SchulyKeycloak/Dockerfile at main · schulydev/SchulyKeycloak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# syntax=docker/dockerfile:1

# ---- Stage 1: build the Keycloakify login theme into a provider jar ----------
FROM node:22-bookworm AS theme
RUN apt-get update && apt-get install -y maven && rm -rf /var/lib/apt/lists/*
WORKDIR /build
COPY keycloakify/package*.json ./
RUN npm install
COPY keycloakify/ .
RUN npm run build-keycloak-theme

# ---- Stage 2: leaked-password blacklist (rockyou) ----------------------------
FROM debian:bookworm-slim AS blacklist
RUN apt-get update \
 && apt-get install -y curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL -o /rockyou.tar.gz \
      https://github.com/danielmiessler/SecLists/raw/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz \
 && tar -xzf /rockyou.tar.gz -C / \
 && iconv -f utf-8 -t utf-8 -c /rockyou.txt -o /rockyou-utf8.txt

# ---- Stage 3: build the custom email-code required-action SPI -----------------
FROM maven:3.9-eclipse-temurin-17 AS spi
WORKDIR /spi
COPY spi/pom.xml .
RUN mvn -q -B dependency:go-offline
COPY spi/src ./src
RUN mvn -q -B package

# ---- Stage 4: optimized Keycloak builder -------------------------------------
FROM quay.io/keycloak/keycloak:26.6 AS builder
ENV KC_DB=postgres
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
COPY --from=theme /build/dist_keycloak/keycloak-theme-for-kc-26.2-and-above.jar \
     /opt/keycloak/providers/schuly-keycloak-theme.jar
COPY --from=spi /spi/target/schuly-email-code.jar \
     /opt/keycloak/providers/schuly-email-code.jar
RUN /opt/keycloak/bin/kc.sh build

# ---- Stage 5: final runtime image --------------------------------------------
FROM quay.io/keycloak/keycloak:26.6
COPY --from=builder /opt/keycloak/ /opt/keycloak/
COPY --from=blacklist /rockyou-utf8.txt /opt/keycloak/password-blacklists/rockyou.txt
COPY realms/ /opt/keycloak/data/import/
# Branded email theme (schuly/email)
COPY themes/ /opt/keycloak/themes/
COPY scripts/resolve-realm-env.sh /opt/keycloak/resolve-realm-env.sh
USER root
RUN chmod +x /opt/keycloak/resolve-realm-env.sh \
    && chown -R 1000:0 /opt/keycloak/data/import \
    && chmod -R ug+rw /opt/keycloak/data/import
USER 1000
ENV JAVA_OPTS_APPEND="-Dkeycloak.password.blacklists.path=/opt/keycloak/password-blacklists"
ENTRYPOINT ["/opt/keycloak/resolve-realm-env.sh"]
CMD ["start", "--optimized", "--import-realm"]