Skip to content

Commit 6b80177

Browse files
adamretteradamretter
committed
[feature] Run Elemental Server under a dedicated service account ('edb01') in the Docker Container
1 parent fef72ea commit 6b80177

File tree

2 files changed

+47
-18
lines changed

2 files changed

+47
-18
lines changed

‎exist-docker/src/main/resources-filtered/Dockerfile‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121

2222
### START: Container build time args for Elemental Server
2323
##
24+
# Names of the Linux user account and group to run the Elemental Server service under
25+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT="edb01"
26+
ARG ELEMENTAL_SERVER_SERVICE_GROUP="edb01"
27+
2428
# Elemental data cache size
2529
ARG ELEMENTAL_SERVER_CACHE_MEM="256"
2630
# Elemental maximum number of database brokers
@@ -43,6 +47,10 @@ ARG ADDITIONAL_JAVA_TOOL_OPTIONS
4347
# Install latest JRE 21 in Chainguard Wolfi temporary builder image
4448
FROM cgr.dev/chainguard/wolfi-base AS builder
4549

50+
# Inherit global args to this build stage
51+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
52+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
53+
4654
RUN apk update && apk upgrade
4755
# Install dependencies needed for JRE
4856
RUN apk add tzdata zlib libjpeg-turbo libpng lcms2 freetype ttf-dejavu fontconfig-config libfontconfig1 expat libuuid libbrotlicommon1 libbrotlidec1 libbrotlienc1 libcrypt1
@@ -51,11 +59,17 @@ RUN apk add ca-certificates java-cacerts
5159
# Install latest JRE
5260
RUN apk add openjdk-21-jre
5361

62+
# Add Elemental Server service group and account
63+
RUN addgroup -S ${ELEMENTAL_SERVER_SERVICE_GROUP} \
64+
&& adduser -S -G ${ELEMENTAL_SERVER_SERVICE_GROUP} -H -h /nonexistent -s /sbin/nologin -g "Elemental Database Server - Instance 01" ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
65+
5466

5567
# Use Chainguard distroless glibc base for dynamically linked libraries
5668
FROM cgr.dev/chainguard/glibc-dynamic:latest
5769

5870
# Inherit global args to this build stage
71+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
72+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
5973
ARG ELEMENTAL_SERVER_CACHE_MEM
6074
ARG ELEMENTAL_SERVER_MAX_BROKER
6175
ARG JVM_MAX_RAM_PERCENTAGE
@@ -93,17 +107,22 @@ COPY --from=builder /usr/share/ca-certificates /usr/share/ca-certificates
93107
# Copy over updated JRE from Wolfi
94108
COPY --from=builder /usr/lib/jvm/java-21-openjdk /usr/lib/jvm/java-21-openjdk
95109

96-
# Switch to nonroot user
97-
USER nonroot
110+
# Copy Elemental Server service group and account
111+
COPY --from=builder --chown=root:root --chmod=0644 /etc/passwd /etc/passwd
112+
COPY --from=builder --chown=root:root --chmod=0644 /etc/group /etc/group
113+
COPY --from=builder --chown=root:root --chmod=0600 /etc/shadow /etc/shadow
114+
115+
# Switch to Elemental Server service account
116+
USER ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
98117

99118
# Copy Elemental
100-
COPY --chmod=0555 logs /elemental
101-
COPY --chmod=0444 LICENSE /elemental/LICENSE
102-
COPY --chmod=0570 autodeploy /elemental/autodeploy
103-
COPY --chmod=0570 etc /elemental/etc
104-
COPY --chmod=0550 lib /elemental/lib
105-
COPY --chown=nonroot --chmod=0750 logs /elemental/logs
106-
COPY --chown=nonroot --chmod=0750 logs /elemental/data
119+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0555 logs /elemental
120+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0444 LICENSE /elemental/LICENSE
121+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 autodeploy /elemental/autodeploy
122+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 etc /elemental/etc
123+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0550 lib /elemental/lib
124+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/logs
125+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/data
107126

108127
# Build-time metadata as defined at http://label-schema.org
109128
# and used by autobuilder @hooks/build

‎exist-docker/src/main/resources-filtered/Dockerfile-DEBUG‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@
2121

2222
### START: Container build time args for Elemental Server
2323
##
24+
# Names of the Linux user account and group to run the Elemental Server service under
25+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT="edb01"
26+
ARG ELEMENTAL_SERVER_SERVICE_GROUP="edb01"
27+
2428
# Elemental data cache size
2529
ARG ELEMENTAL_SERVER_CACHE_MEM="256"
2630
# Elemental maximum number of database brokers
@@ -50,6 +54,8 @@ ARG ADDITIONAL_JAVA_TOOL_OPTIONS
5054
FROM cgr.dev/chainguard/wolfi-base
5155

5256
# Inherit global args to this build stage
57+
ARG ELEMENTAL_SERVER_SERVICE_ACCOUNT
58+
ARG ELEMENTAL_SERVER_SERVICE_GROUP
5359
ARG ELEMENTAL_SERVER_CACHE_MEM
5460
ARG ELEMENTAL_SERVER_MAX_BROKER
5561
ARG JVM_MAX_RAM_PERCENTAGE
@@ -66,17 +72,21 @@ RUN apk add ca-certificates java-cacerts
6672
# Install latest JDK
6773
RUN apk add openjdk-21
6874

69-
# Switch to nonroot user
70-
USER nonroot
75+
# Add Elemental Server service group and account
76+
RUN addgroup -S ${ELEMENTAL_SERVER_SERVICE_GROUP} \
77+
&& adduser -S -G ${ELEMENTAL_SERVER_SERVICE_GROUP} -H -h /nonexistent -s /sbin/nologin -g "Elemental Database Server - Instance 01" ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
78+
79+
# Switch to Elemental Server service account
80+
USER ${ELEMENTAL_SERVER_SERVICE_ACCOUNT}
7181

7282
# Copy Elemental
73-
COPY --chmod=0555 logs /elemental
74-
COPY --chmod=0444 LICENSE /elemental/LICENSE
75-
COPY --chmod=0570 autodeploy /elemental/autodeploy
76-
COPY --chmod=0570 etc /elemental/etc
77-
COPY --chmod=0550 lib /elemental/lib
78-
COPY --chown=nonroot --chmod=0750 logs /elemental/logs
79-
COPY --chown=nonroot --chmod=0750 logs /elemental/data
83+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0555 logs /elemental
84+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0444 LICENSE /elemental/LICENSE
85+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 autodeploy /elemental/autodeploy
86+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0570 etc /elemental/etc
87+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0550 lib /elemental/lib
88+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/logs
89+
COPY --chown=${ELEMENTAL_SERVER_SERVICE_ACCOUNT}:${ELEMENTAL_SERVER_SERVICE_GROUP} --chmod=0750 logs /elemental/data
8090

8191
# Build-time metadata as defined at http://label-schema.org
8292
# and used by autobuilder @hooks/build

0 commit comments

Comments
 (0)