From fc49a34e3194112064fcd8a285bc2e032ac9995f Mon Sep 17 00:00:00 2001 From: rajeevme Date: Wed, 11 Sep 2019 00:18:03 +0530 Subject: [AAI-2178] Run container process as non-root Issue-ID: AAI-2178 Change-Id: I27ef1334c4fae1c564d4ee62bdd991f9ff2a559a Signed-off-by: rajeevme --- src/main/bin/start.sh | 27 ++++++++++++++++++++++++++- src/main/docker/Dockerfile | 27 +++++++++++++++++++++++++++ 2 files changed, 53 insertions(+), 1 deletion(-) diff --git a/src/main/bin/start.sh b/src/main/bin/start.sh index 1dedb25..c618cd6 100644 --- a/src/main/bin/start.sh +++ b/src/main/bin/start.sh @@ -37,6 +37,31 @@ if [ -z "$CONFIG_HOME" ]; then exit 1 fi +# Changes related to:AAI-2178 +# Change aai model-loader container processes to run as non-root on the host +USER_ID=${LOCAL_USER_ID:-9001} +GROUP_ID=${LOCAL_GROUP_ID:-9001} +ML_LOGS=/var/log/onap/AAI-ML + +if [ $(cat /etc/passwd | grep aaiadmin | wc -l) -eq 0 ]; then + + groupadd aaiadmin -g ${GROUP_ID} || { + echo "Unable to create the group id for ${GROUP_ID}"; + exit 1; + } + useradd --shell=/bin/bash -u ${USER_ID} -g ${GROUP_ID} -o -c "" -m aaiadmin || { + echo "Unable to create the user id for ${USER_ID}"; + exit 1; + } +fi; +chown -R aaiadmin:aaiadmin ${MICRO_HOME} +chown -R aaiadmin:aaiadmin ${AJSC_HOME} +chown -R aaiadmin:aaiadmin ${ML_LOGS} +find ${MICRO_HOME} -name "*.sh" -exec chmod +x {} + + +gosu aaiadmin ln -s /logs $MICRO_HOME/logs +JAVA_CMD="exec gosu aaiadmin java"; +### # Some properties are repeated here for debugging purposes. PROPS="-DAJSC_HOME=$AJSC_HOME" PROPS="$PROPS -DCONFIG_HOME=$CONFIG_HOME" @@ -60,4 +85,4 @@ fi JARFILE=$(ls ./model-loader*.jar); echo "java $java_runtime_arguments $PROPS -jar $JARFILE" -java $java_runtime_arguments $PROPS -jar $JARFILE +${JAVA_CMD} $java_runtime_arguments $PROPS -jar $JARFILE diff --git a/src/main/docker/Dockerfile b/src/main/docker/Dockerfile index a523778..435a169 100644 --- a/src/main/docker/Dockerfile +++ b/src/main/docker/Dockerfile @@ -2,6 +2,33 @@ FROM @aai.docker.namespace@/aai-common-@aai.base.image@:@aai.base.image.version@ ARG MICRO_HOME=/opt/app/model-loader +# Additional optional steps for Ubuntu +RUN if ((uname -v | grep -i "ubuntu") || ( cat /etc/*release|grep -i "ubuntu") ) ; then \ + ##################################### + #if JAVA doesnt exist then install it: + ###################################### + if type java 2>/dev/null; then \ + echo "skipping java installation"; \ + else \ + apt-get update && apt-get install -y software-properties-common; \ + ## sudo -E is required to preserve the environment. If you remove that line, it will most like freeze at this step + sudo -E add-apt-repository ppa:openjdk-r/ppa && apt-get update && apt-get install -y openjdk-8-jdk ; \ + ## Setup JAVA_HOME, this is useful for docker commandline + JAVA_HOME=usr/lib/jvm/java-8-openjdk-amd64; \ + export JAVA_HOME ; \ + fi; \ + ########################################## + #Install gosu if not present + ########################################## + if type gosu 2>/dev/null; then \ + echo "skipping gosu installation"; \ + else \ + set -x ; \ + add-apt-repository -y ppa:tianon/gosu; \ + sudo apt-get update; \ + sudo apt-get install gosu; \ + fi;\ +fi # Build up the deployment folder structure RUN mkdir -p $MICRO_HOME WORKDIR $MICRO_HOME -- cgit 1.2.3-korg