Skip to content

Commit 111e953

Browse files
adamretteradamretter
committed
[feature] Run Elemental Server under a dedicated service account ('edb01') in the Docker Container
1 parent 161f6c7 commit 111e953

File tree

2 files changed

+47
-18
lines changed

2 files changed

+47
-18
lines changed

‎exist-docker/src/main/resources-filtered/Dockerfile‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121

2222
### START: Container build time args for Elemental Server
2323
##
24+
# Names of the Linux user account and group to run the Elemental Server service under
25+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT="edb01"
26+
ARG ELEMENTAL_SERVER_SERVICE_GROUP="edb01"
27+
2428
# Elemental data cache size
2529
ARG ELEMENTAL_SERVER_CACHE_MEM="256"
2630
# Elemental maximum number of database brokers
@@ -44,6 +48,10 @@ ARG ADDITIONAL_JAVA_TOOL_OPTIONS
4448
# Install latest JRE 8 in Chainguard Wolfi temporary builder image
4549
FROM cgr.dev/chainguard/wolfi-base AS builder
4650

51+
# Inherit global args to this build stage
52+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
53+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
54+
4755
RUN apk update && apk upgrade
4856
# Install dependencies needed for JRE
4957
RUN apk add tzdata zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
@@ -52,11 +60,17 @@ RUN apk add ca-certificates java-cacerts
5260
# Install latest JRE
5361
RUN apk add openjdk-8-jre
5462

63+
# Add Elemental Server service group and account
64+
RUN addgroup -S ${ELEMENTAL_SERVER_SERVICE_GROUP} \
65+
&& adduser -S -G ${ELEMENTAL_SERVER_SERVICE_GROUP} -H -h /nonexistent -s /sbin/nologin -g "Elemental Database Server - Instance 01" ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
66+
5567

5668
# Use Chainguard distroless glibc base for dynamically linked libraries
5769
FROM cgr.dev/chainguard/glibc-dynamic:latest
5870

5971
# Inherit global args to this build stage
72+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
73+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
6074
ARG ELEMENTAL_SERVER_CACHE_MEM
6175
ARG ELEMENTAL_SERVER_MAX_BROKER
6276
ARG JVM_MAX_RAM_PERCENTAGE
@@ -94,17 +108,22 @@ COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
94108
# Copy over updated JRE from Wolfi
95109
COPY --from=builder /usr/lib/jvm/java-1.8-openjdk /usr/lib/jvm/java-1.8-openjdk
96110

97-
# Switch to nonroot user
98-
USER nonroot
111+
# Copy Elemental Server service group and account
112+
COPY --from=builder --chown=root:root --chmod=0644 /etc/passwd /etc/passwd
113+
COPY --from=builder --chown=root:root --chmod=0644 /etc/group /etc/group
114+
COPY --from=builder --chown=root:root --chmod=0600 /etc/shadow /etc/shadow
115+
116+
# Switch to Elemental Server service account
117+
USER ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
99118

100119
# Copy Elemental
101-
COPY --chmod=0555 logs /elemental
102-
COPY --chmod=0444 LICENSE /elemental/LICENSE
103-
COPY --chmod=0570 autodeploy /elemental/autodeploy
104-
COPY --chmod=0570 etc /elemental/etc
105-
COPY --chmod=0550 lib /elemental/lib
106-
COPY --chown=nonroot --chmod=0750 logs /elemental/logs
107-
COPY --chown=nonroot --chmod=0750 logs /elemental/data
120+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0555 logs /elemental
121+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0444 LICENSE /elemental/LICENSE
122+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 autodeploy /elemental/autodeploy
123+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 etc /elemental/etc
124+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0550 lib /elemental/lib
125+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/logs
126+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/data
108127

109128
# Build-time metadata as defined at http://label-schema.org
110129
# and used by autobuilder @hooks/build

‎exist-docker/src/main/resources-filtered/Dockerfile-DEBUG‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121

2222
### START: Container build time args for Elemental Server
2323
##
24+
# Names of the Linux user account and group to run the Elemental Server service under
25+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT="edb01"
26+
ARG ELEMENTAL_SERVER_SERVICE_GROUP="edb01"
27+
2428
# Elemental data cache size
2529
ARG ELEMENTAL_SERVER_CACHE_MEM="256"
2630
# Elemental maximum number of database brokers
@@ -50,6 +54,8 @@ ARG ADDITIONAL_JAVA_TOOL_OPTIONS
5054
FROM cgr.dev/chainguard/wolfi-base
5155

5256
# Inherit global args to this build stage
57+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
58+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
5359
ARG ELEMENTAL_SERVER_CACHE_MEM
5460
ARG ELEMENTAL_SERVER_MAX_BROKER
5561
ARG JVM_MAX_RAM_PERCENTAGE
@@ -66,17 +72,21 @@ RUN apk add ca-certificates java-cacerts
6672
# Install latest JDK
6773
RUN apk add openjdk-8
6874

69-
# Switch to nonroot user
70-
USER nonroot
75+
# Add Elemental Server service group and account
76+
RUN addgroup -S ${ELEMENTAL_SERVER_SERVICE_GROUP} \
77+
&& adduser -S -G ${ELEMENTAL_SERVER_SERVICE_GROUP} -H -h /nonexistent -s /sbin/nologin -g "Elemental Database Server - Instance 01" ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
78+
79+
# Switch to Elemental Server service account
80+
USER ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
7181

7282
# Copy Elemental
73-
COPY --chmod=0555 logs /elemental
74-
COPY --chmod=0444 LICENSE /elemental/LICENSE
75-
COPY --chmod=0570 autodeploy /elemental/autodeploy
76-
COPY --chmod=0570 etc /elemental/etc
77-
COPY --chmod=0550 lib /elemental/lib
78-
COPY --chown=nonroot --chmod=0750 logs /elemental/logs
79-
COPY --chown=nonroot --chmod=0750 logs /elemental/data
83+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0555 logs /elemental
84+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0444 LICENSE /elemental/LICENSE
85+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 autodeploy /elemental/autodeploy
86+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 etc /elemental/etc
87+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0550 lib /elemental/lib
88+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/logs
89+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/data
8090

8191
# Build-time metadata as defined at http://label-schema.org
8292
# and used by autobuilder @hooks/build

0 commit comments

Comments
 (0)