diff --git a/Dockerfile b/Dockerfile index 629cb73..e845f8c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,62 +1,20 @@ -FROM golang:1.20.3-alpine3.17 AS build +FROM golang AS build -# environment settings -ARG GOOS="linux" \ - CGO_ENABLED="0" +RUN mkdir /endlessh +ADD . /endlessh +WORKDIR /endlessh +RUN go mod tidy +RUN go build -o endlessh . -# copy files to container -COPY . "/tmp/endlessh-go/" +FROM gcr.io/distroless/base -# set build workdir -WORKDIR "/tmp/endlessh-go/" - -# build app -RUN \ - go mod tidy \ - && go build -o "endlessh-go" - - -FROM alpine:3.17 - -# labels LABEL org.opencontainers.image.title=endlessh-go LABEL org.opencontainers.image.description="Endlessh: an SSH tarpit" LABEL org.opencontainers.image.vendor="Shizun Ge" LABEL org.opencontainers.image.licenses=GPLv3 - -# install packages -RUN \ - echo "**** installing base packages ****" \ - && apk update \ - && apk --no-cache add \ - ca-certificates \ - bash \ - procps \ - tzdata - -# prepare container -RUN \ - echo "**** create default user ****" \ - && addgroup -S -g 2000 abc \ - && adduser -S -D -H -s /bin/bash -u 2000 -G abc abc - -# cleanup installation -RUN \ - echo "**** cleanup ****" \ - && rm -rf \ - /tmp/* \ - /var/cache/apk/* \ - /var/tmp/* - -# copy files to container -COPY --from=build "/tmp/endlessh-go/endlessh-go" "/usr/local/bin/" - -# ssh / prometheus port +COPY --from=build /endlessh/endlessh /endlessh EXPOSE 2222 2112 - -USER abc - -ENTRYPOINT ["/usr/local/bin/endlessh-go"] - +USER nobody +ENTRYPOINT ["/endlessh"] CMD ["-logtostderr", "-v=1"] diff --git a/README.md b/README.md index 2ff4e76..2a00126 100644 --- a/README.md +++ b/README.md @@ -33,8 +33,6 @@ Then you can try to connect to the endlessh server. Your SSH client should hang ssh -p 2222 localhost ``` -The default container user has uid/gid 2000. - If you want log like the [C implementation](https://github.com/skeeto/endlessh), you need to set both CLI arguments `-logtostderr` and `-v=1`, then the log will go to stderr. You can set different log destinations via CLI arguments. Also check out [examples](./examples/README.md) for the setup of the full stack. @@ -85,26 +83,18 @@ Usage of ./endlessh-go comma-separated list of pattern=N settings for file-filtered logging ``` -## Using privileged ports (<1024) - -If you want to run the image with privileged ports (below 1025), you need to set the container user to root: - -```yml -user: root -``` - ## Metrics Endlessh-go exports the following Prometheus metrics. -| Metric | Type | Description | -| ------------------------------------ | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| endlessh_client_open_count_total | count | Total number of clients that tried to connect to this host. | -| endlessh_client_closed_count_total | count | Total number of clients that stopped connecting to this host. | -| endlessh_sent_bytes_total | count | Total bytes sent to clients that tried to connect to this host. | -| endlessh_trapped_time_seconds_total | count | Total seconds clients spent on endlessh. | -| endlessh_client_open_count | count | Number of connections of clients.
Labels:
| -| endlessh_client_trapped_time_seconds | count | Seconds a client spends on endlessh.
Labels:
| +| Metric | Type | Description | +|--------------------------------------|-------|--------------| +| endlessh_client_open_count_total | count | Total number of clients that tried to connect to this host. | +| endlessh_client_closed_count_total | count | Total number of clients that stopped connecting to this host. | +| endlessh_sent_bytes_total | count | Total bytes sent to clients that tried to connect to this host. | +| endlessh_trapped_time_seconds_total | count | Total seconds clients spent on endlessh. | +| endlessh_client_open_count | count | Number of connections of clients.
Labels:
| +| endlessh_client_trapped_time_seconds | count | Seconds a client spends on endlessh.
Labels:
| The metrics is off by default, you can turn it via the CLI argument `-enable_prometheus`. diff --git a/examples/README.md b/examples/README.md index 58ab558..50c95f1 100644 --- a/examples/README.md +++ b/examples/README.md @@ -1,6 +1,19 @@ # Examples +> The default container user has uid 65534. + ## docker-simple An example how to setup endlessh-go, Prometheus, and Grafana using [docker compose](https://docs.docker.com/compose/). +## docker-maxmind + +An example how to setup endlessh-go with the Maxmind GeoIP Database. + +### Using privileged ports (<1024) on docker + +If you want to run the image with privileged ports (below 1025), you need to set the container user to root: + +```yml +user: root +``` diff --git a/examples/docker-maxmind/README.md b/examples/docker-maxmind/README.md new file mode 100644 index 0000000..3dff00d --- /dev/null +++ b/examples/docker-maxmind/README.md @@ -0,0 +1,16 @@ +## docker compose + +This is an example how to setup endlessh-go with the Maxmind GeoIP Database using [docker compose](https://docs.docker.com/compose/). The reference of the compose file can be found [here](https://docs.docker.com/compose/compose-file/). + +To start the stack, in the _examples_ folder, run: + +``` +sudo docker-compose up -d +``` + +The GeoIP Database will be saved in a mounted volume in: `./geo-data`. And the endlessh-go container will use this database to do the location lookups. + +This example exposes the following ports. Except the SSH port, you should not expose other ports to public without protections (not included in this example) in production. + +- **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `sudo docker logs endlessh`. +- **2112**: The Prometheus metrics exported by endlessh-go. Go to [http://localhost:2112/metrics](http://localhost:2112/metrics) in your web browser to view the metrics. diff --git a/examples/docker-simple/docker-compose_maxmind.yml b/examples/docker-maxmind/docker-compose.yml similarity index 100% rename from examples/docker-simple/docker-compose_maxmind.yml rename to examples/docker-maxmind/docker-compose.yml