Gnocchi
The gnocchi image is built from ContainerFiles/gnocchi. Security patches are applied by scripts/gnocchi-cve-patching.sh.
This container packages the Gnocchi metric storage service for use in the stack. The build installs the required packages, applies security updates and configuration, and prepares the service for integration.
graph LR
A[Base image] --> B[Install packages]
B --> C[Apply CVE patches]
C --> D[Configure Gnocchi]
D --> E[Container ready]
Ceph_Libs --> AContainerFile used for the build
# syntax = docker/dockerfile:1
# This Dockerfile uses multi-stage build to customize DEV and PROD images:
# https://docs.docker.com/develop/develop-images/multistage-build/
ARG CEPH_TAG=v19.2.2-latest
FROM ghcr.io/rackerlabs/genestack-images/ceph-libs:${CEPH_TAG} AS dependency_build
ARG CACHEBUST=0
ARG GNOCCHI_VERSION=master
ARG OS_CONSTRAINTS=master
RUN export DEBIAN_FRONTEND=noninteractive
RUN curl -fsSL -o /tmp/upper-constraints.txt https://opendev.org/openstack/requirements/raw/branch/${OS_CONSTRAINTS}/upper-constraints.txt \
&& sed -i -e '/^gnocchi===.*/d' -e '/^numpy===.*/d' /tmp/upper-constraints.txt \
&& /var/lib/openstack/bin/pip install -vvv --no-cache-dir --constraint /tmp/upper-constraints.txt \
"gnocchi[postgresql,ceph,keystone,redis] @ git+https://github.com/gnocchixyz/gnocchi.git@${GNOCCHI_VERSION}" \
gnocchiclient \
"numpy>=2.3.2,<3" \
PyMySQL \
pymemcache \
SQLAlchemy \
uwsgi \
cffi \
bcrypt \
cryptography
COPY scripts/gnocchi-cve-patching.sh /opt/
RUN bash /opt/gnocchi-cve-patching.sh
# Strip Ceph runtime libraries Gnocchi never uses. Per upstream setup.cfg the
# `[ceph]` extra has no Python deps and relies on python3-rados, which only
# needs librados. RBD (block device), CephFS, RGW (object gateway), and the
# Ceph SQLite VFS are unrelated and account for ~1.3 GB on their own.
RUN find / -name '*.pyc' -delete \
&& find / -name '*.pyo' -delete \
&& find / -name '__pycache__' -delete \
&& find / -name '*.whl' -delete \
&& rm -f /var/lib/openstack/lib/python*/site-packages/slapdtest/certs/client.key \
&& rm -f /var/lib/openstack/lib/python*/site-packages/slapdtest/certs/server.key \
&& rm -f /usr/local/lib/librbd.so* \
&& rm -f /usr/local/lib/librgw.so* \
&& rm -f /usr/local/lib/libcephfs.so* \
&& rm -f /usr/local/lib/libcephsqlite.so* \
&& rm -rf /root/.cache /tmp/* /var/tmp/* \
&& for f in /var/lib/openstack/lib/python*/site-packages/PyJWT-*.dist-info/METADATA; do \
if [ -f "$f" ]; then \
sed -i '/^Usage/,/^Documentation\n^-.*$/d' "$f"; \
fi; \
done
FROM python:3.12-slim-bookworm
LABEL maintainer="Rackspace"
LABEL vendor="Rackspace OpenStack Team"
LABEL org.opencontainers.image.name="gnocchi"
LABEL org.opencontainers.image.description="OpenStack Service (gnocchi) built for the enterprise."
COPY --from=dependency_build /usr/local/lib /usr/local/lib
COPY --from=dependency_build /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu
COPY --from=dependency_build /usr/lib/python3/dist-packages /usr/lib/python3/dist-packages
COPY --from=dependency_build /var/lib/openstack /var/lib/openstack
RUN export DEBIAN_FRONTEND=noninteractive \
&& BUILD_DEPS="apache2-dev build-essential libffi-dev libldap2-dev libpq-dev libsasl2-dev libsnappy-dev libprotobuf-dev libssl-dev libsystemd-dev libxml2-dev libxslt1-dev librados-dev liberasurecode-dev pkg-config python3-dev" \
&& apt-get update && apt-get upgrade -y \
&& apt-get install --no-install-recommends -y \
apache2 \
bash \
brotli \
curl \
libffi8 \
liberasurecode1 \
libldap-2.5-0 \
libpq5 \
libprotobuf32 \
libsasl2-2 \
libsnappy1v5 \
libssl3 \
libsystemd0 \
libxml2 \
libxslt1.1 \
locales \
python3 \
python3-memcache \
python3-rados \
ssl-cert \
xmlsec1 \
$BUILD_DEPS \
&& /var/lib/openstack/bin/pip install --no-cache-dir --upgrade mod_wsgi \
&& /var/lib/openstack/bin/mod_wsgi-express module-config > /etc/apache2/mods-available/wsgi.load \
&& a2enmod wsgi \
&& apt-get purge -y $BUILD_DEPS \
&& apt-get autoremove -y --purge -o APT::AutoRemove::SuggestsImportant=false -o APT::AutoRemove::RecommendsImportant=true \
&& apt-get clean -y \
&& rm -rf /var/lib/apt/lists/* /root/.cache /tmp/* /var/tmp/* \
&& find / -name '*.pyc' -delete \
&& find / -name '*.pyo' -delete \
&& find / -name '__pycache__' -delete \
&& groupadd --system --gid 42424 gnocchi \
&& useradd --system --gid 42424 --uid 42424 --shell /sbin/nologin --create-home --home /var/lib/gnocchi gnocchi \
&& mkdir -p /var/lib/openstack/etc/gnocchi \
&& ln -s /var/lib/openstack/etc/gnocchi /etc/gnocchi \
&& chown gnocchi:gnocchi -h /etc/gnocchi \
&& chown -R gnocchi:gnocchi /var/lib/openstack/etc/gnocchi \
&& sed -i 's@^ErrorLog.*@ErrorLog /dev/stderr@' /etc/apache2/apache2.conf \
&& mkdir -p /var/run/apache2 /var/lock/apache2 /var/log/apache2 \
&& chown www-data:www-data /var/run/apache2 /var/lock/apache2 /var/log/apache2
# Set the environment variables for the gnocchi venv
ENV PATH="/var/lib/openstack/bin:$PATH"
ENV PYTHONPATH="/usr/local/lib/python3.12/site-packages:/var/lib/openstack/lib/python3.12/site-packages"
# Set the working directory
WORKDIR /var/lib/openstack
# Set the entrypoint to the gnocchi upgrade command
ENTRYPOINT ["/var/lib/openstack/bin/gnocchi-upgrade"]
Build Arguments
| Argument | Default |
|---|---|
| CEPH_TAG | v19.2.2-latest |
| CACHEBUST | 0 |
| GNOCCHI_VERSION | master |
| OS_CONSTRAINTS | master |
Build Command
Dependencies
- Builds From Ceph Libs
Container Image
The container image is available on Github Container Registry.