Skip to content

Commit 6763e15

Browse files
solidnerdsolidnerd
committed
feat: run container as none root
BREAKING CHANGE: This will drop all root privileges inside the container. Probably Migrations are required see `docs/migrate.md` Closes #170 Signed-off-by: solidnerd <niclas@mietz.io>
1 parent 72e91d8 commit 6763e15

File tree

4 files changed

+97
-47
lines changed

4 files changed

+97
-47
lines changed

‎Dockerfile

Lines changed: 69 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,81 @@
1-
FROM php:7.2-apache-stretch
1+
FROM alpine:3 as bookstack
2+
ENV BOOKSTACK_VERSION=0.27.5
3+
RUN apk add --no-cache curl tar
4+
RUN set -x; \
5+
curl -SL -o bookstack.tar.gz https://github.com/BookStackApp/BookStack/archive/v${BOOKSTACK_VERSION}.tar.gz \
6+
&& mkdir -p /bookstack \
7+
&& tar xvf bookstack.tar.gz -C /bookstack --strip-components=1 \
8+
&& rm bookstack.tar.gz
29

3-
ENV BOOKSTACK=BookStack \
4-
BOOKSTACK_VERSION=0.27.5 \
5-
BOOKSTACK_HOME="/var/www/bookstack"
6-
7-
RUN apt-get update && apt-get install -y --no-install-recommends git zlib1g-dev libfreetype6-dev libjpeg62-turbo-dev libmcrypt-dev libpng-dev wget libldap2-dev libtidy-dev libxml2-dev fontconfig ttf-freefont wkhtmltopdf tar curl \
8-
&& docker-php-ext-install dom pdo pdo_mysql zip tidy \
10+
FROM php:7.4-apache-buster as final
11+
RUN set -x; \
12+
apt-get update \
13+
&& apt-get install -y --no-install-recommends \
14+
git \
15+
zlib1g-dev \
16+
libfreetype6-dev \
17+
libjpeg62-turbo-dev \
18+
libmcrypt-dev \
19+
libpng-dev \
20+
libldap2-dev \
21+
libtidy-dev \
22+
libxml2-dev \
23+
fontconfig \
24+
fonts-freefont-ttf \
25+
wkhtmltopdf \
26+
tar \
27+
curl \
28+
libzip-dev \
29+
unzip \
30+
\
31+
&& docker-php-ext-install -j$(nproc) dom pdo pdo_mysql zip tidy \
932
&& docker-php-ext-configure ldap \
10-
&& docker-php-ext-install ldap \
11-
&& docker-php-ext-configure gd --with-freetype-dir=usr/include/ --with-jpeg-dir=/usr/include/ \
12-
&& docker-php-ext-install gd \
13-
&& cd /var/www && curl -sS https://getcomposer.org/installer | php \
14-
&& mv /var/www/composer.phar /usr/local/bin/composer \
15-
&& wget https://github.com/BookStackApp/BookStack/archive/v${BOOKSTACK_VERSION}.tar.gz -O ${BOOKSTACK}.tar.gz \
16-
&& tar -xf ${BOOKSTACK}.tar.gz && mv BookStack-${BOOKSTACK_VERSION} ${BOOKSTACK_HOME} && rm ${BOOKSTACK}.tar.gz \
17-
&& cd $BOOKSTACK_HOME && composer install \
18-
&& chown -R www-data:www-data $BOOKSTACK_HOME \
19-
&& apt-get -y autoremove \
20-
&& apt-get clean \
21-
&& rm -rf /var/lib/apt/lists/* /var/tmp/* /etc/apache2/sites-enabled/000-*.conf
33+
&& docker-php-ext-install -j$(nproc) ldap \
34+
&& docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr/include/ \
35+
&& docker-php-ext-install -j$(nproc) gd
36+
37+
RUN a2enmod rewrite remoteip; \
38+
{ \
39+
echo RemoteIPHeader X-Real-IP ; \
40+
echo RemoteIPTrustedProxy 10.0.0.0/8 ; \
41+
echo RemoteIPTrustedProxy 172.16.0.0/12 ; \
42+
echo RemoteIPTrustedProxy 192.168.0.0/16 ; \
43+
} > /etc/apache2/conf-available/remoteip.conf; \
44+
a2enconf remoteip
45+
46+
RUN set -ex; \
47+
sed -i "s/Listen 80/Listen 8080/" /etc/apache2/ports.conf; \
48+
sed -i "s/VirtualHost *:80/VirtualHost *:8080/" /etc/apache2/sites-available/*.conf
49+
50+
COPY bookstack.conf /etc/apache2/sites-available/000-default.conf
51+
52+
COPY --from=bookstack --chown=33:33 /bookstack/ /var/www/bookstack/
53+
54+
RUN set -x; \
55+
cd /var/www/bookstack \
56+
&& curl -sS https://getcomposer.org/installer | php \
57+
&& /var/www/bookstack/composer.phar global -v require hirak/prestissimo \
58+
&& /var/www/bookstack/composer.phar install -v -d /var/www/bookstack/ \
59+
&& /var/www/bookstack/composer.phar global -v remove hirak/prestissimo \
60+
&& rm -rf /var/www/bookstack/composer.phar /root/.composer \
61+
&& chown -R www-data:www-data /var/www/bookstack
2262

2363
COPY php.ini /usr/local/etc/php/php.ini
24-
COPY bookstack.conf /etc/apache2/sites-enabled/bookstack.conf
25-
RUN a2enmod rewrite
64+
COPY docker-entrypoint.sh /bin/docker-entrypoint.sh
65+
66+
WORKDIR /var/www/bookstack
2667

27-
COPY docker-entrypoint.sh /
68+
# www-data
69+
USER 33
2870

29-
WORKDIR $BOOKSTACK_HOME
71+
VOLUME ["/var/www/bookstack/public/uploads","/var/www/bookstack/storage/uploads"]
3072

31-
EXPOSE 80
73+
ENV RUN_APACHE_USER=www-data \
74+
RUN_APACHE_GROUP=www-data
3275

33-
VOLUME ["$BOOKSTACK_HOME/public/uploads","$BOOKSTACK_HOME/storage/uploads"]
76+
EXPOSE 8080
3477

35-
ENTRYPOINT ["/docker-entrypoint.sh"]
78+
ENTRYPOINT ["/bin/docker-entrypoint.sh"]
3679

3780
ARG BUILD_DATE
3881
ARG VCS_REF

‎bookstack.conf

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,23 @@
1-
<VirtualHost *:80>
2-
ServerName bookstack.dev
3-
DocumentRoot "/var/www/bookstack/public/"
1+
<VirtualHost *:8080>
2+
# The ServerName directive sets the request scheme, hostname and port that
3+
# the server uses to identify itself. This is used when creating
4+
# redirection URLs. In the context of virtual hosts, the ServerName
5+
# specifies what hostname must appear in the request's Host: header to
6+
# match this virtual host. For the default virtual host (this file) this
7+
# value is not decisive as it is used as a last resort host regardless.
8+
# However, you must set it for any further virtual host explicitly.
9+
ServerName bookstack
410

5-
<Directory "/var/www/bookstack/">
6-
Options FollowSymLinks MultiViews
7-
AllowOverride All
8-
Require all granted
9-
</Directory>
11+
DocumentRoot /var/www/bookstack/public
12+
13+
<Directory "/var/www/bookstack/">
14+
Options FollowSymLinks MultiViews
15+
AllowOverride All
16+
Require all granted
17+
</Directory>
18+
# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
19+
# error, crit, alert, emerg.
20+
# It is also possible to configure the loglevel for particular
21+
# modules, e.g.
22+
LogLevel info
1023
</VirtualHost>

‎docker-compose.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ services:
2323
- uploads:/var/www/bookstack/public/uploads
2424
- storage-uploads:/var/www/bookstack/storage/uploads
2525
ports:
26-
- "8080:80"
26+
- "8080:8080"
2727

2828
volumes:
2929
mysql-data:

‎docker-entrypoint.sh

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ echoerr() { echo "$@" 1>&2; }
77
IFS=":" read -r DB_HOST_NAME DB_PORT <<< "$DB_HOST"
88
DB_PORT=${DB_PORT:-3306}
99

10-
if [ ! -f "$BOOKSTACK_HOME/.env" ]; then
10+
if [ ! -f ".env" ]; then
1111
if [[ "${DB_HOST}" ]]; then
12-
cat > "$BOOKSTACK_HOME/.env" <<EOF
12+
cat > ".env" <<EOF
1313
# Environment
1414
APP_ENV=production
1515
APP_DEBUG=${APP_DEBUG:-false}
@@ -79,7 +79,6 @@ if [ ! -f "$BOOKSTACK_HOME/.env" ]; then
7979
MAIL_ENCRYPTION=${MAIL_ENCRYPTION:-null}
8080
# URL used for social login redirects, NO TRAILING SLASH
8181
EOF
82-
sed -ie "s/single/errorlog/g" app/Config/app.php
8382
else
8483
echo >&2 'error: missing DB_HOST environment variable'
8584
exit 1
@@ -103,19 +102,14 @@ else
103102
echoerr "wait-for-db: timeout out after 15 seconds waiting for ${DB_HOST_NAME}:${DB_PORT}"
104103
fi
105104

106-
composer install
107-
108-
php artisan key:generate
105+
echo "Generating Key..."
106+
php artisan key:generate --show
109107

108+
echo "Starting Migration..."
110109
php artisan migrate --force
111110

112-
113-
echo "Setting folder permissions for uploads"
114-
chown -R www-data:www-data public/uploads && chmod -R 775 public/uploads
115-
chown -R www-data:www-data storage/uploads && chmod -R 775 storage/uploads
116-
111+
echo "Clearing caches..."
117112
php artisan cache:clear
118-
119113
php artisan view:clear
120114

121115
exec apache2-foreground

0 commit comments

Comments
 (0)