Skip to content

Commit

Permalink
don't run rt as root user
Browse files Browse the repository at this point in the history
  • Loading branch information
netsandbox committed Jan 7, 2025
1 parent b4de5b9 commit 8dffba7
Show file tree
Hide file tree
Showing 5 changed files with 30 additions and 5 deletions.
7 changes: 6 additions & 1 deletion 4.4/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ LABEL org.opencontainers.image.authors="Christian Loos <[email protected]>"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN groupadd --gid 1000 --system rt && useradd --uid 1000 --gid rt --system --home-dir /opt/rt rt

WORKDIR /usr/local/src

# hadolint ignore=DL3003,SC2174
Expand All @@ -33,7 +35,8 @@ RUN curl -fsSL -o rt.tar.gz https://download.bestpractical.com/pub/rt/release/rt
&& make install \
&& mkdir --mode=0600 --parents /opt/rt/var/data/{gpg,smime} \
&& make initialize-database \
&& cd .. && rm -rf /usr/local/src/*
&& cd .. && rm -rf /usr/local/src/* \
&& chown -R rt:rt /opt/rt

WORKDIR /opt/rt
COPY RT_SiteConfig.pm etc/
Expand All @@ -43,5 +46,7 @@ VOLUME /opt/rt
COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]

USER rt

EXPOSE 80
CMD ["/opt/rt/sbin/rt-server"]
7 changes: 6 additions & 1 deletion 5.0/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ LABEL org.opencontainers.image.authors="Christian Loos <[email protected]>"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN groupadd --gid 1000 --system rt && useradd --uid 1000 --gid rt --system --home-dir /opt/rt rt

WORKDIR /usr/local/src

# hadolint ignore=DL3003,SC2174
Expand All @@ -33,7 +35,8 @@ RUN curl -fsSL -o rt.tar.gz https://download.bestpractical.com/pub/rt/release/rt
&& make install \
&& mkdir --mode=0600 --parents /opt/rt/var/data/{gpg,smime} \
&& make initialize-database \
&& cd .. && rm -rf /usr/local/src/*
&& cd .. && rm -rf /usr/local/src/* \
&& chown -R rt:rt /opt/rt

WORKDIR /opt/rt
COPY RT_SiteConfig.pm etc/
Expand All @@ -43,5 +46,7 @@ VOLUME /opt/rt
COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]

USER rt

EXPOSE 80
CMD ["/opt/rt/sbin/rt-server"]
7 changes: 6 additions & 1 deletion Dockerfile.template
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ LABEL org.opencontainers.image.authors="Christian Loos <[email protected]>"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN groupadd --gid 1000 --system rt && useradd --uid 1000 --gid rt --system --home-dir /opt/rt rt

WORKDIR /usr/local/src

# hadolint ignore=DL3003,SC2174
Expand Down Expand Up @@ -35,7 +37,8 @@ RUN curl -fsSL -o rt.tar.gz %%RT_URL%% \
&& make install \
&& mkdir --mode=0600 --parents /opt/rt/var/data/{gpg,smime} \
&& make initialize-database \
&& cd .. && rm -rf /usr/local/src/*
&& cd .. && rm -rf /usr/local/src/* \
&& chown -R rt:rt /opt/rt

WORKDIR /opt/rt
COPY RT_SiteConfig.pm etc/
Expand All @@ -45,5 +48,7 @@ VOLUME /opt/rt
COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]

USER rt

EXPOSE 80
CMD ["/opt/rt/sbin/rt-server"]
7 changes: 6 additions & 1 deletion master/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ LABEL org.opencontainers.image.authors="Christian Loos <[email protected]>"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN groupadd --gid 1000 --system rt && useradd --uid 1000 --gid rt --system --home-dir /opt/rt rt

WORKDIR /usr/local/src

# hadolint ignore=DL3003,SC2174
Expand Down Expand Up @@ -35,7 +37,8 @@ RUN curl -fsSL -o rt.tar.gz https://github.com/bestpractical/rt/archive/refs/hea
&& make install \
&& mkdir --mode=0600 --parents /opt/rt/var/data/{gpg,smime} \
&& make initialize-database \
&& cd .. && rm -rf /usr/local/src/*
&& cd .. && rm -rf /usr/local/src/* \
&& chown -R rt:rt /opt/rt

WORKDIR /opt/rt
COPY RT_SiteConfig.pm etc/
Expand All @@ -45,5 +48,7 @@ VOLUME /opt/rt
COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]

USER rt

EXPOSE 80
CMD ["/opt/rt/sbin/rt-server"]
7 changes: 6 additions & 1 deletion stable/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ LABEL org.opencontainers.image.authors="Christian Loos <[email protected]>"

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN groupadd --gid 1000 --system rt && useradd --uid 1000 --gid rt --system --home-dir /opt/rt rt

WORKDIR /usr/local/src

# hadolint ignore=DL3003,SC2174
Expand Down Expand Up @@ -35,7 +37,8 @@ RUN curl -fsSL -o rt.tar.gz https://github.com/bestpractical/rt/archive/refs/hea
&& make install \
&& mkdir --mode=0600 --parents /opt/rt/var/data/{gpg,smime} \
&& make initialize-database \
&& cd .. && rm -rf /usr/local/src/*
&& cd .. && rm -rf /usr/local/src/* \
&& chown -R rt:rt /opt/rt

WORKDIR /opt/rt
COPY RT_SiteConfig.pm etc/
Expand All @@ -45,5 +48,7 @@ VOLUME /opt/rt
COPY docker-entrypoint.sh /usr/local/bin/
ENTRYPOINT ["docker-entrypoint.sh"]

USER rt

EXPOSE 80
CMD ["/opt/rt/sbin/rt-server"]

0 comments on commit 8dffba7

Please sign in to comment.