Skip to content

Commit b6f0c39

Browse files
committed
fix(dockerfile-linux): revoke the satosa user's ability to modify the entrypoint script
Guarantee the entrypoint script gets the correct permissions by explicitly setting them at image build time. Note that the COPY command's `--chmod` flag requires BuildKit, which may not work in all environments.
1 parent f39d2b9 commit b6f0c39

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Dockerfile-linux.template

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,8 @@ RUN set -eux; \
124124
VOLUME /etc/satosa
125125
WORKDIR /etc/satosa
126126

127-
COPY --chown=satosa:satosa docker-entrypoint.sh /usr/local/bin/
127+
COPY docker-entrypoint.sh /usr/local/bin/
128+
RUN chmod 0755 /usr/local/bin/docker-entrypoint.sh
128129
ENTRYPOINT ["docker-entrypoint.sh"]
129130

130131
EXPOSE 8080

0 commit comments

Comments
 (0)