Skip to content

Commit 7c752fa

Browse files
JayH5JayH5
committed
alpine: Don't install ca-certificates on Alpine 3.7+
* CA certs come bundled on Alpine 3.7+ * On Alpine 3.6, rather install libressl which also include CA certs, allows us to use wget, and doesn't increase the size over ca-certificates
1 parent 5899357 commit 7c752fa

File tree

9 files changed

+23
-61
lines changed

9 files changed

+23
-61
lines changed

‎2.7/alpine3.6/Dockerfile

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,8 @@ ENV LANG C.UTF-8
99
# https://github.com/docker-library/python/issues/147
1010
ENV PYTHONIOENCODING UTF-8
1111

12-
# install ca-certificates so that HTTPS works consistently
13-
# the other runtime dependencies for Python are installed later
14-
RUN apk add --no-cache ca-certificates
12+
# install libressl so that HTTPS works on Alpine <3.7
13+
RUN apk add --no-cache libressl
1514

1615
ENV GPG_KEY C01E1CAD5EA2C4F0B8E3571504C367C218ADD4FF
1716
ENV PYTHON_VERSION 2.7.15

‎2.7/alpine3.7/Dockerfile

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,8 @@ ENV LANG C.UTF-8
99
# https://github.com/docker-library/python/issues/147
1010
ENV PYTHONIOENCODING UTF-8
1111

12-
# install ca-certificates so that HTTPS works consistently
13-
# the other runtime dependencies for Python are installed later
14-
RUN apk add --no-cache ca-certificates
12+
# install libressl so that HTTPS works on Alpine <3.7
13+
# RUN apk add --no-cache libressl
1514

1615
ENV GPG_KEY C01E1CAD5EA2C4F0B8E3571504C367C218ADD4FF
1716
ENV PYTHON_VERSION 2.7.15

‎3.4/alpine3.7/Dockerfile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ ENV PATH /usr/local/bin:$PATH
1313
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
1414
ENV LANG C.UTF-8
1515

16-
# install ca-certificates so that HTTPS works consistently
17-
# the other runtime dependencies for Python are installed later
18-
RUN apk add --no-cache ca-certificates
16+
# install libressl so that HTTPS works on Alpine <3.7
17+
# RUN apk add --no-cache libressl
1918

2019
ENV GPG_KEY 97FC712E4C024BBEA48A61ED3A5CA953F73C700D
2120
ENV PYTHON_VERSION 3.4.8
2221

2322
RUN set -ex \
2423
&& apk add --no-cache --virtual .fetch-deps \
2524
gnupg \
26-
libressl \
2725
tar \
2826
xz \
2927
\
@@ -46,7 +44,6 @@ RUN set -ex \
4644
gdbm-dev \
4745
libc-dev \
4846
libffi-dev \
49-
libressl \
5047
libressl-dev \
5148
linux-headers \
5249
make \
@@ -105,13 +102,9 @@ RUN cd /usr/local/bin \
105102
ENV PYTHON_PIP_VERSION 10.0.1
106103

107104
RUN set -ex; \
108-
\
109-
apk add --no-cache --virtual .fetch-deps libressl; \
110105
\
111106
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
112107
\
113-
apk del .fetch-deps; \
114-
\
115108
python get-pip.py \
116109
--disable-pip-version-check \
117110
--no-cache-dir \

‎3.5/alpine3.7/Dockerfile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ ENV PATH /usr/local/bin:$PATH
1313
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
1414
ENV LANG C.UTF-8
1515

16-
# install ca-certificates so that HTTPS works consistently
17-
# the other runtime dependencies for Python are installed later
18-
RUN apk add --no-cache ca-certificates
16+
# install libressl so that HTTPS works on Alpine <3.7
17+
# RUN apk add --no-cache libressl
1918

2019
ENV GPG_KEY 97FC712E4C024BBEA48A61ED3A5CA953F73C700D
2120
ENV PYTHON_VERSION 3.5.5
2221

2322
RUN set -ex \
2423
&& apk add --no-cache --virtual .fetch-deps \
2524
gnupg \
26-
libressl \
2725
tar \
2826
xz \
2927
\
@@ -46,7 +44,6 @@ RUN set -ex \
4644
gdbm-dev \
4745
libc-dev \
4846
libffi-dev \
49-
libressl \
5047
libressl-dev \
5148
linux-headers \
5249
make \
@@ -105,13 +102,9 @@ RUN cd /usr/local/bin \
105102
ENV PYTHON_PIP_VERSION 10.0.1
106103

107104
RUN set -ex; \
108-
\
109-
apk add --no-cache --virtual .fetch-deps libressl; \
110105
\
111106
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
112107
\
113-
apk del .fetch-deps; \
114-
\
115108
python get-pip.py \
116109
--disable-pip-version-check \
117110
--no-cache-dir \

‎3.6/alpine3.6/Dockerfile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ ENV PATH /usr/local/bin:$PATH
1313
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
1414
ENV LANG C.UTF-8
1515

16-
# install ca-certificates so that HTTPS works consistently
17-
# the other runtime dependencies for Python are installed later
18-
RUN apk add --no-cache ca-certificates
16+
# install libressl so that HTTPS works on Alpine <3.7
17+
RUN apk add --no-cache libressl
1918

2019
ENV GPG_KEY 0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
2120
ENV PYTHON_VERSION 3.6.6
2221

2322
RUN set -ex \
2423
&& apk add --no-cache --virtual .fetch-deps \
2524
gnupg \
26-
libressl \
2725
tar \
2826
xz \
2927
\
@@ -46,7 +44,6 @@ RUN set -ex \
4644
gdbm-dev \
4745
libc-dev \
4846
libffi-dev \
49-
libressl \
5047
libressl-dev \
5148
linux-headers \
5249
make \
@@ -105,13 +102,9 @@ RUN cd /usr/local/bin \
105102
ENV PYTHON_PIP_VERSION 10.0.1
106103

107104
RUN set -ex; \
108-
\
109-
apk add --no-cache --virtual .fetch-deps libressl; \
110105
\
111106
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
112107
\
113-
apk del .fetch-deps; \
114-
\
115108
python get-pip.py \
116109
--disable-pip-version-check \
117110
--no-cache-dir \

‎3.6/alpine3.7/Dockerfile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ ENV PATH /usr/local/bin:$PATH
1313
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
1414
ENV LANG C.UTF-8
1515

16-
# install ca-certificates so that HTTPS works consistently
17-
# the other runtime dependencies for Python are installed later
18-
RUN apk add --no-cache ca-certificates
16+
# install libressl so that HTTPS works on Alpine <3.7
17+
# RUN apk add --no-cache libressl
1918

2019
ENV GPG_KEY 0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
2120
ENV PYTHON_VERSION 3.6.6
2221

2322
RUN set -ex \
2423
&& apk add --no-cache --virtual .fetch-deps \
2524
gnupg \
26-
libressl \
2725
tar \
2826
xz \
2927
\
@@ -47,7 +45,6 @@ RUN set -ex \
4745
libc-dev \
4846
libffi-dev \
4947
libnsl-dev \
50-
libressl \
5148
libressl-dev \
5249
libtirpc-dev \
5350
linux-headers \
@@ -107,13 +104,9 @@ RUN cd /usr/local/bin \
107104
ENV PYTHON_PIP_VERSION 10.0.1
108105

109106
RUN set -ex; \
110-
\
111-
apk add --no-cache --virtual .fetch-deps libressl; \
112107
\
113108
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
114109
\
115-
apk del .fetch-deps; \
116-
\
117110
python get-pip.py \
118111
--disable-pip-version-check \
119112
--no-cache-dir \

‎3.7/alpine3.7/Dockerfile

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ ENV PATH /usr/local/bin:$PATH
1313
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
1414
ENV LANG C.UTF-8
1515

16-
# install ca-certificates so that HTTPS works consistently
17-
# the other runtime dependencies for Python are installed later
18-
RUN apk add --no-cache ca-certificates
16+
# install libressl so that HTTPS works on Alpine <3.7
17+
# RUN apk add --no-cache libressl
1918

2019
ENV GPG_KEY 0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D
2120
ENV PYTHON_VERSION 3.7.0
2221

2322
RUN set -ex \
2423
&& apk add --no-cache --virtual .fetch-deps \
2524
gnupg \
26-
openssl \
2725
tar \
2826
xz \
2927
\
@@ -47,7 +45,6 @@ RUN set -ex \
4745
libc-dev \
4846
libffi-dev \
4947
libnsl-dev \
50-
openssl \
5148
openssl-dev \
5249
libtirpc-dev \
5350
linux-headers \
@@ -107,13 +104,9 @@ RUN cd /usr/local/bin \
107104
ENV PYTHON_PIP_VERSION 10.0.1
108105

109106
RUN set -ex; \
110-
\
111-
apk add --no-cache --virtual .fetch-deps openssl; \
112107
\
113108
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
114109
\
115-
apk del .fetch-deps; \
116-
\
117110
python get-pip.py \
118111
--disable-pip-version-check \
119112
--no-cache-dir \

‎Dockerfile-alpine.template

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,15 @@ ENV PATH /usr/local/bin:$PATH
77
# > At the moment, setting "LANG=C" on a Linux system *fundamentally breaks Python 3*, and that's not OK.
88
ENV LANG C.UTF-8
99

10-
# install ca-certificates so that HTTPS works consistently
11-
# the other runtime dependencies for Python are installed later
12-
RUN apk add --no-cache ca-certificates
10+
# install libressl so that HTTPS works on Alpine <3.7
11+
# RUN apk add --no-cache libressl
1312

1413
ENV GPG_KEY %%PLACEHOLDER%%
1514
ENV PYTHON_VERSION %%PLACEHOLDER%%
1615

1716
RUN set -ex \
1817
&& apk add --no-cache --virtual .fetch-deps \
1918
gnupg \
20-
libressl \
2119
tar \
2220
xz \
2321
\
@@ -41,7 +39,6 @@ RUN set -ex \
4139
libc-dev \
4240
libffi-dev \
4341
libnsl-dev \
44-
libressl \
4542
libressl-dev \
4643
libtirpc-dev \
4744
linux-headers \
@@ -101,13 +98,9 @@ RUN cd /usr/local/bin \
10198
ENV PYTHON_PIP_VERSION %%PLACEHOLDER%%
10299

103100
RUN set -ex; \
104-
\
105-
apk add --no-cache --virtual .fetch-deps libressl; \
106101
\
107102
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \
108103
\
109-
apk del .fetch-deps; \
110-
\
111104
python get-pip.py \
112105
--disable-pip-version-check \
113106
--no-cache-dir \

‎update.sh

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,10 +153,16 @@ for version in "${versions[@]}"; do
153153
wheezy) sed -ri -e 's/dpkg-architecture --query /dpkg-architecture -q/g' "$dir/Dockerfile" ;;
154154
esac
155155

156+
# On Alpine 3.6 it's necessary to install libressl to get working HTTPS.
157+
# Later Alpine versions have CA certificates pre-installed.
158+
if [[ "$variant" == alpine3.6 ]]; then
159+
sed -ri -e '/^# .* libressl$/s/^# //' "$dir/Dockerfile"
160+
fi
161+
156162
# https://bugs.python.org/issue32598 (Python 3.7.0b1+)
157163
# TL;DR: Python 3.7+ uses OpenSSL functionality which LibreSSL doesn't implement (yet?)
158164
if [[ "$version" == 3.7* ]] && [[ "$variant" == alpine* ]]; then
159-
sed -ri -e 's/libressl/openssl/g' "$dir/Dockerfile"
165+
sed -ri -e 's/libressl-dev/openssl-dev/g' "$dir/Dockerfile"
160166
fi
161167

162168
# Libraries to build the nis module only available in Alpine 3.7+.

0 commit comments

Comments
 (0)