Skip to content

Commit 916236b

Browse files
kaluzkikaluzki
committed
#226 restore gosu suid bit when container stops
make provision
1 parent ceb69fb commit 916236b

File tree

126 files changed

+1210
-1276
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+1210
-1276
lines changed

‎docker/base/alpine/conf/bin/config.sh‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -70,24 +70,18 @@ function deprecationNotice() {
7070
# Run "entrypoint" scripts
7171
##
7272
function runEntrypoints() {
73-
###############
74-
# Try to find entrypoint
75-
###############
76-
77-
ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
78-
79-
if [ -f "$ENTRYPOINT_SCRIPT" ]; then
80-
. "$ENTRYPOINT_SCRIPT"
73+
# try to find entrypoint task script
74+
TASK_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
75+
if [ ! -f "$TASK_SCRIPT" ]; then
76+
# run default
77+
TASK_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
8178
fi
8279

83-
###############
84-
# Run default
85-
###############
86-
if [ -f "/opt/docker/bin/entrypoint.d/default.sh" ]; then
87-
. /opt/docker/bin/entrypoint.d/default.sh
80+
if [ ! -f "$TASK_SCRIPT" ]; then
81+
exit 1
8882
fi
8983

90-
exit 1
84+
. "$TASK_SCRIPT"
9185
}
9286

9387
# Run "entrypoint" provisioning

‎docker/base/alpine/conf/bin/entrypoint.d/run.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ -z "$CONTAINER_UID" ]]; then
4+
export CONTAINER_UID=application
5+
fi
6+
7+
set -o pipefail # trace ERR through pipes
8+
set -o errtrace # trace ERR through 'time command' and other functions
9+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
11+
12+
. /opt/docker/bin/config.sh
13+
14+
# auto elevate privileges (if container is not started as root)
15+
if [[ "$UID" -ne 0 ]]; then
16+
export CONTAINER_UID="$UID"
17+
exec gosu root "$0" "$@"
18+
fi
19+
20+
createDockerStdoutStderr
21+
22+
# sanitize input and set task
23+
TASK="$(echo $1 | sed 's/[^-_a-zA-Z0-9]*//g')"
24+
25+
# remove suid bit `chmod -s /sbin/gosu` in provision/entrypoint.d/05-gosu.sh
26+
if [ "$TASK" == "supervisord" ] || [ "$TASK" == "noop" ]; then
27+
# visible provisioning
28+
runProvisionEntrypoint
29+
else
30+
# hidden provisioning
31+
runProvisionEntrypoint >/dev/null
32+
fi
33+
34+
# https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
35+
# https://hynek.me/articles/docker-signals/
36+
trap 'true' SIGTERM
37+
runEntrypoints &
38+
wait $!
39+
40+
# restore suid bit `chmod +s /sbin/gosu` in provision/entrypoint.d/teardown/05-gosu.sh
41+
includeScriptDir /opt/docker/provision/entrypoint.d/teardown
42+
exit 0

‎docker/base/alpine/conf/bin/entrypoint.sh‎

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,3 @@
11
#!/usr/bin/env bash
22

3-
if [[ -z "$CONTAINER_UID" ]]; then
4-
export CONTAINER_UID="application"
5-
fi
6-
7-
set -o pipefail # trace ERR through pipes
8-
set -o errtrace # trace ERR through 'time command' and other functions
9-
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10-
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
11-
12-
# auto elevate privileges (if container is not started as root)
13-
if [[ "$UID" -ne 0 ]]; then
14-
export CONTAINER_UID="$UID"
15-
exec gosu root "$0" "$@"
16-
fi
17-
# remove suid bit on gosu
18-
chmod -s /sbin/gosu
19-
20-
trap 'echo sigterm ; exit' SIGTERM
21-
trap 'echo sigkill ; exit' SIGKILL
22-
23-
# sanitize input and set task
24-
TASK="$(echo $1| sed 's/[^-_a-zA-Z0-9]*//g')"
25-
26-
source /opt/docker/bin/config.sh
27-
28-
createDockerStdoutStderr
29-
30-
if [[ "$UID" -eq 0 ]]; then
31-
# Only run provision if user is root
32-
33-
if [ "$TASK" == "supervisord" -o "$TASK" == "noop" ]; then
34-
# Visible provisioning
35-
runProvisionEntrypoint
36-
else
37-
# Hidden provisioning
38-
runProvisionEntrypoint > /dev/null
39-
fi
40-
fi
41-
42-
#############################
43-
## COMMAND
44-
#############################
45-
46-
runEntrypoints "$@"
3+
exec /opt/docker/bin/entrypoint.d/run.sh "$@"

‎docker/base/alpine/conf/provision/entrypoint.d/.gitkeep‎

Whitespace-only changes.

‎docker/base/alpine/conf/provision/entrypoint.d/05-gosu.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# remove suid bit on gosu
2+
chmod -s /sbin/gosu

‎docker/base/alpine/conf/provision/entrypoint.d/teardown/05-gosu.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# add suid bit on gosu
2+
chmod +s /sbin/gosu

‎docker/base/centos-7/conf/bin/config.sh‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -70,24 +70,18 @@ function deprecationNotice() {
7070
# Run "entrypoint" scripts
7171
##
7272
function runEntrypoints() {
73-
###############
74-
# Try to find entrypoint
75-
###############
76-
77-
ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
78-
79-
if [ -f "$ENTRYPOINT_SCRIPT" ]; then
80-
. "$ENTRYPOINT_SCRIPT"
73+
# try to find entrypoint task script
74+
TASK_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
75+
if [ ! -f "$TASK_SCRIPT" ]; then
76+
# run default
77+
TASK_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
8178
fi
8279

83-
###############
84-
# Run default
85-
###############
86-
if [ -f "/opt/docker/bin/entrypoint.d/default.sh" ]; then
87-
. /opt/docker/bin/entrypoint.d/default.sh
80+
if [ ! -f "$TASK_SCRIPT" ]; then
81+
exit 1
8882
fi
8983

90-
exit 1
84+
. "$TASK_SCRIPT"
9185
}
9286

9387
# Run "entrypoint" provisioning

‎docker/base/centos-7/conf/bin/entrypoint.d/run.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ -z "$CONTAINER_UID" ]]; then
4+
export CONTAINER_UID=application
5+
fi
6+
7+
set -o pipefail # trace ERR through pipes
8+
set -o errtrace # trace ERR through 'time command' and other functions
9+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
11+
12+
. /opt/docker/bin/config.sh
13+
14+
# auto elevate privileges (if container is not started as root)
15+
if [[ "$UID" -ne 0 ]]; then
16+
export CONTAINER_UID="$UID"
17+
exec gosu root "$0" "$@"
18+
fi
19+
20+
createDockerStdoutStderr
21+
22+
# sanitize input and set task
23+
TASK="$(echo $1 | sed 's/[^-_a-zA-Z0-9]*//g')"
24+
25+
# remove suid bit `chmod -s /sbin/gosu` in provision/entrypoint.d/05-gosu.sh
26+
if [ "$TASK" == "supervisord" ] || [ "$TASK" == "noop" ]; then
27+
# visible provisioning
28+
runProvisionEntrypoint
29+
else
30+
# hidden provisioning
31+
runProvisionEntrypoint >/dev/null
32+
fi
33+
34+
# https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
35+
# https://hynek.me/articles/docker-signals/
36+
trap 'true' SIGTERM
37+
runEntrypoints &
38+
wait $!
39+
40+
# restore suid bit `chmod +s /sbin/gosu` in provision/entrypoint.d/teardown/05-gosu.sh
41+
includeScriptDir /opt/docker/provision/entrypoint.d/teardown
42+
exit 0

‎docker/base/centos-7/conf/bin/entrypoint.sh‎

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,3 @@
11
#!/usr/bin/env bash
22

3-
if [[ -z "$CONTAINER_UID" ]]; then
4-
export CONTAINER_UID="application"
5-
fi
6-
7-
set -o pipefail # trace ERR through pipes
8-
set -o errtrace # trace ERR through 'time command' and other functions
9-
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10-
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
11-
12-
# auto elevate privileges (if container is not started as root)
13-
if [[ "$UID" -ne 0 ]]; then
14-
export CONTAINER_UID="$UID"
15-
exec gosu root "$0" "$@"
16-
fi
17-
# remove suid bit on gosu
18-
chmod -s /sbin/gosu
19-
20-
trap 'echo sigterm ; exit' SIGTERM
21-
trap 'echo sigkill ; exit' SIGKILL
22-
23-
# sanitize input and set task
24-
TASK="$(echo $1| sed 's/[^-_a-zA-Z0-9]*//g')"
25-
26-
source /opt/docker/bin/config.sh
27-
28-
createDockerStdoutStderr
29-
30-
if [[ "$UID" -eq 0 ]]; then
31-
# Only run provision if user is root
32-
33-
if [ "$TASK" == "supervisord" -o "$TASK" == "noop" ]; then
34-
# Visible provisioning
35-
runProvisionEntrypoint
36-
else
37-
# Hidden provisioning
38-
runProvisionEntrypoint > /dev/null
39-
fi
40-
fi
41-
42-
#############################
43-
## COMMAND
44-
#############################
45-
46-
runEntrypoints "$@"
3+
exec /opt/docker/bin/entrypoint.d/run.sh "$@"

‎docker/base/centos-7/conf/provision/entrypoint.d/.gitkeep‎

Whitespace-only changes.

0 commit comments

Comments
 (0)