diff options
| author |   James Forsyth <jf2512@att.com> | 2020-06-03 15:34:53 +0000 |
|---|---|---|
| committer |   Gerrit Code Review <gerrit@onap.org> | 2020-06-03 15:34:53 +0000 |
| commit | 7a7a97cb395a2df6cad958aff444de8c107ff60f (patch) | |
| tree | 7a36903d6749aa20cf817891a77d421b2e0223fc | |
| parent | d22a11ea3937a7c6f3498340cfb8017be9a470d4 (diff) | |
| parent | bf48a65dc08a53a0057db879757e5e91e73492bc (diff) | |
Merge "Containers should not run as root by default"
| -rw-r--r-- | sparkybe-onap-application/src/main/docker/Dockerfile | 25 | ||||
| -rw-r--r-- | sparkybe-onap-application/src/main/scripts/start.sh | 25 |
2 files changed, 14 insertions, 36 deletions
diff --git a/sparkybe-onap-application/src/main/docker/Dockerfile b/sparkybe-onap-application/src/main/docker/Dockerfile index 117c54c..035abd2 100644 --- a/sparkybe-onap-application/src/main/docker/Dockerfile +++ b/sparkybe-onap-application/src/main/docker/Dockerfile @@ -2,9 +2,10 @@ FROM @aai.docker.namespace@/aai-common-@aai.base.image@:@aai.base.image.version@ ARG MICRO_HOME=/opt/app/sparky ARG BIN_HOME=$MICRO_HOME/bin +ARG UI_LOGS=/var/log/onap/AAI-UI # Build up the deployment folder structure -RUN mkdir -p $MICRO_HOME +RUN mkdir -p $MICRO_HOME $MICRO_HOME/logs $UI_LOGS # Changes related to:AAI-2180 # Additional optional steps for Ubuntu @@ -22,20 +23,18 @@ RUN if ((uname -v | grep -i "ubuntu") || ( cat /etc/*release|grep -i "ubuntu") JAVA_HOME=usr/lib/jvm/java-8-openjdk-amd64; \ export JAVA_HOME ; \ fi; \ - ########################################## - #Install gosu if not present - ########################################## - if type gosu 2>/dev/null; then \ - echo "skipping gosu installation"; \ - else \ - set -x ; \ - add-apt-repository -y ppa:tianon/gosu; \ - sudo apt-get update; \ - sudo apt-get install gosu; \ - fi;\ fi + +RUN groupadd aaiadmin -g 1000 +RUN adduser -u 1000 -h /opt/aaihome/aaiadmin -S -D -G aaiadmin -s /bin/bash aaiadmin + WORKDIR $MICRO_HOME -COPY /maven/sparkybe-onap-application/ . +RUN chown -R aaiadmin:aaiadmin $MICRO_HOME $MICRO_HOME/logs $UI_LOGS + +COPY --chown=aaiadmin:aaiadmin /maven/sparkybe-onap-application/ . + +USER aaiadmin + RUN chmod 755 $BIN_HOME/* \ && ln -snf /logs $MICRO_HOME/logs diff --git a/sparkybe-onap-application/src/main/scripts/start.sh b/sparkybe-onap-application/src/main/scripts/start.sh index 512d552..b4e1083 100644 --- a/sparkybe-onap-application/src/main/scripts/start.sh +++ b/sparkybe-onap-application/src/main/scripts/start.sh @@ -5,31 +5,10 @@ CONFIG_HOME=${APP_HOME}/config PROPS="-DAPP_HOME=${APP_HOME} -DCONFIG_HOME=${CONFIG_HOME} -Dlogging.config=${CONFIG_HOME}/logging/logback.xml" -# Changes related to:AAI-2180 -# Change aai sparky container processes to run as non-root on the host -USER_ID=${LOCAL_USER_ID:-9001} -GROUP_ID=${LOCAL_GROUP_ID:-9001} -UI_LOGS=/var/log/onap/AAI-UI - -if [ $(cat /etc/passwd | grep aaiadmin | wc -l) -eq 0 ]; then - - groupadd aaiadmin -g ${GROUP_ID} || { - echo "Unable to create the group id for ${GROUP_ID}"; - exit 1; - } - useradd --shell=/bin/bash -u ${USER_ID} -g ${GROUP_ID} -o -c "" -m aaiadmin || { - echo "Unable to create the user id for ${USER_ID}"; - exit 1; - } -fi; -chown -R aaiadmin:aaiadmin ${MICRO_HOME} -chown -R aaiadmin:aaiadmin ${APP_HOME} -chown -R aaiadmin:aaiadmin ${UI_LOGS} find ${MICRO_HOME} -name "*.sh" -exec chmod +x {} + -gosu aaiadmin ln -s /logs $MICRO_HOME/logs -JAVA_CMD="exec gosu aaiadmin java"; -JAR_CMD="exec gosu aaiadmin jar"; +JAVA_CMD="exec java"; +JAR_CMD="exec jar"; ### set -x |