Dockerfile.alpine.java21

# Copyright (c) 2016-present Sonatype, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# DEPRECATED: The official sonatype/nexus3 images (including the -alpine tag) are no
# longer built from this file. They are built and promoted to Docker Hub by Sonatype's
# internal pipeline. This file remains available for building your own image and for
# this repository's own build and test automation.

FROM alpine

LABEL name="Nexus Repository Manager" \
      maintainer="Sonatype <support@sonatype.com>" \
      vendor=Sonatype \
      version="3.97.2-02" \
      release="3.97.2" \
      url="https://sonatype.com" \
      summary="The Nexus Repository Manager server \
          with universal support for popular component formats." \
      description="The Nexus Repository Manager server \
          with universal support for popular component formats." \
      run="docker run -d --name NAME \
          -p 8081:8081 \
          IMAGE" \
      stop="docker stop NAME" \
      com.sonatype.license="Apache License, Version 2.0" \
      com.sonatype.name="Nexus Repository Manager base image" \
      io.k8s.description="The Nexus Repository Manager server \
          with universal support for popular component formats." \
      io.k8s.display-name="Nexus Repository Manager" \
      io.openshift.expose-services="8081:8081" \
      io.openshift.tags="Sonatype,Nexus,Repository Manager"

ARG NEXUS_VERSION=3.97.2-02
ARG NEXUS_DOWNLOAD_URL=https://download.sonatype.com/nexus/3/sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip
ARG NEXUS_DOWNLOAD_SHA256_HASH=9d20d1253e11320b707c53a0d548e4416e522cebd7fb070971b16713caa67ff1

# configure nexus runtime
ENV SONATYPE_DIR=/opt/sonatype
ENV NEXUS_HOME=${SONATYPE_DIR}/nexus \
    NEXUS_DATA=/nexus-data \
    NEXUS_CONTEXT='' \
    SONATYPE_WORK=${SONATYPE_DIR}/sonatype-work \
    DOCKER_TYPE='alpine'

# Install Java & tar
RUN apk add openjdk21 tar procps gzip curl shadow \
    && apk cache clean \
    && find /usr/lib/jvm -maxdepth 2 -name demo -type d -exec rm -rf {} + \
    # drop jrt-fs.jar (the jrt: FileSystemProvider) -- unused by the classpath/Karaf-launched
    # runtime; IQ flags this unpublished JDK-internal jar as an unknown component
    # (NEXUS-54641; mirrors NEXUS-54299 / NEXUS-54161 / sonatype/yellowfin#326 / FIRE-722).
    # No -maxdepth: unconstrained find is more defensive against JDK layout changes.
    # The assertion on the next line fails the build fast if deletion missed.
    && find /usr/lib/jvm -name jrt-fs.jar -delete \
    && test -z "$(find /usr/lib/jvm -name jrt-fs.jar)" \
    && groupadd --gid 200 -r nexus \
    && useradd --uid 200 -r nexus -g nexus -s /bin/false -d /opt/sonatype/nexus -c 'Nexus Repository Manager user'

RUN apk del --no-cache openssl || true
RUN apk update && apk add --no-cache openssl

# Security: CA certificates that no longer trust the compromised eMudhra intermediate CAs
# (https://emudhra.we-have-a-problem.com/, NEXUS-55997). Alpine fixed both packages in 20261020-r0.
# ca-certificates-bundle is the OS bundle (openssl, curl). ca-certificates is what Java's cacerts is
# built from (via java-cacerts), so it needs its own floor.
# Floor, not an exact pin, so later Alpine CA updates are still picked up.
RUN apk add --no-cache --upgrade "ca-certificates-bundle>=20261020-r0" "ca-certificates>=20261020-r0"

# Security: block the compromised eMudhra intermediate CAs in the JVM (NEXUS-55997). Java has no fixed
# release yet, so append their SHA-256 fingerprints to the JDK's blocked.certs. The JDK then rejects any
# chain containing them, whichever trust store supplied it: cacerts, a -Djavax.net.ssl.trustStore file,
# or the Nexus truststore. revoked-certs/ is shared with the UBI Dockerfiles (NEXUS-55998, NEXUS-55999).
# Remove this once the JDK blocks these certificates itself.
COPY revoked-certs/revoked-intermediates.sha256 /tmp/revoked-intermediates.sha256
RUN set -e; \
    f=$(readlink -f /usr/lib/jvm/default-jvm/lib/security/blocked.certs); \
    [ -f "$f" ]; \
    echo >> "$f"; \
    grep -v '^#' /tmp/revoked-intermediates.sha256 >> "$f"; \
    for h in $(grep -v '^#' /tmp/revoked-intermediates.sha256); do grep -qx "$h" "$f"; done; \
    rm -f /tmp/revoked-intermediates.sha256

# Security: distrust the ROOTS behind the compromised eMudhra intermediates (the 4 roots in the advisory's roots.json,
# NEXUS-56048). Blocking only the intermediates above is not enough: a holder of an intermediate's private key can
# re-encode it (different bytes, still a valid signature), so its SHA-256 no longer matches blocked.certs. A root comes
# from the local trust store, not from the server, so it cannot be re-encoded.
# - JVM: distrust-emudhra-roots.sh deletes the roots from cacerts and appends their fingerprints to blocked.certs.
#   cacerts is a symlink to /etc/ssl/certs/java/cacerts, so the real file is passed.
# - OS: `check` fails the build if the Alpine PEM bundle still holds a root (the ca-certificates floor above).
# - Proof: EmudhraChainCheck runs this image's own JRE against the advisory's chains and re-encoded intermediates, and
#   fails the build unless every one is rejected.
# Side effect: certificates that chain only to emSign ECC Root CA - G3 or AAA Certificate Services stop validating
# (Alpine, Debian, RHEL accepted the same). revoked-certs/ mirrors private/docker/revoked-certs in nexus-internal.
# Remove once the JDK blocks these roots itself.
COPY revoked-certs/ /tmp/emudhra-build/
RUN set -e; \
    jh=/usr/lib/jvm/default-jvm; \
    sh /tmp/emudhra-build/distrust-emudhra-roots.sh jre "$jh" "$(readlink -f $jh/lib/security/cacerts)"; \
    sh /tmp/emudhra-build/distrust-emudhra-roots.sh check "$jh" /etc/ssl/certs/ca-certificates.crt; \
    "$jh/bin/java" /tmp/emudhra-build/emudhra/EmudhraChainCheck.java \
        /tmp/emudhra-build/emudhra/chains /tmp/emudhra-build/emudhra/emudhra-roots.pem; \
    rm -rf /tmp/emudhra-build

WORKDIR ${SONATYPE_DIR}

# Download nexus & setup directories
RUN curl -L ${NEXUS_DOWNLOAD_URL} --output sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip \
    && echo "${NEXUS_DOWNLOAD_SHA256_HASH} sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip" > sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip.sha256 \
    && sha256sum -c sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip.sha256 \
    && unzip sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip \
    && rm -f sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip sonatype-nexus-repository-${NEXUS_VERSION}-assembly.zip.sha256 \
    && mv nexus-${NEXUS_VERSION} $NEXUS_HOME \
    && chown -R nexus:nexus ${SONATYPE_WORK} \
    && mv ${SONATYPE_WORK}/nexus3 ${NEXUS_DATA} \
    && ln -s ${NEXUS_DATA} ${SONATYPE_WORK}/nexus3

RUN echo "#!/bin/bash" >> ${SONATYPE_DIR}/start-nexus-repository-manager.sh \
   && echo "cd /opt/sonatype/nexus" >> ${SONATYPE_DIR}/start-nexus-repository-manager.sh \
   && echo "exec ./bin/nexus run" >> ${SONATYPE_DIR}/start-nexus-repository-manager.sh \
   && chmod a+x ${SONATYPE_DIR}/start-nexus-repository-manager.sh \
   && chmod a+x ${SONATYPE_DIR}/nexus/bin/nexus \
   && sed -e '/^nexus-context/ s:$:${NEXUS_CONTEXT}:' -i ${NEXUS_HOME}/etc/nexus-default.properties

RUN apk del gzip shadow

VOLUME ${NEXUS_DATA}

EXPOSE 8081
USER nexus

ENV INSTALL4J_ADD_VM_PARAMS="-Djava.util.prefs.userRoot=${NEXUS_DATA}/javaprefs"

CMD ["/opt/sonatype/nexus/bin/nexus", "run"]