plausible/analytics
1
1
Fork 0
mirror of https://github.com/plausible/analytics.git synced 2024-11-23 11:12:15 +03:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Update container image to run as non root (#352)"

Browse Source 
This reverts commit 59acd4c76d.
This commit is contained in:
Uku Taht 2020-10-14 15:59:19 +03:00
parent 7a00de31cd
commit 5e500fef59
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
.gitlab/build-scripts/docker-entrypoint.sh
View File

@ -1,11 +1,16 @@
#!/bin/bash
set -e
chmod a+x /app/*.sh
if [[ "$1" = 'run' ]]; then
/app/bin/plausible start
exec gosu plausibleuser /app/bin/plausible start
elif [[ "$1" = 'db' ]]; then
/app/"$2".sh
exec gosu plausibleuser /app/"$2".sh
else
exec "$@"
fi
exec "$@"

17
Dockerfile
View File

@ -6,6 +6,7 @@ FROM elixir:1.10.3 as buildcontainer
# preparation
ARG APP_VER=0.0.1
ENV GOSU_VERSION 1.11
ENV MIX_ENV=prod
ENV NODE_ENV=production
ENV APP_VERSION=$APP_VER
@ -22,6 +23,20 @@ RUN apt-get update && \
RUN apt-get install -y --no-install-recommends ca-certificates wget \
&& apt-get install -y --install-recommends gnupg2 dirmngr
# grab gosu for easy step-down from root
RUN set -x \
&& dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" \
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc" \
&& export GNUPGHOME="$(mktemp -d)" \
&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
&& command -v gpgconf && gpgconf --kill all || : \
&& rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
&& chmod +x /usr/local/bin/gosu \
&& gosu --version \
&& gosu nobody true
COPY mix.exs ./
COPY mix.lock ./
RUN mix local.hex --force && \
@ -67,9 +82,9 @@ COPY .gitlab/build-scripts/docker-entrypoint.sh /entrypoint.sh
RUN chmod a+x /entrypoint.sh && \
useradd -d /app -u 1000 -s /bin/bash -m plausibleuser
COPY --from=buildcontainer /usr/local/bin/gosu /usr/local/bin/gosu
COPY --from=buildcontainer /app/_build/prod/rel/plausible /app
RUN chown -R plausibleuser:plausibleuser /app
USER plausibleuser
WORKDIR /app
ENTRYPOINT ["/entrypoint.sh"]
CMD ["run"]