Skip to content

Commit e10119b

Browse files
yosifkityosifkit
committed
Merge pull request #48 from infosiftr/non-root
Run as non-root by default (and allow arbitrary --user values)
2 parents d8595fb + e57caf5 commit e10119b

12 files changed

+138
-0
lines changed

‎2.1/Dockerfile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1+
# vim:set ft=dockerfile:
12
FROM debian:jessie-backports
23

4+
# explicitly set user/group IDs
5+
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra
6+
7+
# grab gosu for easy step-down from root
8+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9+
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12+
&& gpg --verify /usr/local/bin/gosu.asc \
13+
&& rm /usr/local/bin/gosu.asc \
14+
&& chmod +x /usr/local/bin/gosu \
15+
&& apt-get purge -y --auto-remove ca-certificates wget
16+
317
RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 514A2AD631A57A16DD0047EC749D6EEC0353B12C
418

519
RUN echo 'deb http://www.apache.org/dist/cassandra/debian 21x main' >> /etc/apt/sources.list.d/cassandra.list
@@ -15,6 +29,9 @@ ENV CASSANDRA_CONFIG /etc/cassandra
1529
COPY docker-entrypoint.sh /docker-entrypoint.sh
1630
ENTRYPOINT ["/docker-entrypoint.sh"]
1731

32+
RUN mkdir -p /var/lib/cassandra "$CASSANDRA_CONFIG" \
33+
&& chown -R cassandra:cassandra /var/lib/cassandra "$CASSANDRA_CONFIG" \
34+
&& chmod 777 /var/lib/cassandra "$CASSANDRA_CONFIG"
1835
VOLUME /var/lib/cassandra
1936

2037
# 7000: intra-node communication

‎2.1/docker-entrypoint.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ if [ "${1:0:1}" = '-' ]; then
66
set -- cassandra -f "$@"
77
fi
88

9+
# allow the container to be started with `--user`
10+
if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
11+
chown -R cassandra /var/lib/cassandra "$CASSANDRA_CONFIG"
12+
exec gosu cassandra "$BASH_SOURCE" "$@"
13+
fi
14+
915
if [ "$1" = 'cassandra' ]; then
1016
: ${CASSANDRA_RPC_ADDRESS='0.0.0.0'}
1117

‎2.2/Dockerfile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1+
# vim:set ft=dockerfile:
12
FROM debian:jessie-backports
23

4+
# explicitly set user/group IDs
5+
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra
6+
7+
# grab gosu for easy step-down from root
8+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9+
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12+
&& gpg --verify /usr/local/bin/gosu.asc \
13+
&& rm /usr/local/bin/gosu.asc \
14+
&& chmod +x /usr/local/bin/gosu \
15+
&& apt-get purge -y --auto-remove ca-certificates wget
16+
317
RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 514A2AD631A57A16DD0047EC749D6EEC0353B12C
418

519
RUN echo 'deb http://www.apache.org/dist/cassandra/debian 22x main' >> /etc/apt/sources.list.d/cassandra.list
@@ -15,6 +29,9 @@ ENV CASSANDRA_CONFIG /etc/cassandra
1529
COPY docker-entrypoint.sh /docker-entrypoint.sh
1630
ENTRYPOINT ["/docker-entrypoint.sh"]
1731

32+
RUN mkdir -p /var/lib/cassandra "$CASSANDRA_CONFIG" \
33+
&& chown -R cassandra:cassandra /var/lib/cassandra "$CASSANDRA_CONFIG" \
34+
&& chmod 777 /var/lib/cassandra "$CASSANDRA_CONFIG"
1835
VOLUME /var/lib/cassandra
1936

2037
# 7000: intra-node communication

‎2.2/docker-entrypoint.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ if [ "${1:0:1}" = '-' ]; then
66
set -- cassandra -f "$@"
77
fi
88

9+
# allow the container to be started with `--user`
10+
if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
11+
chown -R cassandra /var/lib/cassandra "$CASSANDRA_CONFIG"
12+
exec gosu cassandra "$BASH_SOURCE" "$@"
13+
fi
14+
915
if [ "$1" = 'cassandra' ]; then
1016
: ${CASSANDRA_RPC_ADDRESS='0.0.0.0'}
1117

‎3.0/Dockerfile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1+
# vim:set ft=dockerfile:
12
FROM debian:jessie-backports
23

4+
# explicitly set user/group IDs
5+
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra
6+
7+
# grab gosu for easy step-down from root
8+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9+
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12+
&& gpg --verify /usr/local/bin/gosu.asc \
13+
&& rm /usr/local/bin/gosu.asc \
14+
&& chmod +x /usr/local/bin/gosu \
15+
&& apt-get purge -y --auto-remove ca-certificates wget
16+
317
RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 514A2AD631A57A16DD0047EC749D6EEC0353B12C
418

519
RUN echo 'deb http://www.apache.org/dist/cassandra/debian 30x main' >> /etc/apt/sources.list.d/cassandra.list
@@ -15,6 +29,9 @@ ENV CASSANDRA_CONFIG /etc/cassandra
1529
COPY docker-entrypoint.sh /docker-entrypoint.sh
1630
ENTRYPOINT ["/docker-entrypoint.sh"]
1731

32+
RUN mkdir -p /var/lib/cassandra "$CASSANDRA_CONFIG" \
33+
&& chown -R cassandra:cassandra /var/lib/cassandra "$CASSANDRA_CONFIG" \
34+
&& chmod 777 /var/lib/cassandra "$CASSANDRA_CONFIG"
1835
VOLUME /var/lib/cassandra
1936

2037
# 7000: intra-node communication

‎3.0/docker-entrypoint.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ if [ "${1:0:1}" = '-' ]; then
66
set -- cassandra -f "$@"
77
fi
88

9+
# allow the container to be started with `--user`
10+
if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
11+
chown -R cassandra /var/lib/cassandra "$CASSANDRA_CONFIG"
12+
exec gosu cassandra "$BASH_SOURCE" "$@"
13+
fi
14+
915
if [ "$1" = 'cassandra' ]; then
1016
: ${CASSANDRA_RPC_ADDRESS='0.0.0.0'}
1117

‎3.1/Dockerfile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1+
# vim:set ft=dockerfile:
12
FROM debian:jessie-backports
23

4+
# explicitly set user/group IDs
5+
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra
6+
7+
# grab gosu for easy step-down from root
8+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9+
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12+
&& gpg --verify /usr/local/bin/gosu.asc \
13+
&& rm /usr/local/bin/gosu.asc \
14+
&& chmod +x /usr/local/bin/gosu \
15+
&& apt-get purge -y --auto-remove ca-certificates wget
16+
317
RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 514A2AD631A57A16DD0047EC749D6EEC0353B12C
418

519
RUN echo 'deb http://www.apache.org/dist/cassandra/debian 31x main' >> /etc/apt/sources.list.d/cassandra.list
@@ -15,6 +29,9 @@ ENV CASSANDRA_CONFIG /etc/cassandra
1529
COPY docker-entrypoint.sh /docker-entrypoint.sh
1630
ENTRYPOINT ["/docker-entrypoint.sh"]
1731

32+
RUN mkdir -p /var/lib/cassandra "$CASSANDRA_CONFIG" \
33+
&& chown -R cassandra:cassandra /var/lib/cassandra "$CASSANDRA_CONFIG" \
34+
&& chmod 777 /var/lib/cassandra "$CASSANDRA_CONFIG"
1835
VOLUME /var/lib/cassandra
1936

2037
# 7000: intra-node communication

‎3.1/docker-entrypoint.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ if [ "${1:0:1}" = '-' ]; then
66
set -- cassandra -f "$@"
77
fi
88

9+
# allow the container to be started with `--user`
10+
if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
11+
chown -R cassandra /var/lib/cassandra "$CASSANDRA_CONFIG"
12+
exec gosu cassandra "$BASH_SOURCE" "$@"
13+
fi
14+
915
if [ "$1" = 'cassandra' ]; then
1016
: ${CASSANDRA_RPC_ADDRESS='0.0.0.0'}
1117

‎3.2/Dockerfile

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1+
# vim:set ft=dockerfile:
12
FROM debian:jessie-backports
23

4+
# explicitly set user/group IDs
5+
RUN groupadd -r cassandra --gid=999 && useradd -r -g cassandra --uid=999 cassandra
6+
7+
# grab gosu for easy step-down from root
8+
RUN gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4
9+
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget && rm -rf /var/lib/apt/lists/* \
10+
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture)" \
11+
&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/1.2/gosu-$(dpkg --print-architecture).asc" \
12+
&& gpg --verify /usr/local/bin/gosu.asc \
13+
&& rm /usr/local/bin/gosu.asc \
14+
&& chmod +x /usr/local/bin/gosu \
15+
&& apt-get purge -y --auto-remove ca-certificates wget
16+
317
RUN apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys 514A2AD631A57A16DD0047EC749D6EEC0353B12C
418

519
RUN echo 'deb http://www.apache.org/dist/cassandra/debian 32x main' >> /etc/apt/sources.list.d/cassandra.list
@@ -15,6 +29,9 @@ ENV CASSANDRA_CONFIG /etc/cassandra
1529
COPY docker-entrypoint.sh /docker-entrypoint.sh
1630
ENTRYPOINT ["/docker-entrypoint.sh"]
1731

32+
RUN mkdir -p /var/lib/cassandra "$CASSANDRA_CONFIG" \
33+
&& chown -R cassandra:cassandra /var/lib/cassandra "$CASSANDRA_CONFIG" \
34+
&& chmod 777 /var/lib/cassandra "$CASSANDRA_CONFIG"
1835
VOLUME /var/lib/cassandra
1936

2037
# 7000: intra-node communication

‎3.2/docker-entrypoint.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ if [ "${1:0:1}" = '-' ]; then
66
set -- cassandra -f "$@"
77
fi
88

9+
# allow the container to be started with `--user`
10+
if [ "$1" = 'cassandra' -a "$(id -u)" = '0' ]; then
11+
chown -R cassandra /var/lib/cassandra "$CASSANDRA_CONFIG"
12+
exec gosu cassandra "$BASH_SOURCE" "$@"
13+
fi
14+
915
if [ "$1" = 'cassandra' ]; then
1016
: ${CASSANDRA_RPC_ADDRESS='0.0.0.0'}
1117

0 commit comments

Comments
 (0)