Building a Docker Image for an API Gateway Instance in OpenShift Environment

About this task

When starting the API Gateway container, OpenShift ignores the built-in user of the Docker image and injects a new user. This user is a member of the root group, and hence the files, scripts, and programs inside the API Gateway container have to be readable, writable, and executable by the root group. To build a Docker image that fulfills these requirements, perform the procedure outlined.

To build a docker image for an API Gateway instance in an OpenShift environment

Procedure

Follow the steps outlined in Building the Docker Image for an API Gateway Instance.

Ensure that you have set the parameters --target.configuration and --os.image specific to the OpenShift environment.

A sample shell script for creating an API Gateway Docker image for an Openshift environment looks as follows:

echo "is createDockerfile ======================================================="
./is_container.sh createDockerfile
status=$?
 
if [ $status -ne 0 ]
then
    echo "Failed! status: $status"
    exit $status
fi
 
echo "is build =================================================================="
./is_container.sh build
status=$?
 
if [ $status -ne 0 ]
then
    echo "Failed! status: $status"
    exit $status
fi
 
echo "apigw createDockerfile =================================================="
./apigw_container.sh createDockerfile  --target.configuration openshift
status=$?
 
if [ $status -ne 0 ]
then
    echo "Failed! status: $status"
    exit $status
fi
 
echo "apigw build ============================================================="
./apigw_container.sh build
status=$?
 
if [ $status -ne 0 ]
then
    echo "Failed! status: $status"
    exit $status
fi

Results

The resulting Docker file uses chgrp and chmod commands to assign proper permissions to the root group. Running these commands almost doubles the Docker image size, hence the Docker file is organized as a multi-stage build where the first stage prepares the file system with root group permissions, and the second stage copies this into the final image. For the second stage, it is necessary to specify the base operating system image using the --os.image parameter, unless the default value, centos:7, is sufficient. As the API Gateway Docker image builds upon a previously created Integration Server Docker image, the value of the --os.image parameter is same as the value of the -Dimage.name parameter that is used in the creation of the Integration Server image.

The resulting API Gateway image has the built-in sagadmin user, but due to the adapted root group permissions, the image can be deployed to an OpenShift cluster.

Note: The resulting API Gateway image can also be deployed to Docker or Kubernetes systems where it is deployed under the control of the sagadmin user.