Commit 1186bc51 authored by nimrod's avatar nimrod
Browse files

Go a different way with running as the right user. 

Deduce the uid and gid from the volume owner and run as those. Don't
need to mount /etc/passwd and /etc/group inside the container (didn't
work with --user anyway). No hard-coded uids/ users anymore.
parent c4635a27

.dockerignore

+1 −0
Original line number Diff line number Diff line
@@ -2,3 +2,4 @@ 
!Pipfile*

!poca.xml

!crontab

!entrypoint

Dockerfile

+6 −1
Original line number Diff line number Diff line
@@ -3,6 +3,10 @@ FROM registry.shore.co.il/cron as supersonic 


FROM registry.hub.docker.com/library/python:3.6-alpine3.13

COPY --from=supersonic /usr/local/bin/supersonic /usr/local/bin/

# hadolint ignore=DL3018

RUN apk add --update --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/edge/testing/ \

        gosu \

    ;

# hadolint ignore=DL3013

RUN pip install --no-cache-dir pipenv

WORKDIR /poquita
@@ -16,7 +20,8 @@ RUN apk add --update --no-cache --virtual .lxml-build build-base git libxslt-dev 
RUN mkdir --mode 777 db Podcasts

COPY --chown=root:root crontab ./

COPY --chown=root:root poca.xml ./

COPY --chown=root:root entrypoint /usr/local/sbin/docker-entrypoint

VOLUME db Podcasts

ENTRYPOINT ["docker-entrypoint"]

CMD [ "supersonic", "crontab" ]

USER nobody

HEALTHCHECK CMD pgrep supersonic

docker-compose.yml

+0 −3
Original line number Diff line number Diff line
@@ -5,10 +5,7 @@ services: 
    build:

      context: ./

    restart: on-failure

    user: nimrod

    volumes:

      - /etc/group:/etc/group:ro

      - /etc/passwd:/etc/passwd:ro

      - /srv/library/nimrod/Podcasts:/poquita/Podcasts

      - poquita:/poquita/db

entrypoint

0 → 100755
+9 −0
Original line number Diff line number Diff line 
#!/bin/sh

set -eu



[ "$(id -u)" = "0" ] || { echo "Not running as root, continuing as the current user."; eval exec "$@"; }

command -v stat > /dev/null || { echo "Can't find stat, exiting."; exit 1; }

command -v gosu > /dev/null || { echo "Can't find gosu, exiting."; exit 1; }

uid="$(stat Podcasts -c '%u')"

gid="$(stat Podcasts -c '%g')"

eval exec gosu "$uid:$gid" "$@"