Skip to content

Commit

Permalink
Create a non-root user in the ENTRYPOINT
Browse files Browse the repository at this point in the history
  • Loading branch information
ucan-lab committed Aug 20, 2024
1 parent 59a88be commit 9593b48
Show file tree
Hide file tree
Showing 7 changed files with 48 additions and 32 deletions.
1 change: 1 addition & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
for-linux-env:
echo "UID=$$(id -u)" >> .env
echo "GID=$$(id -g)" >> .env
echo "USERNAME=$$(whoami)" >> .env
install:
@make build
@make up
Expand Down
22 changes: 10 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,22 +22,21 @@ Build a simple laravel development environment with Docker Compose. Support with
3. Execute the following command

```bash
$ task for-linux-env # Linux environment only
$ task create-project

# or...

$ make for-linux-env # Linux environment only
$ make create-project

# or...
# or... Linux environment

$ echo "UID=$(id -u)" >> .env # Linux environment only
$ echo "GID=$(id -g)" >> .env # Linux environment only
$ echo "UID=$(id -u)" >> .env
$ echo "GID=$(id -g)" >> .env
$ echo "USERNAME=$(whoami)" >> .env

$ mkdir -p src
$ docker compose build
$ docker compose up -d
$ docker compose --file compose.yaml --file compose-for-linux.yaml up --detach
$ docker compose exec app composer create-project --prefer-dist laravel/laravel .
$ docker compose exec app php artisan key:generate
$ docker compose exec app php artisan storage:link
Expand All @@ -53,21 +52,20 @@ http://localhost
2. Execute the following command

```bash
$ task for-linux-env # Linux environment only
$ task install

# or...

$ make for-linux-env # Linux environment only
$ make install

# or...
# or... Linux environment

$ echo "UID=$(id -u)" >> .env # Linux environment only
$ echo "GID=$(id -g)" >> .env # Linux environment only
$ echo "UID=$(id -u)" >> .env
$ echo "GID=$(id -g)" >> .env
$ echo "USERNAME=$(whoami)" >> .env

$ docker compose build
$ docker compose up -d
$ docker compose --file compose.yaml --file compose-for-linux.yaml up --detach
$ docker compose exec app composer install
$ docker compose exec app cp .env.example .env
$ docker compose exec app php artisan key:generate
Expand Down
1 change: 1 addition & 0 deletions Taskfile.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ tasks:
cmds:
- echo "UID=$(id -u)" >> .env
- echo "GID=$(id -g)" >> .env
- echo "USERNAME=$(whoami)" >> .env

install:
cmds:
Expand Down
8 changes: 8 additions & 0 deletions compose-for-linux.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
services:
app:
entrypoint: ["/usr/local/bin/entrypoint.sh"]
command: ["php-fpm"]
environment:
- UID=${UID:-1000}
- GID=${GID:-1000}
- USERNAME=${USERNAME:-phper}
3 changes: 0 additions & 3 deletions compose.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,6 @@ services:
build:
context: .
dockerfile: ./infra/docker/php/Dockerfile
args:
UID: ${UID:-1000}
GID: ${GID:-1000}
target: ${APP_BUILD_TARGET:-development}
volumes:
- type: bind
Expand Down
20 changes: 3 additions & 17 deletions infra/docker/php/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,8 @@ ENV TZ=UTC \
# composer environment
COMPOSER_HOME=/composer

ARG UID=1000
ARG GID=1000

COPY --from=composer:2.7 /usr/bin/composer /usr/bin/composer
COPY ./infra/docker/php/entrypoint.sh /usr/local/bin/entrypoint.sh

RUN <<EOF
apt-get update
Expand All @@ -33,14 +31,8 @@ RUN <<EOF
pdo_mysql \
zip \
bcmath
# permission denied bind mount in Linux environment
groupadd --gid $GID phper
useradd --uid $UID --gid $GID phper
mkdir /composer
mkdir -p /home/phper/.config/psysh
chown phper:phper /composer
chown phper:phper /workspace
chown phper:phper /home/phper/.config/psysh
chmod +x /usr/local/bin/entrypoint.sh
apt-get clean
rm -rf /var/lib/apt/lists/*
EOF
Expand All @@ -49,8 +41,6 @@ FROM base AS development

COPY ./infra/docker/php/php.development.ini /usr/local/etc/php/php.ini

USER phper

FROM base AS development-xdebug

RUN <<EOF
Expand All @@ -60,14 +50,10 @@ EOF

COPY ./infra/docker/php/xdebug.ini /usr/local/etc/php/conf.d/xdebug.ini

USER phper

FROM base AS deploy

COPY ./infra/docker/php/php.deploy.ini /usr/local/etc/php/php.ini
COPY --chown=phper:phper ./src /workspace

USER phper
COPY ./src /workspace

RUN <<EOF
composer install --quiet --no-interaction --no-ansi --no-dev --no-scripts --no-progress --prefer-dist
Expand Down
25 changes: 25 additions & 0 deletions infra/docker/php/entrypoint.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
#!/bin/sh
set -e

UID=${UID:-1000}
GID=${GID:-1000}
USERNAME=${USERNAME:-phper}

echo "Starting with UID: $UID, GID: $GID, USERNAME: $USERNAME"

useradd -u "$UID" -o -m "$USERNAME"
groupmod -g "$GID" "$USERNAME"

mkdir -p /home/"$USERNAME"/.config/psysh
chown "$USERNAME":"$USERNAME" /home/"$USERNAME"/.config/psysh
chown "$USERNAME":"$USERNAME" /composer
chown "$USERNAME":"$USERNAME" /workspace

export HOME=/home/"$USERNAME"

# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
set -- php-fpm "$@"
fi

exec "$@"

0 comments on commit 9593b48

Please sign in to comment.