Skip to content

Commit 645261f

Browse files
yosifkityosifkit
authored
Merge pull request #136 from infosiftr/any-user
Allow arbitrary --user values
2 parents 2f7ac3a + a3845e0 commit 645261f

File tree

9 files changed

+438
-375
lines changed

9 files changed

+438
-375
lines changed

‎3.3/Dockerfile

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,11 @@ RUN wget -O redmine.tar.gz "https://www.redmine.org/releases/redmine-${REDMINE_V
7474
&& echo "$REDMINE_DOWNLOAD_MD5 redmine.tar.gz" | md5sum -c - \
7575
&& tar -xvf redmine.tar.gz --strip-components=1 \
7676
&& rm redmine.tar.gz files/delete.me log/delete.me \
77-
&& mkdir -p tmp/pdf public/plugin_assets \
78-
&& chown -R redmine:redmine ./
77+
&& mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids \
78+
&& chown -R redmine:redmine ./ \
79+
# fix permissions for running as an arbitrary user
80+
&& chmod -R ugo=rwX config db sqlite \
81+
&& find log tmp -type d -exec chmod 1777 '{}' +
7982

8083
RUN set -eux; \
8184
\
@@ -120,6 +123,8 @@ RUN set -eux; \
120123
cp Gemfile.lock "Gemfile.lock.${adapter}"; \
121124
done; \
122125
rm ./config/database.yml; \
126+
# fix permissions for running as an arbitrary user
127+
chmod ugo=rwX Gemfile.lock; \
123128
\
124129
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
125130
apt-mark auto '.*' > /dev/null; \

‎3.3/docker-entrypoint.sh

Lines changed: 136 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
#!/bin/bash
2-
set -e
1+
#!/usr/bin/env bash
2+
set -Eeo pipefail
3+
# TODO add "-u"
34

45
# usage: file_env VAR [DEFAULT]
56
# ie: file_env 'XYZ_DB_PASSWORD' 'example'
@@ -23,131 +24,143 @@ file_env() {
2324
unset "$fileVar"
2425
}
2526

27+
isLikelyRedmine=
2628
case "$1" in
27-
rails|rake|passenger)
28-
if [ ! -f './config/database.yml' ]; then
29-
file_env 'REDMINE_DB_MYSQL'
30-
file_env 'REDMINE_DB_POSTGRES'
31-
file_env 'REDMINE_DB_SQLSERVER'
32-
33-
if [ "$MYSQL_PORT_3306_TCP" ] && [ -z "$REDMINE_DB_MYSQL" ]; then
34-
export REDMINE_DB_MYSQL='mysql'
35-
elif [ "$POSTGRES_PORT_5432_TCP" ] && [ -z "$REDMINE_DB_POSTGRES" ]; then
36-
export REDMINE_DB_POSTGRES='postgres'
37-
fi
38-
39-
if [ "$REDMINE_DB_MYSQL" ]; then
40-
adapter='mysql2'
41-
host="$REDMINE_DB_MYSQL"
42-
file_env 'REDMINE_DB_PORT' '3306'
43-
file_env 'REDMINE_DB_USERNAME' "${MYSQL_ENV_MYSQL_USER:-root}"
44-
file_env 'REDMINE_DB_PASSWORD' "${MYSQL_ENV_MYSQL_PASSWORD:-${MYSQL_ENV_MYSQL_ROOT_PASSWORD:-}}"
45-
file_env 'REDMINE_DB_DATABASE' "${MYSQL_ENV_MYSQL_DATABASE:-${MYSQL_ENV_MYSQL_USER:-redmine}}"
46-
file_env 'REDMINE_DB_ENCODING' ''
47-
elif [ "$REDMINE_DB_POSTGRES" ]; then
48-
adapter='postgresql'
49-
host="$REDMINE_DB_POSTGRES"
50-
file_env 'REDMINE_DB_PORT' '5432'
51-
file_env 'REDMINE_DB_USERNAME' "${POSTGRES_ENV_POSTGRES_USER:-postgres}"
52-
file_env 'REDMINE_DB_PASSWORD' "${POSTGRES_ENV_POSTGRES_PASSWORD}"
53-
file_env 'REDMINE_DB_DATABASE' "${POSTGRES_ENV_POSTGRES_DB:-${REDMINE_DB_USERNAME:-}}"
54-
file_env 'REDMINE_DB_ENCODING' 'utf8'
55-
elif [ "$REDMINE_DB_SQLSERVER" ]; then
56-
adapter='sqlserver'
57-
host="$REDMINE_DB_SQLSERVER"
58-
file_env 'REDMINE_DB_PORT' '1433'
59-
file_env 'REDMINE_DB_USERNAME' ''
60-
file_env 'REDMINE_DB_PASSWORD' ''
61-
file_env 'REDMINE_DB_DATABASE' ''
62-
file_env 'REDMINE_DB_ENCODING' ''
63-
else
64-
echo >&2
65-
echo >&2 'warning: missing REDMINE_DB_MYSQL, REDMINE_DB_POSTGRES, or REDMINE_DB_SQLSERVER environment variables'
66-
echo >&2
67-
echo >&2 '*** Using sqlite3 as fallback. ***'
68-
echo >&2
69-
70-
adapter='sqlite3'
71-
host='localhost'
72-
file_env 'REDMINE_DB_PORT' ''
73-
file_env 'REDMINE_DB_USERNAME' 'redmine'
74-
file_env 'REDMINE_DB_PASSWORD' ''
75-
file_env 'REDMINE_DB_DATABASE' 'sqlite/redmine.db'
76-
file_env 'REDMINE_DB_ENCODING' 'utf8'
77-
78-
mkdir -p "$(dirname "$REDMINE_DB_DATABASE")"
79-
find "$(dirname "$REDMINE_DB_DATABASE")" \! -user redmine -exec chown redmine '{}' +
80-
fi
81-
82-
REDMINE_DB_ADAPTER="$adapter"
83-
REDMINE_DB_HOST="$host"
84-
echo "$RAILS_ENV:" > config/database.yml
85-
for var in \
86-
adapter \
87-
host \
88-
port \
89-
username \
90-
password \
91-
database \
92-
encoding \
93-
; do
94-
env="REDMINE_DB_${var^^}"
95-
val="${!env}"
96-
[ -n "$val" ] || continue
97-
echo " $var: \"$val\"" >> config/database.yml
98-
done
99-
else
100-
# parse the database config to get the database adapter name
101-
# so we can use the right Gemfile.lock
102-
adapter="$(
103-
ruby -e "
104-
require 'yaml'
105-
conf = YAML.load_file('./config/database.yml')
106-
puts conf['$RAILS_ENV']['adapter']
107-
"
108-
)"
29+
rails | rake | passenger ) isLikelyRedmine=1 ;;
30+
esac
31+
32+
_fix_permissions() {
33+
# https://www.redmine.org/projects/redmine/wiki/RedmineInstall#Step-8-File-system-permissions
34+
if [ "$(id -u)" = '0' ]; then
35+
find config files log public/plugin_assets \! -user redmine -exec chown redmine:redmine '{}' +
36+
fi
37+
# directories 755, files 644:
38+
find config files log public/plugin_assets tmp -type d \! -perm 755 -exec chmod 755 '{}' + 2>/dev/null || :
39+
find config files log public/plugin_assets tmp -type f \! -perm 644 -exec chmod 644 '{}' + 2>/dev/null || :
40+
}
41+
42+
# allow the container to be started with `--user`
43+
if [ -n "$isLikelyRedmine" ] && [ "$(id -u)" = '0' ]; then
44+
_fix_permissions
45+
exec gosu redmine "$BASH_SOURCE" "$@"
46+
fi
47+
48+
if [ -n "$isLikelyRedmine" ]; then
49+
_fix_permissions
50+
if [ ! -f './config/database.yml' ]; then
51+
file_env 'REDMINE_DB_MYSQL'
52+
file_env 'REDMINE_DB_POSTGRES'
53+
file_env 'REDMINE_DB_SQLSERVER'
54+
55+
if [ "$MYSQL_PORT_3306_TCP" ] && [ -z "$REDMINE_DB_MYSQL" ]; then
56+
export REDMINE_DB_MYSQL='mysql'
57+
elif [ "$POSTGRES_PORT_5432_TCP" ] && [ -z "$REDMINE_DB_POSTGRES" ]; then
58+
export REDMINE_DB_POSTGRES='postgres'
10959
fi
110-
111-
# ensure the right database adapter is active in the Gemfile.lock
112-
cp "Gemfile.lock.${adapter}" Gemfile.lock
113-
# install additional gems for Gemfile.local and plugins
114-
bundle check || bundle install --without development test
115-
116-
if [ ! -s config/secrets.yml ]; then
117-
file_env 'REDMINE_SECRET_KEY_BASE'
118-
if [ "$REDMINE_SECRET_KEY_BASE" ]; then
119-
cat > 'config/secrets.yml' <<-YML
120-
$RAILS_ENV:
121-
secret_key_base: "$REDMINE_SECRET_KEY_BASE"
122-
YML
123-
elif [ ! -f /usr/src/redmine/config/initializers/secret_token.rb ]; then
124-
rake generate_secret_token
60+
61+
if [ "$REDMINE_DB_MYSQL" ]; then
62+
adapter='mysql2'
63+
host="$REDMINE_DB_MYSQL"
64+
file_env 'REDMINE_DB_PORT' '3306'
65+
file_env 'REDMINE_DB_USERNAME' "${MYSQL_ENV_MYSQL_USER:-root}"
66+
file_env 'REDMINE_DB_PASSWORD' "${MYSQL_ENV_MYSQL_PASSWORD:-${MYSQL_ENV_MYSQL_ROOT_PASSWORD:-}}"
67+
file_env 'REDMINE_DB_DATABASE' "${MYSQL_ENV_MYSQL_DATABASE:-${MYSQL_ENV_MYSQL_USER:-redmine}}"
68+
file_env 'REDMINE_DB_ENCODING' ''
69+
elif [ "$REDMINE_DB_POSTGRES" ]; then
70+
adapter='postgresql'
71+
host="$REDMINE_DB_POSTGRES"
72+
file_env 'REDMINE_DB_PORT' '5432'
73+
file_env 'REDMINE_DB_USERNAME' "${POSTGRES_ENV_POSTGRES_USER:-postgres}"
74+
file_env 'REDMINE_DB_PASSWORD' "${POSTGRES_ENV_POSTGRES_PASSWORD}"
75+
file_env 'REDMINE_DB_DATABASE' "${POSTGRES_ENV_POSTGRES_DB:-${REDMINE_DB_USERNAME:-}}"
76+
file_env 'REDMINE_DB_ENCODING' 'utf8'
77+
elif [ "$REDMINE_DB_SQLSERVER" ]; then
78+
adapter='sqlserver'
79+
host="$REDMINE_DB_SQLSERVER"
80+
file_env 'REDMINE_DB_PORT' '1433'
81+
file_env 'REDMINE_DB_USERNAME' ''
82+
file_env 'REDMINE_DB_PASSWORD' ''
83+
file_env 'REDMINE_DB_DATABASE' ''
84+
file_env 'REDMINE_DB_ENCODING' ''
85+
else
86+
echo >&2
87+
echo >&2 'warning: missing REDMINE_DB_MYSQL, REDMINE_DB_POSTGRES, or REDMINE_DB_SQLSERVER environment variables'
88+
echo >&2
89+
echo >&2 '*** Using sqlite3 as fallback. ***'
90+
echo >&2
91+
92+
adapter='sqlite3'
93+
host='localhost'
94+
file_env 'REDMINE_DB_PORT' ''
95+
file_env 'REDMINE_DB_USERNAME' 'redmine'
96+
file_env 'REDMINE_DB_PASSWORD' ''
97+
file_env 'REDMINE_DB_DATABASE' 'sqlite/redmine.db'
98+
file_env 'REDMINE_DB_ENCODING' 'utf8'
99+
100+
mkdir -p "$(dirname "$REDMINE_DB_DATABASE")"
101+
if [ "$(id -u)" = '0' ]; then
102+
find "$(dirname "$REDMINE_DB_DATABASE")" \! -user redmine -exec chown redmine '{}' +
125103
fi
126104
fi
127-
if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
128-
gosu redmine rake db:migrate
129-
fi
130-
131-
# https://www.redmine.org/projects/redmine/wiki/RedmineInstall#Step-8-File-system-permissions
132-
find files log public/plugin_assets \! -user redmine -exec chown redmine:redmine '{}' +
133-
# directories 755, files 644:
134-
find files log tmp public/plugin_assets -type d \! -perm 755 -exec chmod 755 '{}' +
135-
find files log tmp public/plugin_assets -type f \! -perm 644 -exec chmod 644 '{}' +
136-
137-
if [ "$1" != 'rake' -a -n "$REDMINE_PLUGINS_MIGRATE" ]; then
138-
gosu redmine rake redmine:plugins:migrate
139-
fi
140-
141-
# remove PID file to enable restarting the container
142-
rm -f /usr/src/redmine/tmp/pids/server.pid
143-
144-
if [ "$1" = 'passenger' ]; then
145-
# Don't fear the reaper.
146-
set -- tini -- "$@"
105+
106+
REDMINE_DB_ADAPTER="$adapter"
107+
REDMINE_DB_HOST="$host"
108+
echo "$RAILS_ENV:" > config/database.yml
109+
for var in \
110+
adapter \
111+
host \
112+
port \
113+
username \
114+
password \
115+
database \
116+
encoding \
117+
; do
118+
env="REDMINE_DB_${var^^}"
119+
val="${!env}"
120+
[ -n "$val" ] || continue
121+
echo " $var: \"$val\"" >> config/database.yml
122+
done
123+
else
124+
# parse the database config to get the database adapter name
125+
# so we can use the right Gemfile.lock
126+
adapter="$(ruby -e "
127+
require 'yaml'
128+
conf = YAML.load_file('./config/database.yml')
129+
puts conf['$RAILS_ENV']['adapter']
130+
")"
131+
fi
132+
133+
# ensure the right database adapter is active in the Gemfile.lock
134+
cp "Gemfile.lock.${adapter}" Gemfile.lock
135+
# install additional gems for Gemfile.local and plugins
136+
bundle check || bundle install --without development test
137+
138+
if [ ! -s config/secrets.yml ]; then
139+
file_env 'REDMINE_SECRET_KEY_BASE'
140+
if [ -n "$REDMINE_SECRET_KEY_BASE" ]; then
141+
cat > 'config/secrets.yml' <<-YML
142+
$RAILS_ENV:
143+
secret_key_base: "$REDMINE_SECRET_KEY_BASE"
144+
YML
145+
elif [ ! -f config/initializers/secret_token.rb ]; then
146+
rake generate_secret_token
147147
fi
148-
149-
set -- gosu redmine "$@"
150-
;;
151-
esac
148+
fi
149+
if [ "$1" != 'rake' -a -z "$REDMINE_NO_DB_MIGRATE" ]; then
150+
rake db:migrate
151+
fi
152+
153+
if [ "$1" != 'rake' -a -n "$REDMINE_PLUGINS_MIGRATE" ]; then
154+
rake redmine:plugins:migrate
155+
fi
156+
157+
# remove PID file to enable restarting the container
158+
rm -f tmp/pids/server.pid
159+
160+
if [ "$1" = 'passenger' ]; then
161+
# Don't fear the reaper.
162+
set -- tini -- "$@"
163+
fi
164+
fi
152165

153166
exec "$@"

‎3.3/passenger/Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,7 @@ RUN set -eux; \
2727
passenger-config install-agent; \
2828
passenger-config download-nginx-engine
2929

30+
# adjust Passenger to write the PID to the same file as "rails server"
31+
ENV PASSENGER_PID_FILE tmp/pids/server.pid
32+
3033
CMD ["passenger", "start"]

‎3.4/Dockerfile

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,11 @@ RUN wget -O redmine.tar.gz "https://www.redmine.org/releases/redmine-${REDMINE_V
7474
&& echo "$REDMINE_DOWNLOAD_MD5 redmine.tar.gz" | md5sum -c - \
7575
&& tar -xvf redmine.tar.gz --strip-components=1 \
7676
&& rm redmine.tar.gz files/delete.me log/delete.me \
77-
&& mkdir -p tmp/pdf public/plugin_assets \
78-
&& chown -R redmine:redmine ./
77+
&& mkdir -p log public/plugin_assets sqlite tmp/pdf tmp/pids \
78+
&& chown -R redmine:redmine ./ \
79+
# fix permissions for running as an arbitrary user
80+
&& chmod -R ugo=rwX config db sqlite \
81+
&& find log tmp -type d -exec chmod 1777 '{}' +
7982

8083
RUN set -eux; \
8184
\
@@ -120,6 +123,8 @@ RUN set -eux; \
120123
cp Gemfile.lock "Gemfile.lock.${adapter}"; \
121124
done; \
122125
rm ./config/database.yml; \
126+
# fix permissions for running as an arbitrary user
127+
chmod ugo=rwX Gemfile.lock; \
123128
\
124129
# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
125130
apt-mark auto '.*' > /dev/null; \

0 commit comments

Comments
 (0)