diff options
| author |   wr148d <wr148d@att.com> | 2020-06-01 14:03:35 -0400 |
|---|---|---|
| committer | wr148d <wr148d@att.com> | 2020-06-01 14:05:57 -0400 |
| commit | e1ca97f1cff72a7ad1b7fe838a3f15a3930d11ae (patch) | |
| tree | 50bdf2ec3ddd868e799a95c1340feb3b6b86581f | |
| parent | 05dd335456cd6dcd535afc33e68ccaedb8ed07ad (diff) | |
Containers should not run as root by default
Issue-ID: AAI-2822
Signed-off-by: wr148d <wr148d@att.com>
Change-Id: I4ddab6247bc8b4a44d62023b4fec0c579838f9ed
| -rw-r--r-- | src/main/bin/start.sh | 22 | ||||
| -rw-r--r-- | src/main/docker/Dockerfile | 25 |
2 files changed, 13 insertions, 34 deletions
diff --git a/src/main/bin/start.sh b/src/main/bin/start.sh index b9c49c2..2c4ae67 100644 --- a/src/main/bin/start.sh +++ b/src/main/bin/start.sh @@ -14,29 +14,9 @@ if [ -z "$KEY_STORE_PASSWORD" ]; then exit 1 fi -# Changes related to:AAI-2176 -# Change aai datarouter container processes to run as non-root on the host -USER_ID=${LOCAL_USER_ID:-9001} -GROUP_ID=${LOCAL_GROUP_ID:-9001} -DR_LOGS=/var/log/onap/AAI-DR - -if [ $(cat /etc/passwd | grep aaiadmin | wc -l) -eq 0 ]; then - - groupadd aaiadmin -g ${GROUP_ID} || { - echo "Unable to create the group id for ${GROUP_ID}"; - exit 1; - } - useradd --shell=/bin/bash -u ${USER_ID} -g ${GROUP_ID} -o -c "" -m aaiadmin || { - echo "Unable to create the user id for ${USER_ID}"; - exit 1; - } -fi; -chown -R aaiadmin:aaiadmin ${MICRO_HOME} -chown -R aaiadmin:aaiadmin ${DR_LOGS} find ${MICRO_HOME} -name "*.sh" -exec chmod +x {} + -gosu aaiadmin ln -s /logs $MICRO_HOME/logs -JAVA_CMD="exec gosu aaiadmin java"; +JAVA_CMD="exec java"; ### PROPS="-DAJSC_HOME=${MICRO_HOME}" PROPS="$PROPS -Dlogging.config=${MICRO_HOME}/bundleconfig/etc/logback.xml" diff --git a/src/main/docker/Dockerfile b/src/main/docker/Dockerfile index 0ff79a2..74abb1c 100644 --- a/src/main/docker/Dockerfile +++ b/src/main/docker/Dockerfile @@ -2,6 +2,7 @@ FROM @aai.docker.namespace@/aai-common-@aai.base.image@:@aai.base.image.version@ ARG MICRO_HOME=/opt/app/data-router ARG BIN_HOME=$MICRO_HOME/bin +ARG DR_LOGS=/var/log/onap/AAI-DR # AAI-2176 Additional optional steps for Ubuntu RUN if ((uname -v | grep -i "ubuntu") || ( cat /etc/*release|grep -i "ubuntu") ) ; then \ @@ -18,21 +19,19 @@ RUN if ((uname -v | grep -i "ubuntu") || ( cat /etc/*release|grep -i "ubuntu") JAVA_HOME=usr/lib/jvm/java-8-openjdk-amd64; \ export JAVA_HOME ; \ fi; \ - ########################################## - #Install gosu if not present - ########################################## - if type gosu 2>/dev/null; then \ - echo "skipping gosu installation"; \ - else \ - set -x ; \ - add-apt-repository -y ppa:tianon/gosu; \ - sudo apt-get update; \ - sudo apt-get install gosu; \ - fi;\ fi -RUN mkdir -p $MICRO_HOME +RUN mkdir -p $MICRO_HOME $MICRO_HOME/logs $DR_LOGS + +RUN groupadd aaiadmin -g 1000 +RUN adduser -u 1000 -h /opt/aaihome/aaiadmin -S -D -G aaiadmin -s /bin/bash aaiadmin + WORKDIR $MICRO_HOME -COPY /maven/data-router/ . +RUN chown -R aaiadmin:aaiadmin $MICRO_HOME $MICRO_HOME/logs $DR_LOGS + +COPY --chown=aaiadmin:aaiadmin /maven/data-router/ . + +USER aaiadmin + RUN chmod 755 $BIN_HOME/* \ && ln -snf /logs $MICRO_HOME/logs |