Merge pull request #17 from iris-connect/feature/nonrootimage

chore: creates and uses the non-privileged user iris in EPS Docker files

.scripts/entrypoint-eps.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if ! su iris -c "find ./settings -type f -exec cat {} > /dev/null +"; then
+    chown -R iris:iris ./settings
+fi
+
+exec su iris -c "./eps $*"

.scripts/entrypoint-proxy.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if ! su iris -c "find ./settings -type f -exec cat {} > /dev/null +"; then
+    chown -R iris:iris ./settings
+fi
+
+exec su iris -c "./proxy $*"

.scripts/entrypoint-sd.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if ! su iris -c "find ./settings -type f -exec cat {} > /dev/null +"; then
+    chown -R iris:iris ./settings
+fi
+
+exec su iris -c "./sd $*"

docker/Eps.dockerfile

@@ -14,6 +14,11 @@ COPY . .
 RUN make
 
 FROM alpine:latest
+
+# Create a group and user
+RUN addgroup --gid 9999 iris && adduser --disabled-password --gecos '' --uid 9999 -G iris -s /bin/ash iris
+
 WORKDIR /app
-COPY --from=builder /go/bin/eps /app/eps
-ENTRYPOINT ["./eps"]
+COPY --from=builder /go/bin/eps /app/.scripts/entrypoint-eps.sh /app/
+
+ENTRYPOINT ["/bin/sh", "./entrypoint-eps.sh"]

docker/InternalServer.dockerfile

@@ -14,6 +14,12 @@ COPY . .
 RUN make examples
 
 FROM alpine:latest
+
+# Create a group and user
+RUN addgroup --gid 9999 iris && adduser --disabled-password --gecos '' --uid 9999 -G iris -s /bin/ash iris
+# Change to non-root privilege
+USER iris:iris
+
 WORKDIR /app
 COPY --from=builder /go/bin/internal-server /app/internal-server
 ENTRYPOINT ["./internal-server"]

docker/Proxy.dockerfile

@@ -14,6 +14,11 @@ COPY . .
 RUN make
 
 FROM alpine:latest
+
+# Create a group and user
+RUN addgroup --gid 9999 iris && adduser --disabled-password --gecos '' --uid 9999 -G iris -s /bin/ash iris
+
 WORKDIR /app
-COPY --from=builder /go/bin/proxy /app/proxy
-ENTRYPOINT ["./proxy"]
+COPY --from=builder /go/bin/proxy /app/.scripts/entrypoint-proxy.sh /app/
+
+ENTRYPOINT ["/bin/sh", "./entrypoint-proxy.sh"]

docker/Scripts.dockerfile

@@ -4,6 +4,7 @@ RUN apk add --update bash
 RUN apk add --update coreutils && rm -rf /var/cache/apk/*
 RUN bash --version
 RUN bash
+
 WORKDIR /app
 COPY . .
 ENTRYPOINT [ "make" ]

docker/Sd.dockerfile

@@ -14,6 +14,11 @@ COPY . .
 RUN make
 
 FROM alpine:latest
+
+# Create a group and user
+RUN addgroup --gid 9999 iris && adduser --disabled-password --gecos '' --uid 9999 -G iris -s /bin/ash iris
+
 WORKDIR /app
-COPY --from=builder /go/bin/sd /app/sd
-ENTRYPOINT ["./sd"]
+COPY --from=builder /go/bin/sd /app/.scripts/entrypoint-sd.sh /app/
+
+ENTRYPOINT ["/bin/sh", "./entrypoint-sd.sh"]