diff options
| author |   rajeevme <rajeev.mehta@amdocs.com> | 2019-09-04 22:59:26 +0530 |
|---|---|---|
| committer | rajeevme <rajeev.mehta@amdocs.com> | 2019-09-04 23:01:34 +0530 |
| commit | b725ee2af38389a1618f671bee4732194b0dadcb (patch) | |
| tree | 31f8ab652c45d78dd8660a11b15d56a17db51aa8 | |
| parent | ad589b35655d6569d770267c5b6ccb7289c2e3e1 (diff) | |
[AAI-2174] Run container process as non-root5.1.0-ONAP5.0.2-ONAP5.0.1-ONAPelalto
Issue-ID: AAI-2174
Change-Id: Ie65986b5ba58e6d97c1353cce0374fd6fb40bc40
Signed-off-by: rajeevme <rajeev.mehta@amdocs.com>
Change-Id: I38efff10f79d209ab128483f9aa57acab468c111
| -rw-r--r-- | src/main/bin/start.sh | 26 | ||||
| -rw-r--r-- | src/main/docker/Dockerfile | 27 |
2 files changed, 52 insertions, 1 deletions
diff --git a/src/main/bin/start.sh b/src/main/bin/start.sh index f4707ad..2d8f100 100644 --- a/src/main/bin/start.sh +++ b/src/main/bin/start.sh @@ -38,6 +38,30 @@ if [ -z "${KEY_STORE_PASSWORD}" ]; then exit 1 fi +# Changes related to:AAI-2174 +# Change aai babel container processes to run as non-root on the host +USER_ID=${LOCAL_USER_ID:-9001} +GROUP_ID=${LOCAL_GROUP_ID:-9001} + +if [ $(cat /etc/passwd | grep aaiadmin | wc -l) -eq 0 ]; then + + groupadd aaiadmin -g ${GROUP_ID} || { + echo "Unable to create the group id for ${GROUP_ID}"; + exit 1; + } + useradd --shell=/bin/bash -u ${USER_ID} -g ${GROUP_ID} -o -c "" -m aaiadmin || { + echo "Unable to create the user id for ${USER_ID}"; + exit 1; + } +fi; + +chown -R aaiadmin:aaiadmin ${APP_HOME} +find ${APP_HOME} -name "*.sh" -exec chmod +x {} + + +gosu aaiadmin ln -s /logs $MICRO_HOME/logs + +JAVA_CMD="exec gosu aaiadmin java"; +### PROPS="-DAPP_HOME=${APP_HOME}" PROPS="${PROPS} -DCONFIG_HOME=${CONFIG_HOME}" PROPS="${PROPS} -Dtosca.mappings.config=${CONFIG_HOME}/tosca-mappings.json" @@ -50,4 +74,4 @@ JVM_MAX_HEAP=${MAX_HEAP:-1024} JARFILE=$(ls ./babel*.jar); -exec java -Xmx${JVM_MAX_HEAP}m ${PROPS} -jar ${APP_HOME}/${JARFILE} +${JAVA_CMD} -Xmx${JVM_MAX_HEAP}m ${PROPS} -jar ${APP_HOME}/${JARFILE} diff --git a/src/main/docker/Dockerfile b/src/main/docker/Dockerfile index 03917f7..242a9da 100644 --- a/src/main/docker/Dockerfile +++ b/src/main/docker/Dockerfile @@ -2,6 +2,33 @@ FROM @aai.docker.namespace@/aai-common-@aai.base.image@:@aai.base.image.version@ ARG MICRO_HOME=/opt/app/babel +# Additional optional steps for Ubuntu +RUN if ((uname -v | grep -i "ubuntu") || ( cat /etc/*release|grep -i "ubuntu") ) ; then \ + ##################################### + #if JAVA doesnt exist then install it: + ###################################### + if type java 2>/dev/null; then \ + echo "skipping java installation"; \ + else \ + apt-get update && apt-get install -y software-properties-common; \ + ## sudo -E is required to preserve the environment. If you remove that line, it will most like freeze at this step + sudo -E add-apt-repository ppa:openjdk-r/ppa && apt-get update && apt-get install -y openjdk-8-jdk ; \ + ## Setup JAVA_HOME, this is useful for docker commandline + JAVA_HOME=usr/lib/jvm/java-8-openjdk-amd64; \ + export JAVA_HOME ; \ + fi; \ + ########################################## + #Install gosu if not present + ########################################## + if type gosu 2>/dev/null; then \ + echo "skipping gosu installation"; \ + else \ + set -x ; \ + add-apt-repository -y ppa:tianon/gosu; \ + sudo apt-get update; \ + sudo apt-get install gosu; \ + fi;\ +fi # Build up the deployment folder structure RUN mkdir -p $MICRO_HOME WORKDIR $MICRO_HOME |