Skip to content

build: run as any user #3646

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

build: run as any user #3646

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c51755
build: run as any user
leafty Apr 15, 2025
51d4984
fix HC
leafty Apr 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 32 additions & 23 deletions client/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
# syntax=docker/dockerfile:1
FROM node:22 AS builder

RUN apt-get update && apt-get upgrade --quiet --assume-yes
RUN <<EOT bash
set -ex
apt-get update
apt-get upgrade --quiet --assume-yes
EOT

WORKDIR /app

Expand All @@ -22,38 +27,42 @@ RUN npm run storybook-build -- -o storybook-static

FROM nginxinc/nginx-unprivileged:1.27-alpine

COPY --from=builder /app/build /usr/share/nginx/html
COPY --from=builder /app/storybook-static /usr/share/nginx/html/storybook
COPY nginx.vh.default.conf /etc/nginx/conf.d/default.conf
COPY docker-entrypoint.sh /app/docker-entrypoint.sh
COPY scripts/generate_sitemap.sh /app/scripts/generate_sitemap.sh
COPY --from=builder --chown=root:root /app/build /usr/share/nginx/html
COPY --from=builder --chown=root:root /app/storybook-static /usr/share/nginx/html/storybook
COPY --chown=nginx:root nginx.vh.default.conf /etc/nginx/conf.d/default.conf
COPY --chown=root:root --chmod=755 docker-entrypoint.sh /app/docker-entrypoint.sh
COPY --chown=root:root --chmod=755 scripts/generate_sitemap.sh /app/scripts/generate_sitemap.sh

# Set up the config files written by docker-entrypoint
USER root
RUN touch /usr/share/nginx/html/config.json
RUN chmod a+r /usr/share/nginx/html/config.json
RUN chown nginx /usr/share/nginx/html/config.json

RUN touch /usr/share/nginx/html/robots.txt
RUN chmod a+r /usr/share/nginx/html/robots.txt
RUN chown nginx /usr/share/nginx/html/robots.txt
RUN <<EOT ash
set -ex

RUN touch /usr/share/nginx/html/sitemap.xml
RUN chmod a+r /usr/share/nginx/html/sitemap.xml
RUN chown nginx /usr/share/nginx/html/sitemap.xml
touch /usr/share/nginx/html/config.json
chown nginx:root /usr/share/nginx/html/config.json
chmod a+rw /usr/share/nginx/html/config.json

RUN touch /usr/share/nginx/html/privacy-statement.md
RUN chmod a+r /usr/share/nginx/html/privacy-statement.md
RUN chown nginx /usr/share/nginx/html/privacy-statement.md
touch /usr/share/nginx/html/robots.txt
chown nginx:root /usr/share/nginx/html/robots.txt
chmod a+rw /usr/share/nginx/html/robots.txt

RUN touch /usr/share/nginx/html/terms-of-use.md
RUN chmod a+r /usr/share/nginx/html/terms-of-use.md
RUN chown nginx /usr/share/nginx/html/terms-of-use.md
touch /usr/share/nginx/html/sitemap.xml
chown nginx:root /usr/share/nginx/html/sitemap.xml
chmod a+rw /usr/share/nginx/html/sitemap.xml

USER nginx
touch /usr/share/nginx/html/privacy-statement.md
chown nginx:root /usr/share/nginx/html/privacy-statement.md
chmod a+rw /usr/share/nginx/html/privacy-statement.md

touch /usr/share/nginx/html/terms-of-use.md
chown nginx:root /usr/share/nginx/html/terms-of-use.md
chmod a+rw /usr/share/nginx/html/terms-of-use.md
EOT

USER nginx

HEALTHCHECK --interval=20s --timeout=10s --retries=5 CMD test -e /var/run/nginx.pid
HEALTHCHECK --interval=20s --timeout=10s --retries=5 CMD test -e /tmp/nginx.pid

ARG SHORT_SHA
ENV RENKU_UI_SHORT_SHA=$SHORT_SHA
Expand Down
6 changes: 6 additions & 0 deletions client/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,4 +113,10 @@ else
echo "No terms-of-use.md"
fi

chmod 644 /usr/share/nginx/html/config.json
chmod 644 /usr/share/nginx/html/robots.txt
chmod 644 /usr/share/nginx/html/sitemap.xml
chmod 644 /usr/share/nginx/html/privacy-statement.md
chmod 644 /usr/share/nginx/html/terms-of-use.md

exec -- "$@"
Loading