[Feature] Create docker image CLI for crypto tools

[fpapon]

Search before asking

• I had searched in the issues, including closed issues and found no similar issues.

Feature Request

It would be nice to have a Shiro docker image published on DockerHub to be able to use the crypto jar as a CLI.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

[lprimak]

Not sure Docker is the best fit here. Perhaps jdeploy, jpackage or something like that?

[fpapon]

I'm not sure to understand

[lprimak]

Well, a whole docker container for a command line tool seems like "too much" Maybe jpackage or jdeploy can be used to simplify running and maybe publish on package managers with jreleaser

[fpapon]

This is common use case because it doesn't need any installation.

[ntolppi]

Example Dockerfile for using shiro hasher cli in container:

ARG SHIRO_VERSION="2.0.5"
FROM maven:sapmachine AS build

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /src

# Get tar.gz release using curl, wget not installed in maven:sapmachine by default
# -L Follow redirect, empty tar otherwise
# -O File is named same as remote file, ie shiro-root-${SHIRO_VERSION}.tar.gz
RUN curl -L -O https://github.com/apache/shiro/archive/refs/tags/shiro-root-${SHIRO_VERSION}.tar.gz

# Use tar, unzip not installed in maven:sapmachine by default
RUN tar -xzf shiro-root-${SHIRO_VERSION}.tar.gz
WORKDIR /src/shiro-shiro-root-${SHIRO_VERSION}
RUN mvn clean package 

FROM openjdk:25-slim

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /opt/app/

# Copy shiro hasher cli jar from previous stage
COPY --from=build /src/shiro-shiro-root-${SHIRO_VERSION}/tools/hasher/target/shiro-tools-hasher-${SHIRO_VERSION}-cli.jar /opt/app/shiro-tools-hasher-cli.jar

# Run cli jar
ENTRYPOINT ["java", "-jar", "/opt/app/shiro-tools-hasher-cli.jar"]

CMD ["--help"]

Build: docker build -t shiro-hasher:2.5.0 .
Run by default will display help message: docker run -it shiro-hasher:2.5.0
Run to hash password test:

docker run -it shiro-hasher:2.5.0 -a SHA-512 -f shiro1 -p
Password to hash: 
Password to hash (confirm): 
$shiro1$SHA-512$50000$Ac5gu7bPVjdC/S/T8E6Kqw==$/Owa0ULFc3BsuIHY7OKDZCCyU5h5qMBqNHoBudmw3SFyrDuKupL8K5ev78vb25jyYZPs0NCRSyW8HuiQjPIWZQ==

Currently container is fairly large, ~500MB, scratch or alpine would help reduce image size.

[fpapon]

Example Dockerfile for using shiro hasher cli in container:

ARG SHIRO_VERSION="2.0.5"
FROM maven:sapmachine AS build

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /src

# Get tar.gz release using curl, wget not installed in maven:sapmachine by default
# -L Follow redirect, empty tar otherwise
# -O File is named same as remote file, ie shiro-root-${SHIRO_VERSION}.tar.gz
RUN curl -L -O https://github.com/apache/shiro/archive/refs/tags/shiro-root-${SHIRO_VERSION}.tar.gz

# Use tar, unzip not installed in maven:sapmachine by default
RUN tar -xzf shiro-root-${SHIRO_VERSION}.tar.gz
WORKDIR /src/shiro-shiro-root-${SHIRO_VERSION}
RUN mvn clean package 

FROM openjdk:25-slim

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /opt/app/

# Copy shiro hasher cli jar from previous stage
COPY --from=build /src/shiro-shiro-root-${SHIRO_VERSION}/tools/hasher/target/shiro-tools-hasher-${SHIRO_VERSION}-cli.jar /opt/app/shiro-tools-hasher-cli.jar

# Run cli jar
ENTRYPOINT ["java", "-jar", "/opt/app/shiro-tools-hasher-cli.jar"]

CMD ["--help"]

Build: docker build -t shiro-hasher:2.5.0 . Run by default will display help message: docker run -it shiro-hasher:2.5.0 Run to hash password test:

docker run -it shiro-hasher:2.5.0 -a SHA-512 -f shiro1 -p
Password to hash: 
Password to hash (confirm): 
$shiro1$SHA-512$50000$Ac5gu7bPVjdC/S/T8E6Kqw==$/Owa0ULFc3BsuIHY7OKDZCCyU5h5qMBqNHoBudmw3SFyrDuKupL8K5ev78vb25jyYZPs0NCRSyW8HuiQjPIWZQ==

Currently container is fairly large, ~500MB, scratch or alpine would help reduce image size.

Thank you. About the first step of the dockerfile, we don't need to build the project with maven, we should use signed artifact from release. About the lighweight image we can do better and I also want to try a native build of the cli with GraalVM.

[fpapon]

Example Dockerfile for using shiro hasher cli in container:

ARG SHIRO_VERSION="2.0.5"
FROM maven:sapmachine AS build

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /src

# Get tar.gz release using curl, wget not installed in maven:sapmachine by default
# -L Follow redirect, empty tar otherwise
# -O File is named same as remote file, ie shiro-root-${SHIRO_VERSION}.tar.gz
RUN curl -L -O https://github.com/apache/shiro/archive/refs/tags/shiro-root-${SHIRO_VERSION}.tar.gz

# Use tar, unzip not installed in maven:sapmachine by default
RUN tar -xzf shiro-root-${SHIRO_VERSION}.tar.gz
WORKDIR /src/shiro-shiro-root-${SHIRO_VERSION}
RUN mvn clean package 

FROM openjdk:25-slim

# Redeclare ARG
ARG SHIRO_VERSION

WORKDIR /opt/app/

# Copy shiro hasher cli jar from previous stage
COPY --from=build /src/shiro-shiro-root-${SHIRO_VERSION}/tools/hasher/target/shiro-tools-hasher-${SHIRO_VERSION}-cli.jar /opt/app/shiro-tools-hasher-cli.jar

# Run cli jar
ENTRYPOINT ["java", "-jar", "/opt/app/shiro-tools-hasher-cli.jar"]

CMD ["--help"]

Build: docker build -t shiro-hasher:2.5.0 . Run by default will display help message: docker run -it shiro-hasher:2.5.0 Run to hash password test:

docker run -it shiro-hasher:2.5.0 -a SHA-512 -f shiro1 -p
Password to hash: 
Password to hash (confirm): 
$shiro1$SHA-512$50000$Ac5gu7bPVjdC/S/T8E6Kqw==$/Owa0ULFc3BsuIHY7OKDZCCyU5h5qMBqNHoBudmw3SFyrDuKupL8K5ev78vb25jyYZPs0NCRSyW8HuiQjPIWZQ==

Currently container is fairly large, ~500MB, scratch or alpine would help reduce image size.

Thank you. About the first step of the dockerfile, we don't need to build the project with maven, we should use signed artifact from release. About the lighweight image we can do better and I also want to try a native build of the cli with GraalVM. This can be in the release process.

[jbampton]

With Docker you can install pre-commit into the container and then run the hooks with Docker.

For those that don't want to setup Python locally and install pre-commit this can be an alternative.

Just thought I would mention this here since I saw this Docker issue.

Thanks !

[jbampton]

If we add Docker then we should use hadolint a Dockerfile linter: validate inline bash, written in Haskell

https://github.com/hadolint/hadolint

I know it can be run with pre-commit with GitHub actions and there are other ways to run it.

Check the online version:

https://hadolint.github.io/hadolint/

[lprimak]

We might use jib instead of dockerfiles here... so it's premature IMHO