Skip to content

Commit cb993ee

Browse files
lfranckelfrancke
authored
Make uid/gid configurable & change group of files (#849)
* WIP * Fix install command * Rework image to get the commands in order and have everything owned by stackable:0 * Make precommit happy(er) * Adjust Druid * Adjust Hadoop * Update to image-tools 0.0.13 * Fix Druid & Hadoop * Fix Hadoop * Adjust HBase * Adjust Hello-World * Fix Hadoop * Fix HBase * WIP Fix Hive * Delete unused file
1 parent 5086a48 commit cb993ee

23 files changed

+207
-154
lines changed

‎.github/ISSUE_TEMPLATE/update-base-java.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6464

6565
```shell
6666
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
67-
pip install image-tools-stackabletech==0.0.12
67+
pip install image-tools-stackabletech==0.0.13
6868

6969
# Test a product image can build, eg: ZooKeeper
7070
bake --product zookeeper=x.y.z # where x.y.z is a valid product version using the newly added Java version

‎.github/ISSUE_TEMPLATE/update-base-stackable.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ This list should be completed by the assignee(s), once respective PRs have been
5353

5454
```shell
5555
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
56-
pip install image-tools-stackabletech==0.0.12
56+
pip install image-tools-stackabletech==0.0.13
5757

5858
bake --product vector=x.y.z # where x.y.z is a valid version
5959
```

‎.github/ISSUE_TEMPLATE/update-base-vector.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ This list should be completed by the assignee(s), once respective PRs have been
7171

7272
```shell
7373
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
74-
pip install image-tools-stackabletech==0.0.12
74+
pip install image-tools-stackabletech==0.0.13
7575

7676
bake --product vector=x.y.z # where x.y.z is the new version added in this PR
7777

‎.github/ISSUE_TEMPLATE/update-product-airflow.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6363

6464
```shell
6565
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
66-
pip install image-tools-stackabletech==0.0.12
66+
pip install image-tools-stackabletech==0.0.13
6767

6868
bake --product airflow=x.y.z # where x.y.z is the new version added in this PR
6969

‎.github/ISSUE_TEMPLATE/update-product-druid.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6767

6868
```shell
6969
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
70-
pip install image-tools-stackabletech==0.0.12
70+
pip install image-tools-stackabletech==0.0.13
7171

7272
bake --product druid=x.y.z # where x.y.z is the new version added in this PR
7373

‎.github/ISSUE_TEMPLATE/update-product-hbase-phoenix-omid.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ This list should be completed by the assignee(s), once respective PRs have been
7171

7272
```shell
7373
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
74-
pip install image-tools-stackabletech==0.0.12
74+
pip install image-tools-stackabletech==0.0.13
7575

7676
bake --product hbase=x.y.z # where x.y.z is the new version added in this PR
7777
bake --product omid=x.y.z # where x.y.z is the new version added in this PR

‎.github/ISSUE_TEMPLATE/update-product-hdfs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6565

6666
```shell
6767
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
68-
pip install image-tools-stackabletech==0.0.12
68+
pip install image-tools-stackabletech==0.0.13
6969

7070
bake --product hadoop=x.y.z # where x.y.z is the new version added in this PR
7171

‎.github/ISSUE_TEMPLATE/update-product-hive.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6464

6565
```shell
6666
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
67-
pip install image-tools-stackabletech==0.0.12
67+
pip install image-tools-stackabletech==0.0.13
6868

6969
bake --product hive=x.y.z # where x.y.z is the new version added in this PR
7070

‎.github/ISSUE_TEMPLATE/update-product-kafka.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ This list should be completed by the assignee(s), once respective PRs have been
7575

7676
```shell
7777
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
78-
pip install image-tools-stackabletech==0.0.12
78+
pip install image-tools-stackabletech==0.0.13
7979

8080
bake --product kafka=x.y.z # where x.y.z is the new version added in this PR
8181
bake --product kafka-testing-tools=1.0.0 # This version doesn't change

‎.github/ISSUE_TEMPLATE/update-product-nifi.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6464

6565
```shell
6666
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
67-
pip install image-tools-stackabletech==0.0.12
67+
pip install image-tools-stackabletech==0.0.13
6868

6969
bake --product nifi=x.y.z # where x.y.z is the new version added in this PR
7070

‎.github/ISSUE_TEMPLATE/update-product-opa.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6363

6464
```shell
6565
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
66-
pip install image-tools-stackabletech==0.0.12
66+
pip install image-tools-stackabletech==0.0.13
6767

6868
bake --product opa=x.y.z # where x.y.z is the new version added in this PR
6969

‎.github/ISSUE_TEMPLATE/update-product-spark.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6565

6666
```shell
6767
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
68-
pip install image-tools-stackabletech==0.0.12
68+
pip install image-tools-stackabletech==0.0.13
6969

7070
bake --product spark-k8s=x.y.z # where x.y.z is the new version added in this PR
7171

‎.github/ISSUE_TEMPLATE/update-product-superset.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6565

6666
```shell
6767
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
68-
pip install image-tools-stackabletech==0.0.12
68+
pip install image-tools-stackabletech==0.0.13
6969

7070
bake --product superset=x.y.z # where x.y.z is the new version added in this PR
7171

‎.github/ISSUE_TEMPLATE/update-product-trino.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ This list should be completed by the assignee(s), once respective PRs have been
7373

7474
```shell
7575
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
76-
pip install image-tools-stackabletech==0.0.12
76+
pip install image-tools-stackabletech==0.0.13
7777

7878
bake --product trino=x.y.z # where x.y.z is the new version added in this PR
7979
bake --product trino-cli=x.y.z # where x.y.z is the new version added in this PR

‎.github/ISSUE_TEMPLATE/update-product-zookeeper.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ This list should be completed by the assignee(s), once respective PRs have been
6464

6565
```shell
6666
# See the latest version at https://pypi.org/project/image-tools-stackabletech/
67-
pip install image-tools-stackabletech==0.0.12
67+
pip install image-tools-stackabletech==0.0.13
6868

6969
bake --product zookeeper=x.y.z # where x.y.z is the new version added in this PR
7070

‎airflow/Dockerfile

Lines changed: 40 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ FROM stackable/image/vector AS airflow-build-image
1414
ARG PRODUCT
1515
ARG PYTHON
1616
ARG TARGETARCH
17-
ARG TARGETOS
1817

1918
COPY airflow/constraints-${PRODUCT}-python${PYTHON}.txt /tmp/constraints.txt
2019

@@ -61,7 +60,7 @@ ARG PYTHON
6160
ARG RELEASE
6261
ARG TINI
6362
ARG TARGETARCH
64-
ARG TARGETOS
63+
ARG STACKABLE_USER_UID
6564

6665
LABEL name="Apache Airflow" \
6766
maintainer="info@stackable.tech" \
@@ -72,51 +71,56 @@ LABEL name="Apache Airflow" \
7271
description="This image is deployed by the Stackable Operator for Apache Airflow."
7372

7473
COPY airflow/licenses /licenses
75-
76-
# Update image and install python
77-
RUN microdnf update && \
78-
microdnf install \
79-
ca-certificates \
80-
cyrus-sasl \
81-
git \
82-
libpq \
83-
openldap \
84-
openldap-clients \
85-
openssh-clients \
86-
openssl-libs \
87-
openssl-pkcs11 \
88-
python${PYTHON} \
89-
socat \
90-
unixODBC && \
91-
microdnf clean all && \
92-
rm -rf /var/cache/yum
74+
COPY --chown=${STACKABLE_USER_UID}:0 airflow/stackable/utils/entrypoint.sh /entrypoint.sh
75+
COPY --chown=${STACKABLE_USER_UID}:0 airflow/stackable/utils/run-airflow.sh /run-airflow.sh
9376

9477
ENV HOME=/stackable
9578
ENV AIRFLOW_USER_HOME_DIR=/stackable
9679
ENV PATH=$PATH:/bin:$HOME/app/bin
9780
ENV AIRFLOW_HOME=$HOME/airflow
9881

82+
# Update image and install python
83+
RUN <<EOF
84+
microdnf update
85+
microdnf install \
86+
ca-certificates \
87+
cyrus-sasl \
88+
git \
89+
libpq \
90+
openldap \
91+
openldap-clients \
92+
openssh-clients \
93+
openssl-libs \
94+
openssl-pkcs11 \
95+
python${PYTHON} \
96+
socat \
97+
unixODBC
98+
microdnf clean all
99+
rm -rf /var/cache/yum
99100

100101
# Get the correct `tini` binary for our architecture.
101102
# It is used as an init alternative in the entrypoint
102-
RUN mkdir -pv ${AIRFLOW_HOME} && \
103-
mkdir -pv ${AIRFLOW_HOME}/dags && \
104-
mkdir -pv ${AIRFLOW_HOME}/logs && \
105-
chown --recursive stackable:stackable ${AIRFLOW_HOME} && \
106-
curl -o /usr/bin/tini "https://repo.stackable.tech/repository/packages/tini/tini-${TINI}-${TARGETARCH}"
107-
108-
COPY airflow/stackable/utils/entrypoint.sh /entrypoint.sh
109-
COPY airflow/stackable/utils/run-airflow.sh /run-airflow.sh
110-
RUN chmod a+x /entrypoint.sh && \
111-
chmod a+x /run-airflow.sh && \
112-
chmod +x /usr/bin/tini
113-
114-
COPY --from=airflow-build-image --chown=stackable:stackable /stackable/ ${HOME}/
115-
COPY --from=gitsync-image --chown=stackable:stackable /git-sync /stackable/git-sync
116-
117-
USER stackable
103+
curl -o /usr/bin/tini "https://repo.stackable.tech/repository/packages/tini/tini-${TINI}-${TARGETARCH}"
104+
chmod a+x /entrypoint.sh
105+
chmod a+x /run-airflow.sh
106+
chmod +x /usr/bin/tini
107+
108+
mkdir -pv ${AIRFLOW_HOME}
109+
mkdir -pv ${AIRFLOW_HOME}/dags
110+
mkdir -pv ${AIRFLOW_HOME}/logs
111+
112+
# All files and folders owned by root to support running as arbitrary users
113+
# This is best practice as all container users will belong to the root group (0)
114+
chown -R ${STACKABLE_USER_UID}:0 /stackable
115+
chmod -R g=u /stackable
116+
EOF
117+
118+
USER ${STACKABLE_USER_UID}
118119
WORKDIR /stackable
119120

121+
COPY --from=airflow-build-image --chown=${STACKABLE_USER_UID}:0 /stackable/ ${HOME}/
122+
COPY --from=gitsync-image --chown=${STACKABLE_USER_UID}:0 /git-sync /stackable/git-sync
123+
120124
ENTRYPOINT ["/usr/bin/tini", "--", "/run-airflow.sh"]
121125
CMD []
122126

‎conf.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,10 @@
8989
"ignore-error": "true",
9090
},
9191
]
92+
93+
args = {
94+
"STACKABLE_USER_NAME": "stackable",
95+
"STACKABLE_USER_UID": "1000",
96+
"STACKABLE_USER_GID": "1000",
97+
"DELETE_CACHES": "true"
98+
}

‎druid/Dockerfile

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ ARG JACKSON_DATAFORMAT_XML
88
ARG STAX2_API
99
ARG WOODSTOX_CORE
1010
ARG AUTHORIZER
11+
ARG STACKABLE_USER_UID
1112

1213
# Setting this to anything other than "true" will keep the cache folders around (e.g. for Maven, NPM etc.)
1314
# This can be used to speed up builds when disk space is of no concern.
@@ -31,11 +32,11 @@ microdnf clean all
3132
rm -rf /var/cache/yum
3233
EOF
3334

34-
USER stackable
35+
USER ${STACKABLE_USER_UID}
3536
WORKDIR /stackable
3637

37-
COPY --chown=stackable:stackable druid/stackable/patches/apply_patches.sh /stackable/apache-druid-${PRODUCT}-src/patches/apply_patches.sh
38-
COPY --chown=stackable:stackable druid/stackable/patches/${PRODUCT} /stackable/apache-druid-${PRODUCT}-src/patches/${PRODUCT}
38+
COPY --chown=stackable:0 druid/stackable/patches/apply_patches.sh /stackable/apache-druid-${PRODUCT}-src/patches/apply_patches.sh
39+
COPY --chown=stackable:0 druid/stackable/patches/${PRODUCT} /stackable/apache-druid-${PRODUCT}-src/patches/${PRODUCT}
3940

4041
# Cache mounts are owned by root by default
4142
# We need to explicitly give the uid to use which is hardcoded to "1000" in stackable-base
@@ -45,9 +46,9 @@ COPY --chown=stackable:stackable druid/stackable/patches/${PRODUCT} /stackable/a
4546
# with a "directory not empty" error on the first builder to finish, as other builders
4647
# are still working in the cache directory.
4748

48-
RUN --mount=type=cache,id=maven-${PRODUCT},uid=1000,target=/stackable/.m2/repository \
49-
--mount=type=cache,id=npm-${PRODUCT},uid=1000,target=/stackable/.npm \
50-
--mount=type=cache,id=cache-${PRODUCT},uid=1000,target=/stackable/.cache \
49+
RUN --mount=type=cache,id=maven-${PRODUCT},uid=${STACKABLE_USER_UID},target=/stackable/.m2/repository \
50+
--mount=type=cache,id=npm-${PRODUCT},uid=${STACKABLE_USER_UID},target=/stackable/.npm \
51+
--mount=type=cache,id=cache-${PRODUCT},uid=${STACKABLE_USER_UID},target=/stackable/.cache \
5152
<<EOF
5253
curl "https://repo.stackable.tech/repository/packages/druid/apache-druid-${PRODUCT}-src.tar.gz" | tar -xzC .
5354
cd apache-druid-${PRODUCT}-src
@@ -79,6 +80,7 @@ FROM stackable/image/java-base AS final
7980

8081
ARG PRODUCT
8182
ARG RELEASE
83+
ARG STACKABLE_USER_UID
8284

8385
ARG NAME="Apache Druid"
8486
ARG DESCRIPTION="This image is deployed by the Stackable Operator for Apache Druid"
@@ -102,27 +104,29 @@ LABEL io.openshift.tags="ubi9,stackable,druid,sdp"
102104
LABEL io.k8s.description="${DESCRIPTION}"
103105
LABEL io.k8s.display-name="${NAME}"
104106

107+
108+
COPY --chown=${STACKABLE_USER_UID}:0 --from=druid-builder /stackable/apache-druid-${PRODUCT} /stackable/apache-druid-${PRODUCT}
109+
COPY --chown=${STACKABLE_USER_UID}:0 druid/stackable/bin /stackable/bin
110+
COPY --chown=${STACKABLE_USER_UID}:0 druid/licenses /licenses
111+
105112
RUN <<EOF
106113
microdnf update
107114
microdnf clean all
108115
rpm -qa --qf "%{NAME}-%{VERSION}-%{RELEASE}\n" | sort > /stackable/package_manifest.txt
109116
rm -rf /var/cache/yum
110-
EOF
111-
112-
USER stackable
113-
WORKDIR /stackable
114-
115-
COPY --chown=stackable:stackable --from=druid-builder /stackable/apache-druid-${PRODUCT} /stackable/apache-druid-${PRODUCT}
116-
COPY --chown=stackable:stackable druid/stackable/bin /stackable/bin
117-
COPY --chown=stackable:stackable druid/licenses /licenses
118117

119-
RUN <<EOF
120118
ln -s /stackable/apache-druid-${PRODUCT} /stackable/druid
121119

122120
# Force to overwrite the existing 'run-druid'
123121
ln -sf /stackable/bin/run-druid /stackable/druid/bin/run-druid
122+
123+
# All files and folders owned by root to support running as arbitrary users
124+
# This is best practice as all container users will belong to the root group (0)
125+
chown -R ${STACKABLE_USER_UID}:0 /stackable
126+
chmod -R g=u /stackable
124127
EOF
125128

129+
USER ${STACKABLE_USER_UID}
126130
ENV PATH="${PATH}":/stackable/druid/bin
127131

128132
WORKDIR /stackable/druid

0 commit comments

Comments
 (0)