diff --git a/Dockerfile b/Dockerfile index 3455e77..e4892a1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,65 @@ -FROM martinussuherman/alpine:3.13-amd64-glibc +FROM alpine:3.19.3 +LABEL org.opencontainers.image.authors="DEVOPly " + +ENV GLIBC_VERSION 2.35-r1 + +# Download and install glibc +#RUN apk add --update curl && \ +# curl -Lo /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \ +# curl -Lo glibc.apk "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk" && \ +# curl -Lo glibc-bin.apk "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-bin-${GLIBC_VERSION}.apk" && \ +# apk add --force-overwrite glibc-bin.apk glibc.apk && \ +# /usr/glibc-compat/sbin/ldconfig /lib /usr/glibc-compat/lib && \ +# echo 'hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4' >> /etc/nsswitch.conf && \ +# apk del curl && \ +# rm -rf /var/cache/apk/* glibc.apk glibc-bin.apk + +RUN apk add --update gcompat + +ENV \ + # container/su-exec UID \ + EUID=1001 \ + # container/su-exec GID \ + EGID=1001 \ + # container/su-exec user name \ + EUSER=docker-user \ + # container/su-exec group name \ + EGROUP=docker-group \ + # container user home dir \ + EHOME= \ + # should user created/updated to use nologin shell? (yes/no) \ + ENOLOGIN=yes \ + # should user home dir get chown'ed? (yes/no) \ + ECHOWNHOME=no \ + # additional directories to create + chown (space separated) \ + ECHOWNDIRS= \ + # additional files to create + chown (space separated) \ + ECHOWNFILES= \ + # container timezone \ + TZ=UTC + +# Install shadow (for usermod and groupmod) and su-exec +RUN \ + apk --no-cache --update add \ + shadow \ + su-exec \ + tzdata + +COPY \ + chown-path \ + set-user-group-home \ + entrypoint-crond \ + entrypoint-exec \ + entrypoint-su-exec \ + /usr/bin/ + +RUN \ + chmod +x \ + /usr/bin/chown-path \ + /usr/bin/set-user-group-home \ + /usr/bin/entrypoint-crond \ + /usr/bin/entrypoint-exec \ + /usr/bin/entrypoint-su-exec ENV \ # container/su-exec UID \ @@ -14,7 +75,7 @@ ENV \ # container user home dir \ EHOME=/home/vscode \ # code-server version \ - VERSION=4.4.0 + VERSION=4.91.1 COPY code-server /usr/bin/ RUN chmod +x /usr/bin/code-server diff --git a/chown-path b/chown-path new file mode 100644 index 0000000..b0a6331 --- /dev/null +++ b/chown-path @@ -0,0 +1,17 @@ +#!/bin/sh + +if [ ! -z "$ECHOWNDIRS" ]; then + if [ ! -d "$ECHOWNDIRS" ]; then + mkdir -p $ECHOWNDIRS + fi + + chown $EUSER:$EGROUP $ECHOWNDIRS +fi + +if [ ! -z "$ECHOWNFILES" ]; then + if [ ! -f "$ECHOWNFILES" ]; then + touch $ECHOWNFILES + fi + + chown $EUSER:$EGROUP $ECHOWNFILES +fi diff --git a/code-server b/code-server index bc9fb65..e12f493 100644 --- a/code-server +++ b/code-server @@ -1,3 +1,3 @@ #!/usr/bin/env sh -exec /usr/lib/code-server/code-server "$@" +exec /usr/lib/code-server/bin/code-server "$@" diff --git a/entrypoint-crond b/entrypoint-crond new file mode 100644 index 0000000..427eed4 --- /dev/null +++ b/entrypoint-crond @@ -0,0 +1,18 @@ +#!/bin/sh + +CROND_PARAMS=$@ +if [ -z $CROND_CRONTAB ]; then + echo "missing environment variable: CROND_CRONTAB" + exit 1 +fi + +# set user group and home +set-user-group-home + +# chown path +chown-path + +# configure and exec cron deamon +crontab -u $EUSER $CROND_CRONTAB + +crond $CROND_PARAMS diff --git a/entrypoint-exec b/entrypoint-exec new file mode 100644 index 0000000..e83dc3c --- /dev/null +++ b/entrypoint-exec @@ -0,0 +1,14 @@ +#!/bin/sh + +ENTRYPOINT_COMMAND=$1 +shift +ENTRYPOINT_PARAMS=$@ + +# set user group and home +set-user-group-home + +# chown path +chown-path + +# exec ENTRYPOINT_COMMAND +exec $ENTRYPOINT_COMMAND $ENTRYPOINT_PARAMS diff --git a/entrypoint-su-exec b/entrypoint-su-exec new file mode 100644 index 0000000..4a3c5e8 --- /dev/null +++ b/entrypoint-su-exec @@ -0,0 +1,14 @@ +#!/bin/sh + +ENTRYPOINT_COMMAND=$1 +shift +ENTRYPOINT_PARAMS=$@ + +# set user group and home +set-user-group-home + +# chown path +chown-path + +# exec ENTRYPOINT_COMMAND as user +exec su-exec $EUSER $ENTRYPOINT_COMMAND $ENTRYPOINT_PARAMS diff --git a/set-user-group-home b/set-user-group-home new file mode 100644 index 0000000..6a58cc7 --- /dev/null +++ b/set-user-group-home @@ -0,0 +1,73 @@ +#!/bin/sh +# The goal of this script is to allow mapping of host user (the one running +# docker), to the desired container user, as to enable the use of more +# restrictive file permission (700 or 600) + +# does a group with name = EGROUP already exist ? +EXISTING_GID=$( getent group $EGROUP | cut -f3 -d ':' ) + +if [ ! -z $EXISTING_GID ]; then + if [ $EXISTING_GID != $EGID ]; then + # change id of the existing group + groupmod -g $EGID $EGROUP + fi +else + # create new group with id = EGID + addgroup -g $EGID $EGROUP +fi + +# does a user with name = EUSER already exist ? +EXISTING_UID=$( getent passwd $EUSER | cut -f3 -d ':' ) + +if [ ! -z $EXISTING_UID ]; then + if [ $EXISTING_UID != $EUID ]; then + if [ ! -z $EHOME ]; then + if [ $ENOLOGIN = "yes" ]; then + # update existing user, set shell = nologin, id = EUID, + # group = EGROUP, and home directory = EHOME + usermod -s /sbin/nologin -u $EUID -g $EGROUP -d $EHOME $EUSER + else + # update existing user, set shell = sh, id = EUID, group = EGROUP, + # and home directory = EHOME + usermod -s /bin/sh -u $EUID -g $EGROUP -d $EHOME $EUSER + fi + else + if [ $ENOLOGIN = "yes" ]; then + # update existing user, set shell = nologin, id = EUID + # and group = EGROUP + usermod -s /sbin/nologin -u $EUID -g $EGROUP $EUSER + else + # update existing user, set shell = sh, id = EUID + # and group = EGROUP + usermod -s /bin/sh -u $EUID -g $EGROUP $EUSER + fi + fi + fi +else + if [ ! -z $EHOME ]; then + if [ $ENOLOGIN = "yes" ]; then + # create new user with nologin shell, id = EUID, group = EGROUP + # and home directory = EHOME + adduser -s /sbin/nologin -u $EUID -G $EGROUP -h $EHOME -D $EUSER + else + # create new user with sh shell, id = EUID, group = EGROUP + # and home directory = EHOME, + adduser -s /bin/sh -u $EUID -G $EGROUP -h $EHOME -D $EUSER + fi + else + if [ $ENOLOGIN = "yes" ]; then + # create new user with nologin shell, id = EUID and group = EGROUP + adduser -s /sbin/nologin -u $EUID -G $EGROUP -D $EUSER + else + # create new user with sh shell, id = EUID and group = EGROUP + adduser -s /bin/sh -u $EUID -G $EGROUP -D $EUSER + fi + fi +fi + +if [ ! -z $EHOME ]; then + if [ $ECHOWNHOME = "yes" ]; then + # change ownership of home directory + chown $EUSER:$EGROUP $EHOME + fi +fi