From b8e4b859b044935093c0972ef238dd89856b1a17 Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Mon, 20 Apr 2020 01:31:46 -0700 Subject: [PATCH 1/6] Added gosu to image. --- influxdb/1.8/Dockerfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/influxdb/1.8/Dockerfile b/influxdb/1.8/Dockerfile index 5df0d6d38..f85afb3d8 100644 --- a/influxdb/1.8/Dockerfile +++ b/influxdb/1.8/Dockerfile @@ -2,7 +2,7 @@ FROM buildpack-deps:stretch-curl RUN set -ex && \ for key in \ - 05CE15085FC09D18E99EFB22684A14CF2582E0C5 ; \ + 05CE15085FC09D18E99EFB22684A14CF2582E0C5 B42F6819007F00F88E364FD4036A9C25BF357DD4 ; \ do \ gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \ gpg --keyserver pgp.mit.edu --recv-keys "$key" || \ @@ -10,6 +10,7 @@ RUN set -ex && \ done ENV INFLUXDB_VERSION 1.8.0 +ENV GOSU_VERSION 1.12 RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \ case "${dpkgArch##*-}" in \ amd64) ARCH='amd64';; \ @@ -22,7 +23,14 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" && \ wget --no-verbose https://dl.influxdata.com/influxdb/releases/influxdb_${INFLUXDB_VERSION}_${ARCH}.deb && \ gpg --batch --verify influxdb_${INFLUXDB_VERSION}_${ARCH}.deb.asc influxdb_${INFLUXDB_VERSION}_${ARCH}.deb && \ dpkg -i influxdb_${INFLUXDB_VERSION}_${ARCH}.deb && \ - rm -f influxdb_${INFLUXDB_VERSION}_${ARCH}.deb* + rm -f influxdb_${INFLUXDB_VERSION}_${ARCH}.deb* && \ + wget --no-verbose https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${ARCH}.asc && \ + wget --no-verbose https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${ARCH} && \ + gpg --batch --verify gosu-${ARCH}.asc gosu-${ARCH} && \ + rm -f gosu-${ARCH}.asc && \ + mv gosu-${ARCH} /usr/local/bin && \ + chmod +x /usr/local/bin/gosu-${ARCH} && \ + ln -s /usr/local/bin/gosu-${ARCH} /usr/local/bin/gosu COPY influxdb.conf /etc/influxdb/influxdb.conf EXPOSE 8086 From 82d0bdf645521a0462d04ada97bfb8f8856882e0 Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Mon, 20 Apr 2020 09:42:45 -0700 Subject: [PATCH 2/6] Added support for running influxdb as non-root via USER_ID/GROUP_ID env variables. --- influxdb/1.8/entrypoint.sh | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/influxdb/1.8/entrypoint.sh b/influxdb/1.8/entrypoint.sh index 26e6bd7ad..08a18e3ef 100755 --- a/influxdb/1.8/entrypoint.sh +++ b/influxdb/1.8/entrypoint.sh @@ -1,6 +1,30 @@ #!/bin/bash set -e +USER_ID=${USER_ID:-0} +GROUP_ID=${GROUP_ID:-0} + +if [ $USER_ID != 0 ]; then + if [ $USER_ID != $(id -u influxdb) ]; then + echo "Changing uid of influxdb to $USER_ID" + usermod -u $USER_ID influxdb + fi +fi + +if [ $GROUP_ID != 0 ]; then + if [ $GROUP_ID != $(id -g influxdb) ]; then + echo "Changing gid of influxdb to $GROUP_ID" + groupmod -o -g $GROUP_ID influxdb + fi +fi + +if [ $USER_ID != 0 -a $(stat -c "%u" /var/lib/influxdb) != $USER_ID ]; then + echo "Changing ownership of /var/lib/influxdb to $USER_ID:$GROUP_ID" + chown -R ${USER_ID}:${GROUP_ID} /var/lib/influxdb +fi + +echo "Starting influxdb as uid $USER_ID and gid $GROUP_ID" + if [ "${1:0:1}" = '-' ]; then set -- influxd "$@" fi @@ -9,4 +33,4 @@ if [ "$1" = 'influxd' ]; then /init-influxdb.sh "${@:2}" fi -exec "$@" +exec gosu influxdb "$@" From 73f93b8317f24d2626f3d610e829fbc56fe07ec9 Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Mon, 20 Apr 2020 11:43:33 -0700 Subject: [PATCH 3/6] Continue to launch influxdb as root by default --- influxdb/1.8/entrypoint.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/influxdb/1.8/entrypoint.sh b/influxdb/1.8/entrypoint.sh index 08a18e3ef..5a085bfdc 100755 --- a/influxdb/1.8/entrypoint.sh +++ b/influxdb/1.8/entrypoint.sh @@ -33,4 +33,8 @@ if [ "$1" = 'influxd' ]; then /init-influxdb.sh "${@:2}" fi -exec gosu influxdb "$@" +if [ $USER_ID != 0 ]; then + exec gosu influxdb "$@" +else + exec "$@" +fi From 1471fe4b9080c6733e37ef3bfe3e919df0b6fb28 Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Mon, 20 Apr 2020 11:58:49 -0700 Subject: [PATCH 4/6] Adding INFLUXDB_ prefix to uid/gid variables. --- influxdb/1.8/entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/influxdb/1.8/entrypoint.sh b/influxdb/1.8/entrypoint.sh index 5a085bfdc..82d7e62e5 100755 --- a/influxdb/1.8/entrypoint.sh +++ b/influxdb/1.8/entrypoint.sh @@ -1,8 +1,8 @@ #!/bin/bash set -e -USER_ID=${USER_ID:-0} -GROUP_ID=${GROUP_ID:-0} +USER_ID=${INFLUXDB_RUNAS_USER_ID:-0} +GROUP_ID=${INFLUXDB_RUNAS_GROUP_ID:-0} if [ $USER_ID != 0 ]; then if [ $USER_ID != $(id -u influxdb) ]; then From 2a9fffdb28eb41f43abec1a8701d81e48e96c10f Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Mon, 20 Apr 2020 13:21:58 -0700 Subject: [PATCH 5/6] Always update /var/lib/influxdb ownership if a uid/gid is passed in. --- influxdb/1.8/entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/influxdb/1.8/entrypoint.sh b/influxdb/1.8/entrypoint.sh index 82d7e62e5..7e86f52dc 100755 --- a/influxdb/1.8/entrypoint.sh +++ b/influxdb/1.8/entrypoint.sh @@ -18,7 +18,7 @@ if [ $GROUP_ID != 0 ]; then fi fi -if [ $USER_ID != 0 -a $(stat -c "%u" /var/lib/influxdb) != $USER_ID ]; then +if [ $USER_ID != 0 ]; then echo "Changing ownership of /var/lib/influxdb to $USER_ID:$GROUP_ID" chown -R ${USER_ID}:${GROUP_ID} /var/lib/influxdb fi @@ -30,7 +30,7 @@ if [ "${1:0:1}" = '-' ]; then fi if [ "$1" = 'influxd' ]; then - /init-influxdb.sh "${@:2}" + /init-influxdb.sh "${@:2}" fi if [ $USER_ID != 0 ]; then From 1471e4310ed5b796e254425d7aa6b26ef55e623f Mon Sep 17 00:00:00 2001 From: Bruno Kraychete da Costa Date: Fri, 24 Apr 2020 14:37:46 -0700 Subject: [PATCH 6/6] Also run init-influxdb.sh as user, if applicable. --- influxdb/1.8/entrypoint.sh | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/influxdb/1.8/entrypoint.sh b/influxdb/1.8/entrypoint.sh index 7e86f52dc..00422615e 100755 --- a/influxdb/1.8/entrypoint.sh +++ b/influxdb/1.8/entrypoint.sh @@ -23,6 +23,12 @@ if [ $USER_ID != 0 ]; then chown -R ${USER_ID}:${GROUP_ID} /var/lib/influxdb fi +if [ $USER_ID != 0 ]; then + GOSU_CMD="gosu influxdb" +else + GOSU_CMD= +fi + echo "Starting influxdb as uid $USER_ID and gid $GROUP_ID" if [ "${1:0:1}" = '-' ]; then @@ -30,11 +36,7 @@ if [ "${1:0:1}" = '-' ]; then fi if [ "$1" = 'influxd' ]; then - /init-influxdb.sh "${@:2}" + $GOSU_CMD /init-influxdb.sh "${@:2}" fi -if [ $USER_ID != 0 ]; then - exec gosu influxdb "$@" -else - exec "$@" -fi +exec $GOSU_CMD "$@"