ghostscript build-essential libreadline-dev \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Download libssh2 and postgresql source
|
||||
ADD https://www.libssh2.org/download/libssh2-${LIBSSH2_VER}.tar.gz /tmp
|
||||
ADD https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.gz /tmp
|
||||
|
||||
|
||||
# Build & install libssh2
|
||||
RUN tar -xzvf /tmp/libssh2-${LIBSSH2_VER}.tar.gz \
|
||||
&& cd libssh2-${LIBSSH2_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/libssh2-${LIBSSH2_VER}*
|
||||
|
||||
# Build & install postgresql
|
||||
RUN tar -xzvf /tmp/postgresql-${PG_VER}.tar.gz \
|
||||
&& cd postgresql-${PG_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/postgresql-${PG_VER}*
|
||||
@@ -0,0 +1,113 @@
|
||||
FROM arm32v7/tomcat:9-jre11
|
||||
|
||||
ENV GUAC_VER=1.5.4 \
|
||||
GUACAMOLE_HOME=/app/guacamole \
|
||||
PG_VER=9.6.24 \
|
||||
LIBSSH2_VER=1.11.0 \
|
||||
PGDATA=/config/postgres \
|
||||
POSTGRES_USER=guacamole \
|
||||
POSTGRES_DB=guacamole_db
|
||||
|
||||
# Install base dependencies
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y curl ca-certificates gnupg \
|
||||
libcairo2-dev libjpeg-turbo8-dev libpng-dev libavformat-dev \
|
||||
libossp-uuid-dev libavcodec-dev libavutil-dev \
|
||||
libswscale-dev freerdp2-dev libfreerdp-client2-2 libpango1.0-dev \
|
||||
libtelnet-dev libvncserver-dev \
|
||||
libpulse-dev libssl-dev libvorbis-dev libwebp-dev libwebsockets-dev \
|
||||
ghostscript build-essential libreadline-dev
|
||||
|
||||
# Build & install libssh2
|
||||
ADD https://www.libssh2.org/download/libssh2-${LIBSSH2_VER}.tar.gz /tmp
|
||||
RUN tar -xzvf /tmp/libssh2-${LIBSSH2_VER}.tar.gz \
|
||||
&& cd libssh2-${LIBSSH2_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/libssh2-${LIBSSH2_VER}*
|
||||
|
||||
# Build & install postgresql
|
||||
ADD https://ftp.postgresql.org/pub/source/v${PG_VER}/postgresql-${PG_VER}.tar.gz /tmp
|
||||
RUN tar -xzvf /tmp/postgresql-${PG_VER}.tar.gz \
|
||||
&& cd postgresql-${PG_VER} \
|
||||
&& ./configure \
|
||||
&& make \
|
||||
&& make install \
|
||||
&& rm -rf /tmp/postgresql-${PG_VER}*
|
||||
|
||||
RUN useradd postgres
|
||||
|
||||
# Apply the s6-overlay
|
||||
ADD https://github.com/just-containers/s6-overlay/releases/download/v2.2.0.3/s6-overlay-armhf.tar.gz /tmp
|
||||
RUN tar -xzf /tmp/s6-overlay-armhf.tar.gz -C / \
|
||||
&& tar -xzf /tmp/s6-overlay-armhf.tar.gz -C /usr ./bin \
|
||||
&& rm -rf /tmp/s6-overlay-armhf.tar.gz
|
||||
|
||||
RUN mkdir -p ${GUACAMOLE_HOME} \
|
||||
${GUACAMOLE_HOME}/lib \
|
||||
${GUACAMOLE_HOME}/extensions
|
||||
|
||||
WORKDIR ${GUACAMOLE_HOME}
|
||||
|
||||
# Link FreeRDP to where guac expects it to be
|
||||
RUN ln -s /usr/local/lib/freerdp /usr/lib/arm-linux-gnueabihf/freerdp || exit 0
|
||||
|
||||
# Install guacamole-server
|
||||
RUN curl -SLOk "https://archive.apache.org/dist/guacamole/${GUAC_VER}/source/guacamole-server-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-server-${GUAC_VER}.tar.gz \
|
||||
&& cd guacamole-server-${GUAC_VER} \
|
||||
&& ./configure --enable-allow-freerdp-snapshots \
|
||||
&& make -j$(getconf _NPROCESSORS_ONLN) \
|
||||
&& make install \
|
||||
&& cd .. \
|
||||
&& rm -rf guacamole-server-${GUAC_VER}.tar.gz guacamole-server-${GUAC_VER} \
|
||||
&& ldconfig
|
||||
|
||||
# Install guacamole-client and postgres auth adapter
|
||||
RUN set -x \
|
||||
&& rm -rf ${CATALINA_HOME}/webapps/ROOT \
|
||||
&& curl -SLko ${CATALINA_HOME}/webapps/ROOT.war "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${GUAC_VER}.war" \
|
||||
&& curl -SLko ${GUACAMOLE_HOME}/lib/postgresql-42.1.4.jar "https://jdbc.postgresql.org/download/postgresql-42.2.24.jar" \
|
||||
&& curl -SLkO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-jdbc-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-auth-jdbc-${GUAC_VER}.tar.gz \
|
||||
&& cp -R guacamole-auth-jdbc-${GUAC_VER}/postgresql/guacamole-auth-jdbc-postgresql-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions/ \
|
||||
&& cp -R guacamole-auth-jdbc-${GUAC_VER}/postgresql/schema ${GUACAMOLE_HOME}/ \
|
||||
&& rm -rf guacamole-auth-jdbc-${GUAC_VER} guacamole-auth-jdbc-${GUAC_VER}.tar.gz
|
||||
|
||||
# add auth-sso to available extensions folder structur differs from other extensions
|
||||
RUN set -xe \
|
||||
&& echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-sso-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-auth-sso-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-auth-sso-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/cas/guacamole-auth-sso-cas-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/openid/guacamole-auth-sso-openid-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& cp guacamole-auth-sso-${GUAC_VER}/saml/guacamole-auth-sso-saml-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-auth-sso-${GUAC_VER} guacamole-auth-sso-${GUAC_VER}.tar.gz
|
||||
|
||||
# add vault to available extensions folder structur differs from other extensions
|
||||
RUN set -xe \
|
||||
&& echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-vault-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-vault-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-vault-${GUAC_VER}/ksm/guacamole-vault-ksm-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-vault-${GUAC_VER} guacamole-vault-${GUAC_VER}.tar.gz
|
||||
|
||||
# Add optional extensions
|
||||
RUN set -xe \
|
||||
&& for i in auth-duo auth-header auth-json auth-ldap auth-quickconnect auth-totp history-recording-storage; do \
|
||||
echo "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& curl -SLO "https://archive.apache.org/dist/guacamole/${GUAC_VER}/binary/guacamole-${i}-${GUAC_VER}.tar.gz" \
|
||||
&& tar -xzf guacamole-${i}-${GUAC_VER}.tar.gz \
|
||||
&& cp guacamole-${i}-${GUAC_VER}/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions-available/ \
|
||||
&& rm -rf guacamole-${i}-${GUAC_VER} guacamole-${i}-${GUAC_VER}.tar.gz \
|
||||
;done
|
||||
|
||||
ENV PATH="/usr/local/pgsql/bin:$PATH"
|
||||
ENV GUACAMOLE_HOME=/config/guacamole
|
||||
|
||||
WORKDIR /config
|
||||
|
||||
COPY root /
|
||||
|
||||
ENTRYPOINT [ "/init" ]
|
||||
@@ -18,18 +18,18 @@ This container runs the guacamole web client, the guacd server and a postgres da
|
||||
docker run \
|
||||
-p 8080:8080 \
|
||||
-v </path/to/config>:/config \
|
||||
jwetzell/guacamole:1.6.0-20250711
|
||||
jwetzell/guacamole
|
||||
```
|
||||
|
||||
## Raspberry Pi / ARMv7
|
||||
|
||||
Now that the image has been converted to a multi-platform image the command for Raspberry Pi's or other ARM devices is the same.
|
||||
This image will also allow you to run [Apache Guacamole](https://guacamole.apache.org/) on a Raspberry Pi or other Docker-enabled ARMv5/6/7/8 devices by using the `arm32v7` tag.
|
||||
|
||||
```shell
|
||||
docker run \
|
||||
-p 8080:8080 \
|
||||
-v </path/to/config>:/config \
|
||||
jwetzell/guacamole:1.6.0-20250711
|
||||
jwetzell/guacamole:arm32v7
|
||||
```
|
||||
|
||||
## Parameters
|
||||
@@ -51,21 +51,22 @@ docker run \
|
||||
-p 8080:8080 \
|
||||
-v </path/to/config>:/config \
|
||||
-e "EXTENSIONS=auth-ldap,auth-duo"
|
||||
jwetzell/guacamole:1.6.0-20250711
|
||||
jwetzell/guacamole
|
||||
```
|
||||
|
||||
Currently the available extensions are:
|
||||
|
||||
* auth-ban - [Blocking brute-force attacks](https://guacamole.apache.org/doc/gug/auth-ban.html)
|
||||
* auth-duo - [Duo two-factor authentication](https://guacamole.apache.org/doc/gug/duo-auth.html)
|
||||
* auth-header - [HTTP header authentication](https://guacamole.apache.org/doc/gug/header-auth.html)
|
||||
* auth-jdbc-mysql - [MySQL Authentication](https://guacamole.apache.org/doc/gug/jdbc-auth.html)
|
||||
* auth-jdbc-postgresql - [PostgreSQL Authentication](https://guacamole.apache.org/doc/gug/jdbc-auth.html)
|
||||
* auth-jdbc-sqlserver - [SQL Server Authentication](https://guacamole.apache.org/doc/gug/jdbc-auth.html)
|
||||
* auth-json - [Encrypted JSON Authentication](https://guacamole.apache.org/doc/gug/json-auth.html)
|
||||
* auth-ldap - [LDAP Authentication](https://guacamole.apache.org/doc/gug/ldap-auth.html)
|
||||
* auth-quickconnect - [Ad-hoc connections extension](https://guacamole.apache.org/doc/gug/adhoc-connections.html)
|
||||
* auth-sso-cas - [CAS Authentication](https://guacamole.apache.org/doc/gug/cas-auth.html)
|
||||
* auth-sso-openid - [OpenID Authentication](https://guacamole.apache.org/doc/gug/openid-auth.html)
|
||||
* auth-sso-saml - [SAML Authentication](https://guacamole.apache.org/doc/gug/saml-auth.html)
|
||||
* auth-restrict - [Login / Connection restrictions](https://guacamole.apache.org/doc/gug/auth-restrict.html)
|
||||
* auth-totp - [TOTP two-factor authentication](https://guacamole.apache.org/doc/gug/totp-auth.html)
|
||||
* history-recording-storage - [Session Recording Playback](https://guacamole.apache.org/doc/gug/recording-playback.html#)
|
||||
* vault - [Retrieving secrets from a vault](https://guacamole.apache.org/doc/gug/vault.html)
|
||||
@@ -84,7 +85,7 @@ Mapped volumes behave differently when running Docker for Windows and you may en
|
||||
version: "2"
|
||||
services:
|
||||
guacamole:
|
||||
image: jwetzell/guacamole:1.6.0-20250711
|
||||
image: jwetzell/guacamole
|
||||
container_name: guacamole
|
||||
volumes:
|
||||
- postgres:/config
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
postgresql-hostname: localhost
|
||||
postgresql-port: 5432
|
||||
postgresql-database: guacamole_db
|
||||
postgresql-username: guacamole
|
||||
postgresql-password: null
|
||||
# postgresql-hostname: localhost
|
||||
# postgresql-port: 5432
|
||||
# postgresql-database: guacamole_db
|
||||
# postgresql-username: guacamole
|
||||
# postgresql-password: null
|
||||
|
||||
# ldap-hostname: ldap.example.net
|
||||
# ldap-port: 389
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
mkdir -p /config/postgres
|
||||
mkdir -p /var/run/postgresql
|
||||
chown postgres:postgres /var/run/postgresql
|
||||
chown -R postgres:postgres /config/postgres
|
||||
chmod 0700 /config/postgres
|
||||
|
||||
if [ -e /config/postgres/postgresql.conf ]; then
|
||||
echo "Database already configured"
|
||||
else
|
||||
s6-setuidgid postgres initdb
|
||||
fi
|
||||
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
# clean up extensions
|
||||
for i in auth-ldap auth-duo auth-header auth-cas auth-openid auth-quickconnect auth-totp; do
|
||||
rm -rf ${GUACAMOLE_HOME}/extensions/guacamole-${i}-${GUAC_VER}.jar
|
||||
done
|
||||
|
||||
# if the guacamole version was bumped, delete the contents of the extensions directory - just on the first run
|
||||
# if [ "$(cat /config/.database-version)" != "$GUAC_VER" ]; then
|
||||
# rm -rf ${GUACAMOLE_HOME}/extensions/*
|
||||
# fi
|
||||
|
||||
# enable extensions
|
||||
for i in $(echo "$EXTENSIONS" | tr "," " "); do
|
||||
cp ${GUACAMOLE_HOME}/extensions-available/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions
|
||||
done
|
||||
@@ -1,16 +0,0 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
echo "Cleaning Extensions from previous Guacamole versions"
|
||||
for e in $(ls -1 ${GUACAMOLE_HOME}/extensions | grep guacamole | grep -v ${GUAC_VER}); do
|
||||
rm ${GUACAMOLE_HOME}/extensions/${e}
|
||||
done
|
||||
|
||||
echo "Cleaning Extensions"
|
||||
for i in auth-duo auth-header auth-json auth-ldap auth-quickconnect auth-sso-cas auth-sso-openid auth-sso-saml auth-totp history-recording-storage vault-ksm; do
|
||||
rm -rf ${GUACAMOLE_HOME}/extensions/guacamole-${i}-${GUAC_VER}.jar
|
||||
done
|
||||
|
||||
# enable extensions
|
||||
for i in $(echo "$EXTENSIONS" | tr "," " "); do
|
||||
cp ${GUACAMOLE_HOME}/extensions-available/guacamole-${i}-${GUAC_VER}.jar ${GUACAMOLE_HOME}/extensions
|
||||
done
|
||||
@@ -1,29 +1,29 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
until pg_isready; do
|
||||
echo "Waiting for postgres to come up..."
|
||||
sleep 1
|
||||
done
|
||||
# until pg_isready; do
|
||||
# echo "Waiting for postgres to come up..."
|
||||
# sleep 1
|
||||
# done
|
||||
|
||||
# Create database if it does not exist
|
||||
psql -U postgres -lqt | cut -d \| -f 1 | grep -qw $POSTGRES_DB
|
||||
if [ $? -ne 0 ]; then
|
||||
createuser -U postgres $POSTGRES_USER
|
||||
createdb -U postgres -O $POSTGRES_USER $POSTGRES_DB
|
||||
cat /app/guacamole/schema/*.sql | psql -U $POSTGRES_USER -d $POSTGRES_DB -f -
|
||||
echo "$GUAC_VER" > /config/.database-version
|
||||
# psql -U postgres -lqt | cut -d \| -f 1 | grep -qw $POSTGRES_DB
|
||||
# if [ $? -ne 0 ]; then
|
||||
# createuser -U postgres $POSTGRES_USER
|
||||
# createdb -U postgres -O $POSTGRES_USER $POSTGRES_DB
|
||||
# cat /app/guacamole/schema/*.sql | psql -U $POSTGRES_USER -d $POSTGRES_DB -f -
|
||||
# echo "$GUAC_VER" > /config/.database-version
|
||||
|
||||
/etc/cont-init.d/30-defaults.sh
|
||||
/etc/cont-init.d/50-extensions.sh
|
||||
else
|
||||
if [ "$(cat /config/.database-version)" != "$GUAC_VER" ]; then
|
||||
cat /app/guacamole/schema/upgrade/upgrade-pre-$GUAC_VER.sql | psql -U $POSTGRES_USER -d $POSTGRES_DB -f -
|
||||
echo "$GUAC_VER" > /config/.database-version
|
||||
# /etc/cont-init.d/30-defaults.sh
|
||||
# /etc/cont-init.d/50-extensions
|
||||
# else
|
||||
# if [ "$(cat /config/.database-version)" != "$GUAC_VER" ]; then
|
||||
# cat /app/guacamole/schema/upgrade/upgrade-pre-$GUAC_VER.sql | psql -U $POSTGRES_USER -d $POSTGRES_DB -f -
|
||||
# echo "$GUAC_VER" > /config/.database-version
|
||||
|
||||
/etc/cont-init.d/30-defaults.sh
|
||||
/etc/cont-init.d/50-extensions.sh
|
||||
fi
|
||||
fi
|
||||
# /etc/cont-init.d/30-defaults.sh
|
||||
# /etc/cont-init.d/50-extensions
|
||||
# fi
|
||||
# fi
|
||||
|
||||
echo "Starting guacamole client..."
|
||||
s6-setuidgid root catalina.sh run
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
|
||||
echo "Starting postgres..."
|
||||
s6-setuidgid postgres postgres
|
||||
Reference in New Issue
Block a user