Cleanup bundle dockerfiles (#1969)

* cleanup bundle dockerfiles

* lint fixes

* pin apt-get versions

* fix version

* bump version

.github/linters/.yaml-lint.yml

@@ -5,3 +5,5 @@ rules:
   line-length:
     max: 120  # Keep this updated with the editorconfig file
     level: warning
+  comments:
+    min-spaces-from-content: 1 # Used to follow prettier standard: https://github.com/prettier/prettier/pull/10926

templates/shared_services/certs/Dockerfile.tmpl

@@ -1,22 +1,25 @@
-FROM python:3.8
+FROM python:3.8-slim-buster
 
 ARG BUNDLE_DIR
 
-RUN apt-get update \
-    && apt-get install -y ca-certificates \
-    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
+# It's useless to specify azcli version since the mixin installs the latest anyway
+# hadolint ignore=DL3008
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y --no-install-recommends ca-certificates="20200601~deb10u2" jq="1.5+dfsg-2+b1" curl="7.64.0-4+deb10u2" apt-transport-https="1.8.2.3" lsb-release="10.2019051400" gnupg="2.2.12-1+deb10u1" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli \
+    && apt-get update && apt-get -y --no-install-recommends install azure-cli \
     && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # Install Certbot
-RUN apt-get update && apt-get install -y python3 python3-venv libaugeas0 \
+# Some of the tools' versions seem to depend on the base image so proboably best not to specify them.
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends python3 python3-venv libaugeas0="1.11.0-3" \
     && python3 -m venv /opt/certbot/ \
     && /opt/certbot/bin/pip install --no-cache-dir --upgrade pip \
     && /opt/certbot/bin/pip install --no-cache-dir certbot \

templates/shared_services/certs/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-shared-service-certs
-version: 0.0.11
+version: 0.0.12
 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -59,14 +59,10 @@ install:
         domain_prefix: "{{ bundle.parameters.domain_prefix }}"
         cert_name: "{{ bundle.parameters.cert_name }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
-        container_name:
-          "{{ bundle.parameters.tfstate_container_name }}"
-        key:
-          "{{ bundle.parameters.tre_id }}-shared-service-certs"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
+        container_name: "{{ bundle.parameters.tfstate_container_name }}"
+        key: "{{ bundle.parameters.tre_id }}-shared-service-certs"
 
 upgrade:
   - exec:
@@ -88,14 +84,10 @@ uninstall:
         domain_prefix: "{{ bundle.parameters.domain_prefix }}"
         cert_name: "{{ bundle.parameters.cert_name }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
-        container_name:
-          "{{ bundle.parameters.tfstate_container_name }}"
-        key:
-          "{{ bundle.parameters.tre_id }}-shared-service-certs"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
+        container_name: "{{ bundle.parameters.tfstate_container_name }}"
+        key: "{{ bundle.parameters.tre_id }}-shared-service-certs"
 
 generate:
   - terraform:
@@ -103,10 +95,8 @@ generate:
         - "output"
       description: "Get Terraform output variables"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.tre_id }}-shared-service-certs"
       outputs:
@@ -116,8 +106,7 @@ generate:
         - name: resource_group_name
         - name: keyvault_name
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:

templates/shared_services/firewall/Dockerfile.tmpl

@@ -2,15 +2,16 @@ FROM debian:stretch-slim
 
 ARG BUNDLE_DIR
 
-RUN apt-get update && apt-get install -y ca-certificates
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli
+    && apt-get update && apt-get -y install azure-cli="2.36.0-1~stretch" \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # This is a template Dockerfile for the bundle's invocation image
 # You can customize it to use different base images, install tools and copy configuration files.

templates/shared_services/firewall/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-shared-service-firewall
-version: 0.3.0
+version: 0.3.1
 description: "An Azure TRE Firewall shared service"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -38,7 +38,7 @@ parameters:
     default: false
   - name: rule_collections
     type: string
-    default: "W10=" #b64 for []
+    default: "W10=" # b64 for []
 
 mixins:
   - exec

templates/shared_services/gitea/Dockerfile.tmpl

@@ -1,29 +0,0 @@
-FROM debian:stretch-slim
-
-ARG BUNDLE_DIR
-
-RUN apt-get update && apt-get install -y ca-certificates
-
-# Install Azure CLI
-RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
-    && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
-    && AZ_REPO=$(lsb_release -cs) \
-    && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-COPY . $BUNDLE_DIR

templates/shared_services/gitea/porter.yaml

@@ -3,7 +3,6 @@ name: tre-shared-service-gitea
 version: 0.3.5
 description: "A Gitea shared service"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id
@@ -36,6 +35,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 mixins:
   - exec
@@ -49,14 +49,11 @@ install:
       vars:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
-        mgmt_resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
+        mgmt_resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
         acr_name: "{{ bundle.parameters.mgmt_acr_name }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.tre_id }}-shared-service-gitea"
 upgrade:
@@ -72,13 +69,10 @@ uninstall:
       vars:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
-        mgmt_resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
+        mgmt_resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
         acr_name: "{{ bundle.parameters.mgmt_acr_name }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.tre_id }}-shared-service-gitea"

templates/shared_services/gitea/version.txt

@@ -1 +1 @@
-__version__ = "0.3.5"
+__version__ = "0.3.6"

templates/shared_services/sonatype-nexus-vm/Dockerfile.tmpl

@@ -2,15 +2,16 @@ FROM debian:stretch-slim
 
 ARG BUNDLE_DIR
 
-RUN apt-get update && apt-get install -y ca-certificates
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" jq="1.5+dfsg-1.3" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli
+    && apt-get update && apt-get -y install azure-cli="2.36.0-1~stretch" \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # This is a template Dockerfile for the bundle's invocation image
 # You can customize it to use different base images, install tools and copy configuration files.

templates/shared_services/sonatype-nexus-vm/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-shared-service-sonatype-nexus
-version: 2.0.0
+version: 2.0.1
 description: "A Sonatype Nexus shared service"
 registry: azuretre
 credentials:
@@ -31,6 +31,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
   - name: ssl_cert_name
     type: string
@@ -39,7 +40,6 @@ parameters:
 
 mixins:
   - exec
-  - az
   - terraform:
       clientVersion: 1.1.5
 install:

templates/shared_services/sonatype-nexus/Dockerfile.tmpl

@@ -2,15 +2,16 @@ FROM debian:stretch-slim
 
 ARG BUNDLE_DIR
 
-RUN apt-get update && apt-get install -y ca-certificates
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" jq="1.5+dfsg-1.3" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli
+    && apt-get update && apt-get -y install azure-cli="2.36.0-1~stretch" \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 # This is a template Dockerfile for the bundle's invocation image
 # You can customize it to use different base images, install tools and copy configuration files.

templates/shared_services/sonatype-nexus/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-shared-service-nexus
-version: 0.3.1
+version: 0.3.2
 description: "A Sonatype Nexus shared service"
 registry: azuretre
 credentials:
@@ -31,10 +31,10 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 mixins:
   - exec
-  - az
   - terraform:
       clientVersion: 1.1.5
 install:
@@ -45,10 +45,8 @@ install:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.tre_id }}-shared-service-sonatype-nexus"
 upgrade:
@@ -65,9 +63,7 @@ uninstall:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.tre_id }}-shared-service-sonatype-nexus"

templates/workspace_services/azureml/Dockerfile.tmpl

@@ -1,12 +1,15 @@
-FROM debian:buster
+FROM debian:stretch-slim
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" jq="1.5+dfsg-1.3" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
+    && apt-get update && apt-get -y install azure-cli="2.36.0-1~stretch" \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 RUN az extension add --name azure-firewall
 

templates/workspace_services/azureml/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-service-azureml
-version: 0.3.0
+version: 0.3.1
 description: "An Azure TRE service for Azure Machine Learning"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -64,10 +64,8 @@ install:
         arm_client_secret: "{{ bundle.credentials.azure_client_secret }}"
         arm_use_msi: "{{ bundle.parameters.arm_use_msi }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-azureml-{{ bundle.parameters.id }}"
       outputs:
@@ -94,9 +92,7 @@ uninstall:
         arm_client_id: "{{ bundle.credentials.azure_client_id }}"
         arm_client_secret: "{{ bundle.credentials.azure_client_secret }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-azureml-{{ bundle.parameters.id }}"

templates/workspace_services/azureml/user_resources/aml_compute/Dockerfile.tmpl

@@ -1,4 +1,4 @@
-FROM debian:buster
+FROM debian:stretch-slim
 
 ARG BUNDLE_DIR
 

templates/workspace_services/azureml/user_resources/aml_compute/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-user-resource-aml-compute-instance
-version: 0.3.0
+version: 0.3.1
 description: "Azure Machine Learning Compute Instance"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -26,7 +26,7 @@ parameters:
     type: string
   - name: vm_size
     type: string
-    default: 'Standard_DS2_v3'
+    default: "Standard_DS2_v3"
   - name: auth_tenant_id
     type: string
   - name: user_object_id
@@ -46,6 +46,7 @@ parameters:
     env: TERRAFORM_STATE_CONTAINER_NAME
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 
 mixins:
@@ -54,7 +55,6 @@ mixins:
   - terraform:
       clientVersion: 1.0.5
 
-
 install:
   - terraform:
       description: "Deploy service"
@@ -71,14 +71,11 @@ install:
         arm_client_secret: "{{ bundle.credentials.azure_client_secret }}"
         arm_use_msi: "{{ bundle.parameters.arm_use_msi }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-user-resource-aml-compute-instance-{{ bundle.parameters.id }}"
 
-
 uninstall:
   - exec:
       description: "Delete AML Compute Instance"

templates/workspace_services/devtestlabs/porter.yaml

@@ -34,6 +34,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 
 mixins:
@@ -49,10 +50,8 @@ install:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-devtestlabs-{{ bundle.parameters.id }}"
 
@@ -71,9 +70,7 @@ uninstall:
         tre_id: "{{ bundle.parameters.tre_id }}"
         tre_resource_id: "{{ bundle.parameters.id }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-devtestlabs-{{ bundle.parameters.id }}"

templates/workspace_services/gitea/Dockerfile.tmpl

@@ -1,29 +0,0 @@
-FROM debian:stretch-slim
-
-ARG BUNDLE_DIR
-
-RUN apt-get update && apt-get install -y ca-certificates
-
-# Install Azure CLI
-RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
-    && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
-    && AZ_REPO=$(lsb_release -cs) \
-    && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-COPY . $BUNDLE_DIR

templates/workspace_services/gitea/porter.yaml

@@ -1,9 +1,8 @@
 ---
 name: tre-workspace-service-gitea
-version: 0.3.1
+version: 0.3.2
 description: "A Gitea workspace service"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id
@@ -57,6 +56,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 
 mixins:

templates/workspace_services/gitea/version.txt

@@ -1 +1 @@
-__version__ = "0.3.1"
+__version__ = "0.3.2"

templates/workspace_services/guacamole/Dockerfile.tmpl

@@ -1,14 +1,15 @@
-FROM debian:buster
+FROM debian:stretch-slim
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" jq="1.5+dfsg-1.3" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
-
-RUN az config set extension.use_dynamic_install=yes_without_prompt
+    && apt-get update && apt-get -y install azure-cli="2.36.0-1~stretch" \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 RUN az extension add --name azure-firewall
 

templates/workspace_services/guacamole/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-service-guacamole
-version: 0.3.5
+version: 0.3.6
 description: "An Azure TRE service for Guacamole"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -70,14 +70,11 @@ parameters:
     type: boolean
     default: false
     env: IS_EXPOSED_EXTERNALLY
-    description:
-      "Determines if the web app will be available over public/internet
-      or private networks"
+    description: "Determines if the web app will be available over public/internet or private networks"
   - name: workspace_identifier_uri
     type: string
     env: WORKSPACE_IDENTIFIER_URI
-    description:
-      "This is used to define the scope of the oauth2 redirection (e.g. api://treid_ws_wsid)"
+    description: "This is used to define the scope of the oauth2 redirection (e.g. api://treid_ws_wsid)"
   # the following are added automatically by the resource processor
   - name: id
     type: string
@@ -119,8 +116,7 @@ install:
         image_name: "{{ bundle.parameters.image_name }}"
         image_tag: "{{ bundle.parameters.image_tag }}"
         mgmt_acr_name: "{{ bundle.parameters.mgmt_acr_name }}"
-        mgmt_resource_group_name:
-          "{{ bundle.parameters.mgmt_resource_group_name }}"
+        mgmt_resource_group_name: "{{ bundle.parameters.mgmt_resource_group_name }}"
         arm_client_id: "{{ bundle.credentials.azure_client_id }}"
         arm_client_secret: "{{ bundle.credentials.azure_client_secret }}"
         arm_tenant_id: "{{ bundle.credentials.azure_tenant_id }}"
@@ -135,10 +131,8 @@ install:
         tre_resource_id: "{{ bundle.parameters.id }}"
         workspace_identifier_uri: "{{ bundle.parameters.workspace_identifier_uri }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-guacamole-{{ bundle.parameters.id }}"
       outputs:
@@ -160,8 +154,7 @@ uninstall:
         image_name: "{{ bundle.parameters.image_name }}"
         image_tag: "{{ bundle.parameters.image_tag }}"
         mgmt_acr_name: "{{ bundle.parameters.mgmt_acr_name }}"
-        mgmt_resource_group_name:
-          "{{ bundle.parameters.mgmt_resource_group_name }}"
+        mgmt_resource_group_name: "{{ bundle.parameters.mgmt_resource_group_name }}"
         arm_client_id: "{{ bundle.credentials.azure_client_id }}"
         arm_client_secret: "{{ bundle.credentials.azure_client_secret }}"
         arm_tenant_id: "{{ bundle.credentials.azure_tenant_id }}"
@@ -176,9 +169,7 @@ uninstall:
         tre_resource_id: "{{ bundle.parameters.id }}"
         workspace_identifier_uri: "{{ bundle.parameters.workspace_identifier_uri }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "tre-service-guacamole-{{ bundle.parameters.id }}"

templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/Dockerfile.tmpl

@@ -1,30 +0,0 @@
-FROM debian:buster
-
-# Install Azure CLI
-RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
-    && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
-    && AZ_REPO=$(lsb_release -cs) \
-    && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
-
-RUN az config set extension.use_dynamic_install=yes_without_prompt
-
-ARG BUNDLE_DIR
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-
-COPY . $BUNDLE_DIR

templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/porter.yaml

@@ -1,9 +1,8 @@
 ---
 name: tre-service-guacamole-linuxvm
-version: 0.3.2
+version: 0.3.3
 description: "An Azure TRE User Resource Template for Guacamole (Linux)"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id
@@ -43,6 +42,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
   - name: os_image
     type: string
@@ -59,7 +59,9 @@ parameters:
   - name: nexus_version
     type: string
     default: "V1"
-    description: "Which Nexus proxy service to use, i.e. V1 for the App Service-based Nexus or V2 for the VM-based service"
+    description: >-
+      "Which Nexus proxy service to use, i.e. V1 for the App Service-based
+      Nexus or V2 for the VM-based service"
 
 outputs:
   - name: ip
@@ -104,10 +106,8 @@ install:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -133,10 +133,8 @@ upgrade:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -162,10 +160,8 @@ uninstall:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
 
@@ -175,25 +171,21 @@ start:
         - "output"
       description: "Get resource ID from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Start the VM"
+      description: "Start the VM"
       arguments:
         - vm
         - start
@@ -206,25 +198,21 @@ stop:
         - "output"
       description: "Get VM hostname and rg from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Stop the VM"
+      description: "Stop the VM"
       arguments:
         - vm
         - stop

templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/Dockerfile.tmpl

@@ -1,30 +0,0 @@
-FROM debian:buster
-
-# Install Azure CLI
-RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
-    && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
-    && AZ_REPO=$(lsb_release -cs) \
-    && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
-
-RUN az config set extension.use_dynamic_install=yes_without_prompt
-
-ARG BUNDLE_DIR
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-
-COPY . $BUNDLE_DIR

templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm/porter.yaml

@@ -1,9 +1,8 @@
 ---
 name: tre-service-guacamole-windowsvm
-version: 0.3.2
+version: 0.3.3
 description: "An Azure TRE User Resource Template for Guacamole (Windows 10)"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id
@@ -43,6 +42,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
   - name: os_image
     type: string
@@ -59,8 +59,9 @@ parameters:
   - name: nexus_version
     type: string
     default: "V1"
-    description: "Which Nexus proxy service to use, i.e. V1 for the App Service-based Nexus or V2 for the VM-based service"
-
+    description: >-
+      "Which Nexus proxy service to use, i.e. V1 for the App Service-based
+      Nexus or V2 for the VM-based service"
 
 outputs:
   - name: ip
@@ -105,10 +106,8 @@ install:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -134,10 +133,8 @@ upgrade:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -163,10 +160,8 @@ uninstall:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
 
@@ -176,25 +171,21 @@ start:
         - "output"
       description: "Get resource ID from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Start the VM"
+      description: "Start the VM"
       arguments:
         - vm
         - start
@@ -207,25 +198,21 @@ stop:
         - "output"
       description: "Get VM hostname and rg from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Stop the VM"
+      description: "Stop the VM"
       arguments:
         - vm
         - stop

templates/workspace_services/guacamole/user_resources/guacamole-dev-vm/Dockerfile.tmpl

@@ -1,30 +0,0 @@
-FROM debian:buster
-
-# Install Azure CLI
-RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
-    && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
-    && AZ_REPO=$(lsb_release -cs) \
-    && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
-
-RUN az config set extension.use_dynamic_install=yes_without_prompt
-
-ARG BUNDLE_DIR
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-
-COPY . $BUNDLE_DIR

templates/workspace_services/guacamole/user_resources/guacamole-dev-vm/porter.yaml

@@ -1,9 +1,8 @@
 ---
 name: tre-service-dev-vm
-version: 0.3.2
+version: 0.3.3
 description: "An Azure TRE User Resource Template for a Dev VM"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id
@@ -43,6 +42,7 @@ parameters:
     description: "The name of the Terraform state storage container"
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
   - name: os_image
     type: string
@@ -59,7 +59,9 @@ parameters:
   - name: nexus_version
     type: string
     default: "V1"
-    description: "Which Nexus proxy service to use, i.e. V1 for the App Service-based Nexus or V2 for the VM-based service"
+    description: >-
+      "Which Nexus proxy service to use, i.e. V1 for the App Service-based
+      Nexus or V2 for the VM-based service"
 
 outputs:
   - name: ip
@@ -104,10 +106,8 @@ install:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -133,10 +133,8 @@ upgrade:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
@@ -162,10 +160,8 @@ uninstall:
         shared_storage_name: "{{ bundle.parameters.shared_storage_name }}"
         nexus_version: "{{ bundle.parameters.nexus_version }}"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
 
@@ -175,25 +171,21 @@ start:
         - "output"
       description: "Get resource ID from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Start the VM"
+      description: "Start the VM"
       arguments:
         - vm
         - start
@@ -206,25 +198,21 @@ stop:
         - "output"
       description: "Get VM hostname and rg from Terraform outputs"
       backendConfig:
-        resource_group_name:
-          "{{ bundle.parameters.tfstate_resource_group_name }}"
-        storage_account_name:
-          "{{ bundle.parameters.tfstate_storage_account_name }}"
+        resource_group_name: "{{ bundle.parameters.tfstate_resource_group_name }}"
+        storage_account_name: "{{ bundle.parameters.tfstate_storage_account_name }}"
         container_name: "{{ bundle.parameters.tfstate_container_name }}"
         key: "{{ bundle.parameters.id }}"
       outputs:
         - name: azure_resource_id
   - az:
-      description:
-        "Login to Azure"
+      description: "Login to Azure"
       arguments:
         - login
       flags:
         identity:
         username: "{{ bundle.credentials.azure_client_id }}"
   - az:
-      description:
-        "Stop the VM"
+      description: "Stop the VM"
       arguments:
         - vm
         - stop

templates/workspace_services/innereye/Dockerfile.tmpl

@@ -1,18 +1,23 @@
-FROM debian:buster
+FROM debian:stretch-slim
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Install Azure CLI
+# It's useless to specify azcli version since the mixin installs the latest anyway
+# hadolint ignore=DL3008
 RUN apt-get update \
-    && apt-get install -y ca-certificates jq curl apt-transport-https lsb-release gnupg \
+    && apt-get install -y ca-certificates="20200601~deb9u2" jq="1.5+dfsg-1.3" curl="7.52.1-5+deb9u16" apt-transport-https="1.4.11" lsb-release="9.20161125" gnupg="2.1.18-8~deb9u4" \
     && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
     && AZ_REPO=$(lsb_release -cs) \
     && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | tee /etc/apt/sources.list.d/azure-cli.list \
-    && apt-get update && apt-get -y install azure-cli 
+    && apt-get update && apt-get -y install azure-cli \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
 RUN az extension add --name azure-firewall
 
-RUN export PORTER_HOME=/home/$USER/.porter \
+RUN export PORTER_HOME=/home/"${USER}"/.porter \
     && curl -L https://cdn.porter.sh/latest/install-linux.sh | bash \
-    && ${PORTER_HOME}/porter mixin install docker
+    && "${PORTER_HOME}"/porter mixin install docker
 
 ENV PATH /home/$USER/.porter/:$PATH
 

templates/workspace_services/innereye/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-service-innereye
-version: 0.3.0
+version: 0.3.1
 description: "An Azure TRE service for InnerEye Deep Learning"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -44,6 +44,7 @@ parameters:
     env: TERRAFORM_STATE_CONTAINER_NAME
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 
 mixins:

templates/workspace_services/mlflow/Dockerfile.tmpl

@@ -1,20 +0,0 @@
-FROM debian:buster
-
-ARG BUNDLE_DIR
-
-# This is a template Dockerfile for the bundle's invocation image
-# You can customize it to use different base images, install tools and copy configuration files.
-#
-# Porter will use it as a template and append lines to it for the mixins
-# and to set the CMD appropriately for the CNAB specification.
-#
-# Add the following line to porter.yaml to instruct Porter to use this template
-# dockerfile: Dockerfile.tmpl
-
-# You can control where the mixin's Dockerfile lines are inserted into this file by moving "# PORTER_MIXINS" line
-# another location in this file. If you remove that line, the mixins generated content is appended to this file.
-# PORTER_MIXINS
-
-# Use the BUNDLE_DIR build argument to copy files into the bundle
-
-COPY . $BUNDLE_DIR

templates/workspace_services/mlflow/porter.yaml

@@ -1,9 +1,8 @@
 ---
 name: tre-service-mlflow
-version: 0.3.1
+version: 0.3.2
 description: "An Azure TRE service for MLflow machine learning lifecycle"
 registry: azuretre
-dockerfile: Dockerfile.tmpl
 
 credentials:
   - name: azure_tenant_id

templates/workspaces/innereye/porter.yaml

@@ -53,6 +53,7 @@ parameters:
     env: TERRAFORM_STATE_CONTAINER_NAME
   - name: arm_use_msi
     env: ARM_USE_MSI
+    type: boolean
     default: false
 
 mixins: