Skip to content

Commit 46fac91

Browse files
kaluzkikaluzki
committed
restore gosu suid bit when supervisor container stops
* webdevops/Dockerfile#387
1 parent 7ff76d6 commit 46fac91

File tree

5 files changed

+173
-32
lines changed

5 files changed

+173
-32
lines changed

‎src/opt/docker/bin/config.sh

+126
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#!/usr/bin/env bash
2+
3+
shopt -s nullglob
4+
5+
###
6+
# Check if current user is root
7+
#
8+
##
9+
function rootCheck() {
10+
# Root check
11+
if [ "$(/usr/bin/whoami)" != "root" ]; then
12+
echo "[ERROR] $* must be run as root"
13+
exit 1
14+
fi
15+
}
16+
17+
###
18+
# Create /docker.stdout and /docker.stderr
19+
#
20+
##
21+
function createDockerStdoutStderr() {
22+
# link stdout from docker
23+
if [[ -n "$LOG_STDOUT" ]]; then
24+
echo "Log stdout redirected to $LOG_STDOUT"
25+
else
26+
LOG_STDOUT="/proc/$$/fd/1"
27+
fi
28+
29+
if [[ -n "$LOG_STDERR" ]]; then
30+
echo "Log stderr redirected to $LOG_STDERR"
31+
else
32+
LOG_STDERR="/proc/$$/fd/2"
33+
fi
34+
35+
ln -f -s "$LOG_STDOUT" /docker.stdout
36+
ln -f -s "$LOG_STDERR" /docker.stderr
37+
}
38+
###
39+
# Include script directory text inside a file
40+
#
41+
# $1 -> path
42+
#
43+
##
44+
function includeScriptDir() {
45+
if [[ -d "$1" ]]; then
46+
for FILE in "$1"/*.sh; do
47+
echo "-> Executing ${FILE}"
48+
# run custom scripts, only once
49+
. "$FILE"
50+
done
51+
fi
52+
}
53+
54+
###
55+
# Show deprecation notice
56+
#
57+
##
58+
function deprecationNotice() {
59+
echo ""
60+
echo "###############################################################################"
61+
echo "### THIS CALL IS DEPRECATED AND WILL BE REMOVED IN THE FUTURE"
62+
echo "###"
63+
echo "### $*"
64+
echo "###"
65+
echo "###############################################################################"
66+
echo ""
67+
}
68+
69+
###
70+
# Run "entrypoint" scripts
71+
#
72+
##
73+
function runEntrypoints() {
74+
# try to find entrypoint task script
75+
ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
76+
if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
77+
# use default
78+
ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
79+
fi
80+
81+
if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
82+
exit 1
83+
fi
84+
85+
. "$ENTRYPOINT_SCRIPT"
86+
}
87+
88+
###
89+
# Run "entrypoint" provisioning
90+
#
91+
##
92+
function runProvisionEntrypoint() {
93+
includeScriptDir "/opt/docker/provision/entrypoint.d"
94+
includeScriptDir "/entrypoint.d"
95+
}
96+
97+
###
98+
# https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
99+
# https://hynek.me/articles/docker-signals/
100+
#
101+
##
102+
function runTeardownEntrypoint() {
103+
echo "Container stopped, performing teardown..."
104+
includeScriptDir "/opt/docker/provision/entrypoint.d/teardown"
105+
includeScriptDir "/entrypoint.d/teardown"
106+
}
107+
108+
###
109+
# List environment variables (based on prefix)
110+
#
111+
##
112+
function envListVars() {
113+
if [[ $# -eq 1 ]]; then
114+
env | grep "^${1}" | cut -d= -f1
115+
else
116+
env | cut -d= -f1
117+
fi
118+
}
119+
120+
###
121+
# Get environment variable (even with dots in name)
122+
#
123+
##
124+
function envGetValue() {
125+
awk "BEGIN {print ENVIRON[\"$1\"]}"
126+
}

‎src/opt/docker/bin/entrypoint.d/cli.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bash
2+
3+
#############################################
4+
## Run CLI_SCRIPT from environment variable
5+
#############################################
6+
7+
if [ -n "${CLI_SCRIPT}" ]; then
8+
if [ -n "${CONTAINER_UID}" ]; then
9+
# Run as EFFECTIVE_USER
10+
shift
11+
exec gosu "${CONTAINER_UID}" "${CLI_SCRIPT}" "$@"
12+
else
13+
# Run as root
14+
exec "${CLI_SCRIPT}" "$@"
15+
fi
16+
else
17+
echo "[ERROR] No CLI_SCRIPT in in docker environment defined"
18+
exit 1
19+
fi

‎src/opt/docker/bin/entrypoint.sh

+20-32
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,35 @@
11
#!/usr/bin/env bash
22

33
if [[ -z "$CONTAINER_UID" ]]; then
4-
export CONTAINER_UID=$APPLICATION_UID
4+
export CONTAINER_UID=1000
55
fi
66

7-
set -o pipefail # trace ERR through pipes
8-
set -o errtrace # trace ERR through 'time command' and other functions
9-
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10-
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
7+
set -o pipefail # trace ERR through pipes
8+
set -o errtrace # trace ERR through 'time command' and other functions
9+
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
10+
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
1111

1212
# auto elevate privileges (if container is not started as root)
1313
if [[ "$UID" -ne 0 ]]; then
1414
export CONTAINER_UID="$UID"
1515
exec gosu root "$0" "$@"
1616
fi
1717

18-
# remove suid bit on gosu
19-
# chmod -s /sbin/gosu
20-
21-
trap 'echo sigterm ; exit' SIGTERM
22-
trap 'echo sigkill ; exit' SIGKILL
23-
24-
# sanitize input and set task
25-
TASK="$(echo $1| sed 's/[^-_a-zA-Z0-9]*//g')"
26-
27-
source /opt/docker/bin/config.sh
28-
18+
. /opt/docker/bin/config.sh
2919
createDockerStdoutStderr
3020

31-
if [[ "$UID" -eq 0 ]]; then
32-
# Only run provision if user is root
33-
34-
if [ "$TASK" == "supervisord" -o "$TASK" == "noop" ]; then
35-
# Visible provisioning
36-
runProvisionEntrypoint
37-
else
38-
# Hidden provisioning
39-
runProvisionEntrypoint > /dev/null
40-
fi
21+
# sanitize input and set task
22+
TASK="$(echo $1 | sed 's/[^-_a-zA-Z0-9]*//g')"
23+
24+
if [ "$TASK" == "supervisord" ] || [ "$TASK" == "noop" ]; then
25+
# visible provisioning
26+
runProvisionEntrypoint
27+
trap 'runTeardownEntrypoint' SIGTERM
28+
runEntrypoints "$@" &
29+
wait $!
30+
runTeardownEntrypoint
31+
else
32+
# hidden provisioning
33+
runProvisionEntrypoint > /dev/null
34+
runEntrypoints "$@"
4135
fi
42-
43-
#############################
44-
## COMMAND
45-
#############################
46-
47-
runEntrypoints "$@"

‎src/opt/docker/provision/entrypoint.d/05-gosu.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
3+
# remove suid bit
4+
chmod -s /sbin/gosu

‎src/opt/docker/provision/entrypoint.d/teardown/05-gosu.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
3+
# add suid bit
4+
chmod +s /sbin/gosu

0 commit comments

Comments
 (0)