lsm/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2025-11-09 07:24:45 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

docker containers: add non-root user (#7399)

Browse Source 
* add non-root user

* using -g more clearly expresses the intent of setting the primary group for the new user

* no cache

* read only

* specific perm
This commit is contained in:
Chris Lu
2025-10-28 14:58:10 -07:00
committed by GitHub
parent 7d26c8838f
commit b8bef0328b
4 changed files with 44 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docker/Dockerfile.go_build
View File

@@ -15,7 +15,11 @@ COPY --from=builder /go/bin/weed /usr/bin/
RUN mkdir -p /etc/seaweedfs RUN mkdir -p /etc/seaweedfs
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
RUN apk add fuse # for weed mount
# Install dependencies and create non-root user
RUN apk add --no-cache fuse && \
addgroup -g 1000 seaweed && \
adduser -D -u 1000 -g seaweed seaweed
# volume server gprc port # volume server gprc port
EXPOSE 18080 EXPOSE 18080
@@ -34,11 +38,15 @@ EXPOSE 8333
# webdav server http port # webdav server http port
EXPOSE 7333 EXPOSE 7333
RUN mkdir -p /data/filerldb2 # Create data directory and set proper ownership for seaweed user
RUN mkdir -p /data/filerldb2 && \
chown -R seaweed:seaweed /data && \
chmod 755 /entrypoint.sh
VOLUME /data VOLUME /data
WORKDIR /data WORKDIR /data
RUN chmod +x /entrypoint.sh # Switch to non-root user
USER seaweed
ENTRYPOINT ["/entrypoint.sh"] ENTRYPOINT ["/entrypoint.sh"]

15
docker/Dockerfile.local
View File

@@ -6,8 +6,11 @@ COPY ./weed_sub* /usr/bin/
RUN mkdir -p /etc/seaweedfs RUN mkdir -p /etc/seaweedfs
COPY ./filer.toml /etc/seaweedfs/filer.toml COPY ./filer.toml /etc/seaweedfs/filer.toml
COPY ./entrypoint.sh /entrypoint.sh COPY ./entrypoint.sh /entrypoint.sh
RUN apk add fuse # for weed mount
RUN apk add curl # for health checks # Install dependencies and create non-root user
RUN apk add --no-cache fuse curl && \
addgroup -g 1000 seaweed && \
adduser -D -u 1000 -g seaweed seaweed
# volume server grpc port # volume server grpc port
EXPOSE 18080 EXPOSE 18080
@@ -26,11 +29,15 @@ EXPOSE 8333
# webdav server http port # webdav server http port
EXPOSE 7333 EXPOSE 7333
RUN mkdir -p /data/filerldb2 # Create data directory and set proper ownership for seaweed user
RUN mkdir -p /data/filerldb2 && \
chown -R seaweed:seaweed /data && \
chmod 755 /entrypoint.sh
VOLUME /data VOLUME /data
WORKDIR /data WORKDIR /data
RUN chmod +x /entrypoint.sh # Switch to non-root user
USER seaweed
ENTRYPOINT ["/entrypoint.sh"] ENTRYPOINT ["/entrypoint.sh"]

14
docker/Dockerfile.rocksdb_large
View File

@@ -32,7 +32,11 @@ COPY --from=builder /go/bin/weed /usr/bin/
RUN mkdir -p /etc/seaweedfs RUN mkdir -p /etc/seaweedfs
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.toml /etc/seaweedfs/filer.toml COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.toml /etc/seaweedfs/filer.toml
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
RUN apk add fuse snappy gflags
# Install dependencies and create non-root user
RUN apk add --no-cache fuse snappy gflags && \
addgroup -g 1000 seaweed && \
adduser -D -u 1000 -g seaweed seaweed
# volume server gprc port # volume server gprc port
EXPOSE 18080 EXPOSE 18080
@@ -51,12 +55,16 @@ EXPOSE 8333
# webdav server http port # webdav server http port
EXPOSE 7333 EXPOSE 7333
RUN mkdir -p /data/filer_rocksdb # Create data directory and set proper ownership for seaweed user
RUN mkdir -p /data/filer_rocksdb && \
chown -R seaweed:seaweed /data && \
chmod 755 /entrypoint.sh
VOLUME /data VOLUME /data
WORKDIR /data WORKDIR /data
RUN chmod +x /entrypoint.sh # Switch to non-root user
USER seaweed
ENTRYPOINT ["/entrypoint.sh"] ENTRYPOINT ["/entrypoint.sh"]

14
docker/Dockerfile.rocksdb_large_local
View File

@@ -15,7 +15,11 @@ COPY --from=builder /go/bin/weed /usr/bin/
RUN mkdir -p /etc/seaweedfs RUN mkdir -p /etc/seaweedfs
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.toml /etc/seaweedfs/filer.toml COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb.toml /etc/seaweedfs/filer.toml
COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
RUN apk add fuse snappy gflags tmux
# Install dependencies and create non-root user
RUN apk add --no-cache fuse snappy gflags tmux && \
addgroup -g 1000 seaweed && \
adduser -D -u 1000 -g seaweed seaweed
# volume server gprc port # volume server gprc port
EXPOSE 18080 EXPOSE 18080
@@ -34,12 +38,16 @@ EXPOSE 8333
# webdav server http port # webdav server http port
EXPOSE 7333 EXPOSE 7333
RUN mkdir -p /data/filer_rocksdb # Create data directory and set proper ownership for seaweed user
RUN mkdir -p /data/filer_rocksdb && \
chown -R seaweed:seaweed /data && \
chmod 755 /entrypoint.sh
VOLUME /data VOLUME /data
WORKDIR /data WORKDIR /data
RUN chmod +x /entrypoint.sh # Switch to non-root user
USER seaweed
ENTRYPOINT ["/entrypoint.sh"] ENTRYPOINT ["/entrypoint.sh"]