Lucee code obfuscation under docker

Hi,

Under a normal Lucee installation we have the WEB-INF folder under the web root where we can find obfuscated lucee code and we can use these code to provide a degree of source code protection if we so choose. But for Lucee on docker, how can we achieve this same goal?

Thanks.

I’m not sure I understand the problem. Lucee on Docker is essentially the same as Lucee on a standard Linux distro.

@modius have you run Lucee on Docker?

Does it matter? He’s right. (But, he does)

As usual your question is so vague as to be nonsensical and unanswerable.

If you want to provide source to the lucee container, you either ADD/COPY it in in the build, or mount a volume.
If you want to persist WEB-INF, you either ADD/COPY it in in the build, or mount a volume.

The technology doesn’t change anything. Nor is it a lucee question.

-G

@joe.gooch ok.

So, my dockerfile contains the following lines:
FROM lucee/lucee4:latest
COPY www /var/www
// do I need to add
ADD ?

And my /var/www directory has
/var/www/html subdirectory

For “If you want to persist WEB-INF, you either ADD/COPY it in in the build,”
how do I do that?

Thanks.

If it weren’t docker, what would you do?

If you had a server with lucee4 on it, how would you do what you want? Do you have a set of pre-generated source classes such that you can drop them into WEB-INF and NOT copy anything into /var/www? Otherwise, you’re just distributing your source AND some obfuscated classes. So… what process would you go through if it weren’t docker? If you don’t know that, then ask that question. “How do I distribute precompiled or obfuscated source with lucee 4?” Recognizing that Lucee 4.5 in this container is from August of 2018.

If you want to see what’s IN the container:

docker create --name temp lucee/lucee4
docker export temp | tar -tvf -

That’s every file in it.
Notice /usr/local/tomcat has the jars
/opt/lucee/web and /opt/lucee/web/context has the web context
/opt/lucee/server/lucee-server has the server context.

Note also the documentation for the image you’re using.
https://hub.docker.com/r/lucee/lucee4/

Which tells you these things!

Folder locations

Web root for default site: /var/www

Configuration folders:

  • Tomcat config: /usr/local/tomcat/conf
  • Lucee config for default site: /opt/lucee/web
  • Lucee server context: /opt/lucee/server/lucee-server/context

Log folders:

  • Tomcat logs: /usr/local/tomcat/logs
  • Lucee logs for default site: /opt/lucee/web/logs

Note the dockerfile:
https://hub.docker.com/r/lucee/lucee4/dockerfile

Which shows all the steps to build the image, leaving nothing out.

Including things like this:

# lucee first time startup; explodes lucee and installs bundles/extensions
RUN /usr/local/tomcat/bin/catalina.sh start && \
    while [ ! -f "/opt/lucee/web/logs/application.log" ] ; do sleep 2; done && \
    /usr/local/tomcat/bin/catalina.sh stop

Which show you a technique to pre-warm the image.

So… again, if it weren’t a container, what would you do?

1 Like

The WEB-INF folder would have corresponding directory for each web application directory.
They contain corresponding files such as
index.cfm → index_cfm$cf.class
and I can simply rename the index_cfm$cf.class back to index.cfm and place the newly renamed index.cfm (osf) in a temp directory, then, rename or remove the index.cfm source file and place the index.cfm (osf) in the application directory. It works.
That’s what I want for my applications on Lucee with Docker.

You’re right my question were not well formed. I appreciate your detailed writing.

Then all you really need to do is change what files you’re copying into your container. Put the precompiled .cfm’s in /var/www.

So it’s not a docker problem at all and has nothing to do with writing into WEB-INF.

Either manually or through CI, you’re going to need to capture those class files and rename them to the appropriate cfms, and then copy THOSE files into your deployable container instead of the original source files.

i.e.

mkdir compiled
chmod 777 compiled
docker run --rm -d --name compiler -v $PWD/compiled:/opt/lucee/web/cfclasses/ yourimage

(See? Persist with a volume mount)

Then do your manipulation of the compiled folder, renaming to cfms, whatever, and use that to build your new container.

1 Like

@joe.gooch Informative, I’ll try it for next deployment, many thanks.

Check this out

1 Like

Interesting @bdw429s I’ll check it out, thanks.

Is this the same as compiling a mapping?

Another thing you can do from the lucee web admin is create a mapping that points to the root of your application and create an archive without the codde. Then map that archive to the root of your site and use that.
Precompiles everything and it can be done fairly simply (unless cfml-compiler is doing that already)

1 Like

As usual your question is so vague as to be nonsensical and unanswerable.

just because someone doesn’t know how to ask a question, doesn’t mean we can’t help. This seems a little snarky.

I believe the OP is asking how to install config files in the container from the dockerfile

# setup Lucee environment
COPY docker/server.xml /usr/local/tomcat/conf/server.xml
COPY docker/lucee-web.xml.cfm /opt/lucee/web/lucee-web.xml.cfm
COPY docker/lucee-server.xml /opt/lucee/server/lucee-server/context/lucee-server.xml

there are posts buried in the forum about grabbing these out of your container while running in the development environment

what I do is run the container local, open a shell into the container (docker exec -it containerid bash) and scp the config files locally and have docker install them during the build

also since usually we’re using docker to isolate each container into separate lucee instances rather than multiple projects on one container… we just put our configs on the server since /WEB-INF is auto generated from the server configs

@mafimo I don’t believe the original post had anything to do with config files, but rather compiled source code. I would highly recommend you check into the CFConfig CLI to help you manage your configuration on a much more granular level than copying XML files.

@markdrew interesting approach,
however, it generated err msg “mapping [/newdir] has no physical directory”.
my OS is Ubuntu 16.04

@bdw429s

box cfcompile source=./myDir destPath=./myDirx cfengine=lucee@5.3.5

err msg:

Command "cfcompile source=./myDir destPath=./myDirx cfengine=lucee/lucee@4" cannot be resolved.'

docker ps

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                              NAMES
289fs92323a4973d223        lucee/lucee4      
box cfcompile source=./myDir destPath=./myDirx cfengine=lucee@4

or

box cfcompile source=./myDir destPath=./myDirx cfengine=lucee/lucee@4

generated same err msg

any way to fix it other than upgrading the lucee4? thanks

It would appear you didn’t install the cfcompile module. Changing the parameters isn’t going to do any good if cfcompile isn’t installed in the first place.

box install cfml-compiler
1 Like

my bad.

getting closer… however, more err msg:

Destination: /home/me/lucee/www/mydir/mydirx
/home/me/lucee/www/mydir/xyz1.cfm:57 : Wrong Context, Invalid combination of Attributes

/home/me/lucee/www/mydir/xyz2.cfc:2 : No matching end tag found for tag [cfcomponent]
// my comment
// but it does have end tag of

/home/me/lucee/www/mydir/xyz3.cfm:57 : Wrong Context, Invalid combination of Attributes

Stopping cfml-compiler-server…
Stopped
forgetting cfml-compiler-server…
Poof! Wiped out server cfml-compiler-server

If you received compilation errors, it means you have code that is invalid. You’ll need to fix it.

This approach won’t work in my case.
(a) I don’t have this docker directory or a similar one
(b) it assumes I’m using tomcat but I’m not.

I appreciate the effort tho