From 305ef58b732c263dc98215312a0dd9b175709008 Mon Sep 17 00:00:00 2001 From: Willy Kloucek Date: Wed, 11 Aug 2021 13:07:17 +0200 Subject: [PATCH] make image not using root user --- ocis/docker/Dockerfile.linux.amd64 | 25 ++++++++++++++++++++++--- ocis/docker/Dockerfile.linux.arm | 25 ++++++++++++++++++++++--- ocis/docker/Dockerfile.linux.arm64 | 25 ++++++++++++++++++++++--- 3 files changed, 66 insertions(+), 9 deletions(-) diff --git a/ocis/docker/Dockerfile.linux.amd64 b/ocis/docker/Dockerfile.linux.amd64 index ce227da2d..4d2b1b39a 100644 --- a/ocis/docker/Dockerfile.linux.amd64 +++ b/ocis/docker/Dockerfile.linux.amd64 @@ -1,4 +1,4 @@ -FROM amd64/alpine:3.13 +FROM amd64/alpine:3.14 ARG VERSION="" ARG REVISION="" @@ -21,11 +21,30 @@ LABEL maintainer="ownCloud GmbH " \ org.opencontainers.image.version="${VERSION}" \ org.opencontainers.image.revision="${REVISION}" +RUN addgroup -g 700 -S ocis-group && \ + adduser -S --ingroup ocis-group --uid 700 ocis-user + +RUN mkdir -p /var/tmp/ocis && \ + chown -R ocis-user:ocis-group /var/tmp/ocis && \ + chmod -R 777 /var/tmp/ocis + +# default artifact location for autogenerated certifaces +# needs to be a static location because of the docker uid switch mechanism +ENV GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \ + GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \ + IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \ + IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \ + PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \ + PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key + +VOLUME [ "/var/tmp/ocis" ] +WORKDIR /var/tmp/ocis + +USER ocis-user + EXPOSE 9200/tcp ENTRYPOINT ["/usr/bin/ocis"] CMD ["server"] COPY dist/binaries/ocis-linux-amd64 /usr/bin/ocis - -VOLUME [ "/var/tmp/ocis" ] diff --git a/ocis/docker/Dockerfile.linux.arm b/ocis/docker/Dockerfile.linux.arm index f0ddbb32a..ab3e30353 100644 --- a/ocis/docker/Dockerfile.linux.arm +++ b/ocis/docker/Dockerfile.linux.arm @@ -1,4 +1,4 @@ -FROM arm32v6/alpine:3.13 +FROM arm32v6/alpine:3.14 ARG VERSION="" ARG REVISION="" @@ -21,11 +21,30 @@ LABEL maintainer="ownCloud GmbH " \ org.opencontainers.image.version="${VERSION}" \ org.opencontainers.image.revision="${REVISION}" +RUN addgroup -g 700 -S ocis-group && \ + adduser -S --ingroup ocis-group --uid 700 ocis-user + +RUN mkdir -p /var/tmp/ocis && \ + chown -R ocis-user:ocis-group /var/tmp/ocis && \ + chmod -R 777 /var/tmp/ocis + +# default artifact location for autogenerated certifaces +# needs to be a static location because of the docker uid switch mechanism +ENV GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \ + GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \ + IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \ + IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \ + PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \ + PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key + +VOLUME [ "/var/tmp/ocis" ] +WORKDIR /var/tmp/ocis + +USER ocis-user + EXPOSE 9200/tcp ENTRYPOINT ["/usr/bin/ocis"] CMD ["server"] COPY dist/binaries/ocis-linux-arm /usr/bin/ocis - -VOLUME [ "/var/tmp/ocis" ] diff --git a/ocis/docker/Dockerfile.linux.arm64 b/ocis/docker/Dockerfile.linux.arm64 index 3e1f4f555..12c636183 100644 --- a/ocis/docker/Dockerfile.linux.arm64 +++ b/ocis/docker/Dockerfile.linux.arm64 @@ -1,4 +1,4 @@ -FROM arm64v8/alpine:3.13 +FROM arm64v8/alpine:3.14 ARG VERSION="" ARG REVISION="" @@ -21,11 +21,30 @@ LABEL maintainer="ownCloud GmbH " \ org.opencontainers.image.version="${VERSION}" \ org.opencontainers.image.revision="${REVISION}" +RUN addgroup -g 700 -S ocis-group && \ + adduser -S --ingroup ocis-group --uid 700 ocis-user + +RUN mkdir -p /var/tmp/ocis && \ + chown -R ocis-user:ocis-group /var/tmp/ocis && \ + chmod -R 777 /var/tmp/ocis + +# default artifact location for autogenerated certifaces +# needs to be a static location because of the docker uid switch mechanism +ENV GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \ + GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \ + IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \ + IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \ + PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \ + PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key + +VOLUME [ "/var/tmp/ocis" ] +WORKDIR /var/tmp/ocis + +USER ocis-user + EXPOSE 9200/tcp ENTRYPOINT ["/usr/bin/ocis"] CMD ["server"] COPY dist/binaries/ocis-linux-arm64 /usr/bin/ocis - -VOLUME [ "/var/tmp/ocis" ]