[bitnami/zookeeper] Release 3.9.5-debian-12-r2 (#92328)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
2026-08-11 08:32:31 +08:00 · 2026-04-09 00:32:13 +02:00
parent a9a994031c
commit 6d50b7abb8
3 changed files with 50 additions and 32 deletions
@@ -7,7 +7,7 @@ ARG DOWNLOADS_URL="downloads.bitnami.com/files/stacksmith"
 ARG TARGETARCH

 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-03-12T16:51:53Z" \
+      org.opencontainers.image.created="2026-04-08T22:18:22Z" \
      org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
      org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper/README.md" \
      org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/zookeeper" \
@@ -29,7 +29,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
    DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
    mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
    COMPONENTS=( \
-      "wait-for-port-1.0.10-8-linux-${OS_ARCH}-debian-12" \
+      "wait-for-port-1.0.10-9-linux-${OS_ARCH}-debian-12" \
      "jre-11.0.30-9-1-linux-${OS_ARCH}-debian-12" \
      "zookeeper-3.9.5-0-linux-${OS_ARCH}-debian-12" \
    ) ; \
@@ -53,7 +53,7 @@ COPY rootfs /
 RUN /opt/bitnami/scripts/zookeeper/postunpack.sh
 ENV APP_VERSION="3.9.5" \
    BITNAMI_APP_NAME="zookeeper" \
-    IMAGE_REVISION="1"
+    IMAGE_REVISION="2"

 EXPOSE 2181 2888 3888 8080

@@ -601,17 +601,52 @@ zookeeper_healthcheck() {
    local port="$ZOO_PORT_NUMBER"

    if [[ "$ZOO_TLS_CLIENT_ENABLE" = true ]]; then
-        port="$ZOO_TLS_PORT_NUMBER"
-        command="openssl"
-        args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${port}")
+        if [[ "$JAVA_FIPS_MODE" = "restricted" ]]; then
+            # In FIPS-restricted mode OpenSSL only allows FIPS-approved algorithms and
+            # the legacy provider is completely disabled. Any keystore that uses RC2,
+            # 3DES, or a SHA-1 MAC (common in Java-generated PKCS12 and BCFKS) cannot
+            # be parsed by openssl pkcs12.
+            # Primary: use the admin HTTP server (no keystore interaction required).
+            # Fallback: nc on the plain clientPort (ZOO_PORT_NUMBER), which ZooKeeper
+            # keeps open alongside the TLS secureClientPort.
+            local admin_url="http://127.0.0.1:${ZOO_ADMIN_SERVER_PORT_NUMBER}/commands/ruok"
+            debug "Running healthcheck via admin server (FIPS mode): 'curl -sf --max-time ${ZOO_HC_TIMEOUT} ${admin_url}'"
+            local curl_output=""
+            local curl_exit_code=0
+            curl_output=$(curl -sf --max-time "$ZOO_HC_TIMEOUT" "$admin_url") || curl_exit_code=$?
+            if [[ $curl_exit_code -eq 0 ]]; then
+                debug "Admin server response: ${curl_output}"
+                response="imok"
+            else
+                # Admin server is not available. Fall back to the plain clientPort
+                # (ZOO_PORT_NUMBER). Even when TLS is enabled, Bitnami's zoo.cfg always
+                # sets both clientPort and secureClientPort, so ZooKeeper keeps a
+                # plain-text listener on ZOO_PORT_NUMBER alongside the TLS one. Using
+                # nc avoids any keystore interaction.
+                warn "Admin server not reachable (exit code ${curl_exit_code}, url ${admin_url}); falling back to plain port ${ZOO_PORT_NUMBER}."
+                local nc_args=("-w" "$ZOO_HC_TIMEOUT" "127.0.0.1" "$ZOO_PORT_NUMBER")
+                if nc -help 2>&1 | grep -q "\[-q seconds\]"; then
+                    nc_args=("-q" "1" "${nc_args[@]}")
+                fi
+                debug "Running healthcheck command (FIPS fallback): 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} nc ${nc_args[*]}'"
+                response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" nc "${nc_args[@]}" 2>/dev/null)
+                if [[ ! "$response" =~ "imok" ]]; then
+                    error "Plain port fallback also failed (response: '${response}'). Ensure ZOO_PORT_NUMBER=${ZOO_PORT_NUMBER} is reachable or enable the admin server with ZOO_ENABLE_ADMIN_SERVER=yes."
+                fi
+            fi
+        else
+            port="$ZOO_TLS_PORT_NUMBER"
+            command="openssl"
+            args+=("s_client" "-quiet" "-crlf" "-connect" "localhost:${port}")

-        debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]} \
-            -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \
-            -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'"
-        response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}" \
-            -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") \
-            -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") 2> /dev/null
-        )
+            debug "Running healthcheck command: 'echo \"ruok\" | timeout ${ZOO_HC_TIMEOUT} ${command} ${args[*]} \
+                -key <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nocerts -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD) \
+                -cert <(openssl pkcs12 -in ${ZOO_TLS_CLIENT_KEYSTORE_FILE} -nodes -nokeys -passin pass:\$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD)'"
+            response=$(echo "ruok" | timeout "$ZOO_HC_TIMEOUT" "$command" "${args[@]}" \
+                -key <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nocerts -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") \
+                -cert <(openssl pkcs12 -in "$ZOO_TLS_CLIENT_KEYSTORE_FILE" -nodes -nokeys -passin pass:"$ZOO_TLS_CLIENT_KEYSTORE_PASSWORD") 2> /dev/null
+            )
+        fi
    else
        command="nc"
        # Only add flag '-q' if OpenBSD netcat is used
@@ -46,25 +46,7 @@ Subscribe to project updates by watching the [bitnami/containers GitHub reposito

 ## Get this image

-The recommended way to get the Bitnami Apache ZooKeeper Docker Image is to pull the prebuilt image from the [Docker Hub Registry](https://hub.docker.com/r/bitnami/zookeeper).
-
-```console
-docker pull bitnami/zookeeper:latest
-```
-
-To use a specific version, you can pull a versioned tag. You can view the [list of available versions](https://hub.docker.com/r/bitnami/zookeeper/tags/) in the Docker Hub Registry.
-
-```console
-docker pull bitnami/zookeeper:[TAG]
-```
-
-If you wish, you can also build the image yourself by cloning the repository, changing to the directory containing the Dockerfile and executing the `docker build` command. Remember to replace the `APP`, `VERSION` and `OPERATING-SYSTEM` path placeholders in the example command below with the correct values.
-
-```console
-git clone https://github.com/bitnami/containers.git
-cd bitnami/APP/VERSION/OPERATING-SYSTEM
-docker build -t bitnami/APP:latest .
-```
+The Bitnami Apache ZooKeeper Docker image is only available to [Bitnami Secure Images](https://bitnami.com) customers.

 ## Using `docker-compose.yaml`

@@ -241,6 +223,7 @@ You have to use 0.0.0.0 as the host for the server. More concretely, if the ID o
 The Bitnami Apache ZooKeeper Docker image from the [Bitnami Secure Images](https://go-vmware.broadcom.com/contact-us) catalog includes extra features and settings to configure the container with FIPS capabilities. You can configure the next environment variables:

 - `OPENSSL_FIPS`: whether OpenSSL runs in FIPS mode or not. `yes` (default), `no`.
+- `JAVA_TOOL_OPTIONS`: controls Java FIPS mode. Use `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.restricted` (restricted), `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.relaxed` (relaxed), or `-Djava.security.properties==/opt/bitnami/java/conf/security/java.security.original` (off).

 ## Logging