Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Update docker image to permit running as non-root and other tweaks for complement build #11431

Closed
wants to merge 6 commits into from
Closed

Update docker image to permit running as non-root and other tweaks for complement build #11431

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
bf61174
Ignore generated files from scripts-dev/complement.sh.
michaelkaye Nov 25, 2021
608d538
Swap to COMPLEMENT_SPAWN_HS_TIMEOUT_SECS env var.
michaelkaye Nov 25, 2021
e18ce18
Increase write access to /conf and /data within docker container for …
michaelkaye Nov 25, 2021
05d4115
Route /health checks through to the main synapse worker.
michaelkaye Nov 25, 2021
67e20f2
Allow Dockerfile-workers to run as non-root.
michaelkaye Nov 25, 2021
38bfadd
changelog.d
michaelkaye Nov 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,3 +50,7 @@ __pycache__/

# docs
book/

# complement
/complement-master
/master.tar.gz
8 changes: 8 additions & 0 deletions docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,14 @@ COPY --from=builder /install /usr/local
COPY ./docker/start.py /start.py
COPY ./docker/conf /conf

RUN mkdir /data

# Set permissions for GID=0 to be able to interact with /conf and /data
# Allows container to be deployed in OpenShift without UID 0
# https://docs.openshift.com/container-platform/4.7/openshift_images/create-images.html#images-create-guide-openshift_create-images
RUN chgrp -R 0 /conf /data && \
chmod -R g+rw /conf /data
Comment on lines +90 to +91
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

slightly surprised this is needed. What is the default?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

chmod -R g+w is the only absolutely required change; normally these are u+rw ; g+r

I duplicated the change from synapse-workers where there are cases of things being different; it seemed to me to be a good way to clearly state what was intended, rather than rely on the default not changing. It doesn't make much change to the build speed.


VOLUME ["/data"]

EXPOSE 8008/tcp 8009/tcp 8448/tcp
Expand Down
3 changes: 0 additions & 3 deletions docker/Dockerfile-workers
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,6 @@ COPY ./docker/conf-workers/* /conf/
# Expose nginx listener port
EXPOSE 8080/tcp

# Volume for user-editable config files, logs etc.
VOLUME ["/data"]

# A script to read environment variables and create the necessary
# files to run the desired worker configuration. Will start supervisord.
COPY ./docker/configure_workers_and_start.py /configure_workers_and_start.py
Expand Down
2 changes: 1 addition & 1 deletion scripts-dev/complement.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ if [[ -n "$WORKERS" ]]; then
COMPLEMENT_DOCKERFILE=SynapseWorkers.Dockerfile
# And provide some more configuration to complement.
export COMPLEMENT_CA=true
export COMPLEMENT_VERSION_CHECK_ITERATIONS=500
export COMPLEMENT_SPAWN_HS_TIMEOUT_SECS=25
else
export COMPLEMENT_BASE_IMAGE=complement-synapse
COMPLEMENT_DOCKERFILE=Synapse.Dockerfile
Expand Down