Set proper user & group handling in scratch based images (#251)

Signed-off-by: Igor Shishkin <me@teran.ru>
teran · Nov 8, 2024 · 640116f · 640116f
1 parent 87856b1
commit 640116f
Show file tree

Hide file tree

Showing 9 changed files with 26 additions and 30 deletions.
diff --git a/dockerfiles/Dockerfile.cli b/dockerfiles/Dockerfile.cli
@@ -5,6 +5,9 @@ RUN apk add --update --no-cache \
 
 FROM scratch
 
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-cli_linux_amd64_v3/archived-cli /archived-cli
 

diff --git a/dockerfiles/Dockerfile.exporter b/dockerfiles/Dockerfile.exporter
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-exporter_linux_amd64_v3/archived-exporter /archived-exporter
 

diff --git a/dockerfiles/Dockerfile.gc b/dockerfiles/Dockerfile.gc
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-gc_linux_amd64_v3/archived-gc /archived-gc
 

diff --git a/dockerfiles/Dockerfile.manager b/dockerfiles/Dockerfile.manager
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-manager_linux_amd64_v3/archived-manager /archived-manager
 

diff --git a/dockerfiles/Dockerfile.migrator b/dockerfiles/Dockerfile.migrator
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-migrator_linux_amd64_v3/archived-migrator /archived-migrator
 COPY --chmod=0644 --chown=root:root repositories/metadata/postgresql/migrations/sql /migrations/sql

diff --git a/dockerfiles/Dockerfile.publisher b/dockerfiles/Dockerfile.publisher
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-publisher_linux_amd64_v3/archived-publisher /archived-publisher
 COPY --chmod=0644 --chown=root:root publisher/presenter/html/templates /templates

diff --git a/dockerfiles/Dockerfile.seeder b/dockerfiles/Dockerfile.seeder
@@ -3,13 +3,11 @@ FROM alpine:3.20.3 AS certificates
 RUN apk add --update --no-cache \
   ca-certificates=20240705-r0
 
-FROM alpine:3.20.3 AS passwd
-
-RUN echo 'nobody:x:65534:65534:nobody:/:/sbin/nologin' > /passwd.nobody
-
 FROM scratch
 
-COPY --from=passwd /passwd.nobody /etc/passwd
+COPY dockerfiles/rootfs/etc/passwd /etc/passwd
+COPY dockerfiles/rootfs/etc/group /etc/group
+
 COPY --from=certificates /etc/ssl/cert.pem /etc/ssl/cert.pem
 COPY --chmod=0755 --chown=root:root dist/archived-seeder_linux_amd64_v3/archived-seeder /archived-seeder
 

diff --git a/dockerfiles/rootfs/etc/group b/dockerfiles/rootfs/etc/group
@@ -0,0 +1,3 @@
+root:x:0:root
+nogroup:x:65533:
+nobody:x:65534:
diff --git a/dockerfiles/rootfs/etc/passwd b/dockerfiles/rootfs/etc/passwd
@@ -0,0 +1,2 @@
+root:x:0:0:root:/root:/sbin/nologin
+nobody:x:65534:65534:nobody:/:/sbin/nologin