Update Dockerfile to be OpenShift restricted SCC compliant #891
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hi Pandora, could you check if Dependency Track 4.4.0, which includes #1303, is sufficient for you? |
savek-cc
reviewed
Mar 21, 2022
| ARG WAR_FILENAME=dependency-track-apiserver.war | ||
|
|
||
| # Create the directory where Dependency-Track will store its data (${DATA_DIR}) and the external library directory (${EXTLIB_DIR}) | ||
| # Create a user and assign home directory to a ${DATA_DIR} | ||
| # Ensure UID 1000 & GID 1000 own all the needed directories | ||
| RUN mkdir -p -m 770 ${DATA_DIR} \ | ||
| && adduser -D -h ${DATA_DIR} -u 1000 ${USERNAME} \ | ||
| && chown -R ${USERNAME}:${USERNAME} ${DATA_DIR} | ||
| && chown -R ${USERNAME}:0 ${DATA_DIR} |
There was a problem hiding this comment.
Why not :${GID} - otherwise that new parameter isn't even used anywhere?
There was a problem hiding this comment.
The reason for this is to support arbitrary user IDs, such you can find in environments such as OpenShift.
You can read up on it in the OpenShift Documentation.
Regardless, since #1303 was merged that has this kind of behaviour already incorporated this PR is redundant, I think.
Edit: I see why you asked in the first place now 🤦♂️ (still I think this PR has been made redundant, now that the official DT image already includes support for arbitrary user IDs)
savek-cc
reviewed
Mar 21, 2022
|
|
||
| # Copy the compiled WAR to the application directory created above | ||
| # Automatically creates the $APP_DIR directory | ||
| COPY --chown=1000 ./target/${WAR_FILENAME} ${APP_DIR} | ||
| COPY --chown=${USERNAME}:0 ./target/${WAR_FILENAME} ${APP_DIR} |
|
Superseded by #1303. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Set ARG for GID=0.
Also specifying the group ownership for this through chmod -R g=u and chown -R ${USERNAME}:0