Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding support for non-root containers #1584

Open
wants to merge 45 commits into
base: master
Choose a base branch
from
+177 −97
Open

Adding support for non-root containers #1584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
3cf538c
Upgraded s6-overlay to version v3.1.5.0 - Fixed broken build
bsobbe Jul 17, 2023
c2f8fc2
Change to s6-overlay new command path
bsobbe Jul 19, 2023
af959ba
Refactoring scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
deb8892
Refactoring jicofo scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
1f283d7
Refactoring jigasi scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
a984ff8
Refactoring prosody scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
5c97820
Refactoring web scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
e452fec
Upgrade s6-overlay to v3.1.5.0 - making cont-init.d scripts executable
bsobbe Jul 19, 2023
8bb646e
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
b76dd96
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
4524b24
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
f0c374e
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
1d854cc
Refactoring jvb scripts to be s6-overlay v3 friendly
bsobbe Jul 19, 2023
4163e2c
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
13e8663
Make cont-init and services.d scripts executable
bsobbe Jul 19, 2023
2053f9d
Adding noroot user with id 1000 - setting scripts ownership for noroot
bsobbe Jul 19, 2023
9f2d13d
Setting script ownerships to noroot
bsobbe Jul 19, 2023
9831e43
Fixing ownership and permission issues for noroot - setting the user …
bsobbe Jul 19, 2023
b0c08b7
Fixing ownership and permission issues for noroot
bsobbe Jul 19, 2023
493490e
Refactoring paths for s6-overlay v3
bsobbe Jul 19, 2023
93b4cae
Moving this block to dockerfile due to permission issues after switch…
bsobbe Jul 20, 2023
339c6f6
Fixing permission issues - moving /config prepare block - removing le…
bsobbe Jul 20, 2023
e042186
Creating user and group noroot with ids 1000
bsobbe Jul 20, 2023
5b3c8af
Changing /var ownership to noroot:noroot
bsobbe Jul 20, 2023
a88e09a
Removing legacy command
bsobbe Jul 20, 2023
6ac6ca6
Fixing permission issues due to noroot - moving root specific operati…
bsobbe Jul 20, 2023
5020778
Moving back some commands to init config
bsobbe Jul 24, 2023
d224159
Moving back some commands to init config
bsobbe Jul 24, 2023
2491511
Fixing issues with permissions and moving some init commands to docke…
bsobbe Jul 24, 2023
ca8f66a
Refactoring for s6 overlay v3
bsobbe Jul 24, 2023
d3e63ef
Cleaning up commands that moved to dockerfile
bsobbe Jul 24, 2023
63e15d7
Fixing permission issue causing prosody tls not being loaded
bsobbe Jul 25, 2023
0a337ab
Fixing permission issues for noroot
bsobbe Aug 1, 2023
7a92697
Changing directory to get over tls certificate permission issue - upd…
bsobbe Aug 1, 2023
62633f7
Change user to noroot - change ownerships and permissions - update sc…
bsobbe Aug 1, 2023
a9c7328
Change user to noroot - change ownerships and permissions - update sc…
bsobbe Aug 1, 2023
9264bbf
Comment out build blocks with noroot as UID and GID
bsobbe Aug 1, 2023
e23b95c
Merge pull request #2 from jitsi/master
bsobbe Aug 1, 2023
714e525
Merge pull request #1 from bsobbe/1447-non-root
bsobbe Aug 1, 2023
a5c98ea
Cleaning up Dockerfile - changing bad saslauthd path and ownership
bsobbe Aug 3, 2023
304401f
Cleaning up Dockerfile - fix indent
bsobbe Aug 3, 2023
0ae86e7
Removing comments
bsobbe Aug 3, 2023
0efcf93
Cleaning up Dockerfile - changing how the scripts are being started
bsobbe Aug 3, 2023
d359557
Cleaning up
bsobbe Aug 3, 2023
43c9507
Cleaning up Dockerfile - changing transcripts path
bsobbe Aug 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 16 additions & 7 deletions base/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,32 +4,41 @@ ARG JITSI_RELEASE=stable
ARG TARGETPLATFORM
ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2

COPY rootfs /
RUN groupadd --gid 1000 noroot; \
useradd --uid 1000 --gid 1000 -m noroot

COPY --chown=noroot:noroot rootfs /

RUN case ${TARGETPLATFORM} in \
"linux/amd64") TPL_ARCH=amd64 ;; \
"linux/arm64") TPL_ARCH=arm64 ;; \
esac && \
case ${TARGETPLATFORM} in \
"linux/amd64") S6_ARCH=amd64 ;; \
"linux/amd64") S6_ARCH=x86_64 ;; \
"linux/arm64") S6_ARCH=aarch64 ;; \
esac && \
apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget && \
apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget xz-utils && \
wget -qO /usr/bin/tpl https://github.com/jitsi/tpl/releases/download/v1.0.4/tpl-linux-${TPL_ARCH} && \
wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-${S6_ARCH}.tar.gz | tar xfz - -C / && \
wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v3.1.5.0/s6-overlay-${S6_ARCH}.tar.xz | tar -xJp -C / && \
wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v3.1.5.0/s6-overlay-noarch.tar.xz | tar -xJp -C / && \
wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmour > /etc/apt/trusted.gpg.d/jitsi.gpg && \
echo "deb https://download.jitsi.org $JITSI_RELEASE/" > /etc/apt/sources.list.d/jitsi.list && \
echo "deb http://ftp.debian.org/debian bullseye-backports main" > /etc/apt/sources.list.d/backports.list && \
apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get dist-upgrade -y && \
apt-cleanup && \
chmod +x /usr/bin/tpl

chown -R noroot:noroot /usr/bin/tpl && \
chown -R noroot:noroot /etc/cont-init.d && \
chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /etc/timezone && \
chmod +x /usr/bin/tpl && \
chmod +x /etc/cont-init.d/*

RUN [ "$JITSI_RELEASE" = "unstable" ] && \
apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y jq procps curl vim iputils-ping net-tools && \
apt-cleanup || \
true

ENTRYPOINT [ "/init" ]
ENTRYPOINT [ "/init" ]
2 changes: 1 addition & 1 deletion base/rootfs/etc/cont-init.d/01-set-timezone
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

if [[ ! -z "$TZ" ]]; then
if [[ -f /usr/share/zoneinfo/$TZ ]]; then
Expand Down
32 changes: 29 additions & 3 deletions jibri/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,38 @@ ARG USE_CHROMIUM=0
ARG CHROME_RELEASE=114.0.5735.90
ARG CHROMEDRIVER_MAJOR_RELEASE=114

COPY rootfs/ /
COPY --chown=noroot:noroot rootfs/ /

RUN apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" jibri libgl1-mesa-dri procps jitsi-upload-integrations jitsi-autoscaler-sidecar jq pulseaudio dbus dbus-x11 rtkit unzip fonts-noto && \
/usr/bin/install-chrome.sh && \
apt-cleanup && \
adduser jibri rtkit
apt-cleanup

RUN mkdir -p /etc/jitsi/autoscaler-sidecar && \
mkdir -p /config/logs && \
mkdir -p /config/recordings && \
mkdir -p /home/jibri && chown -R noroot:noroot /home/jibri

RUN chown -R noroot:noroot /etc/cont-init.d && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These 2 are already done in the base image. Is it necessary?

chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /etc/jitsi && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this necessary? Even if files are owned by root we can read them, right?

chown -R noroot:noroot /run && \
chown -R noroot:noroot /config && \
chown -R noroot:noroot /var && \
chown -R noroot:noroot /opt/jitsi && \
chown -R noroot:noroot /tmp && \
chown -R noroot:noroot /defaults && \
chown -R noroot:noroot /usr/bin

RUN chmod +x /etc/cont-init.d/* && \
chmod +x /etc/services.d/10-xorg/* && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any chance we can use wildcards to use a single command here?

chmod +x /etc/services.d/20-icewm/* && \
chmod +x /etc/services.d/30-pulse/* && \
chmod +x /etc/services.d/40-jibri/* && \
chmod +x /etc/services.d/50-autoscaler-sidecar/* && \
chmod +x /opt/jitsi/jibri/launch.sh


USER noroot

VOLUME /config
11 changes: 3 additions & 8 deletions jibri/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

if [[ -z $JIBRI_RECORDER_PASSWORD || -z $JIBRI_XMPP_PASSWORD ]]; then
echo 'FATAL ERROR: Jibri recorder password and auth password must be set'
Expand Down Expand Up @@ -52,7 +52,6 @@ if [ -n "$AUTOSCALER_URL" ]; then
[ -z "$AUTOSCALER_SIDECAR_GROUP_NAME" ] && export AUTOSCALER_SIDECAR_GROUP_NAME="docker-jibri"
[ -z "$LOCAL_ADDRESS" ] && export LOCAL_ADDRESS="$(ip route get 1 | grep -oP '(?<=src ).*' | awk '{ print $1 '})"

mkdir -p /etc/jitsi/autoscaler-sidecar
tpl /defaults/autoscaler-sidecar.config > /etc/jitsi/autoscaler-sidecar/config
else
echo "No key file at $AUTOSCALER_SIDECAR_KEY_FILE, leaving autoscaler sidecar disabled"
Expand All @@ -66,12 +65,8 @@ tpl /defaults/jibri.conf > /etc/jitsi/jibri/jibri.conf
tpl /defaults/logging.properties > /etc/jitsi/jibri/logging.properties
tpl /defaults/xorg-video-dummy.conf > /etc/jitsi/jibri/xorg-video-dummy.conf

# make recording dir
# set recording dir
[ -z "${JIBRI_RECORDING_DIR}" ] && export JIBRI_RECORDING_DIR=/config/recordings
mkdir -p ${JIBRI_RECORDING_DIR}
chown -R jibri ${JIBRI_RECORDING_DIR}

# make logs dir
# set logs dir
JIBRI_LOGS_DIR=/config/logs
mkdir -p ${JIBRI_LOGS_DIR}
chown -R jibri ${JIBRI_LOGS_DIR}
4 changes: 2 additions & 2 deletions jibri/rootfs/etc/services.d/10-xorg/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

DAEMON="/usr/bin/Xorg -nocursor -noreset +extension RANDR +extension RENDER -logfile /tmp/xorg.log -config /etc/jitsi/jibri/xorg-video-dummy.conf ${DISPLAY}"
exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
exec /bin/bash -c "exec $DAEMON"

4 changes: 2 additions & 2 deletions jibri/rootfs/etc/services.d/20-icewm/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

DAEMON="/usr/bin/icewm-session"
exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
exec /bin/bash -c "exec $DAEMON"

4 changes: 2 additions & 2 deletions jibri/rootfs/etc/services.d/30-pulse/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

HOME=/home/jibri
exec s6-setuidgid jibri /bin/bash -c "exec /usr/bin/pulseaudio"
exec /bin/bash -c "exec /usr/bin/pulseaudio"
2 changes: 1 addition & 1 deletion jibri/rootfs/etc/services.d/40-jibri/finish
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

# When jibri is shutdown (or gracefully shutdown), it exits with code 255.
# In this case, we don't want S6 to restart the service. We want to stop all
Expand Down
6 changes: 3 additions & 3 deletions jibri/rootfs/etc/services.d/40-jibri/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

# we have to set it, otherwise chrome won't find ~/.asoundrc file
HOME=/home/jibri

DAEMON=/opt/jitsi/jibri/launch.sh
# pre-warm google chrome before jibri launches to ensure fast chrome launch during recordings
s6-setuidgid jibri /usr/bin/google-chrome --timeout=1000 --headless about:blank
exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
/usr/bin/google-chrome --timeout=1000 --headless about:blank
exec /bin/bash -c "exec $DAEMON"

4 changes: 2 additions & 2 deletions jibri/rootfs/etc/services.d/50-autoscaler-sidecar/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

if [[ -n "$AUTOSCALER_URL" ]] && [[ -f "/etc/jitsi/autoscaler-sidecar/config" ]]; then
DAEMON="/usr/bin/node /usr/share/jitsi-autoscaler-sidecar/app.js"
exec s6-setuidgid autoscaler-sidecar /bin/bash -c ". /etc/jitsi/autoscaler-sidecar/config && exec $DAEMON"
exec autoscaler-sidecar /bin/bash -c ". /etc/jitsi/autoscaler-sidecar/config && exec $DAEMON"
else
# if autoscaler-sidecar should not be started,
# prevent s6 from restarting this script again and again
Expand Down
17 changes: 16 additions & 1 deletion jicofo/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,21 @@ RUN apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y jicofo && \
apt-cleanup

COPY rootfs/ /
COPY --chown=noroot:noroot rootfs/ /

RUN chown -R noroot:noroot /etc/cont-init.d && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same, is this necessary? If it is, which I'd like you to double-check, let's a script in the base image which all mages call, instead of duplicating the code on each of them.

chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /run && \
chown -R noroot:noroot /var && \
chown -R noroot:noroot /usr/share/jicofo && \
chown -R noroot:noroot /etc/jitsi && \
chown -R noroot:noroot /etc/jitsi/jicofo && \
mkdir -p /config && chown -R noroot:noroot /config
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should go on the base image.


RUN chmod +x /usr/share/jicofo/jicofo.sh && \
chmod +x /etc/cont-init.d/* && \
chmod +x /etc/services.d/jicofo/*

USER noroot

VOLUME /config
4 changes: 1 addition & 3 deletions jicofo/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

export SENTRY_RELEASE="${SENTRY_RELEASE:-$(apt-cache policy jicofo | sed -n '/Installed/p' | sed -e 's/[^:]*: //')}"

Expand All @@ -15,5 +15,3 @@ fi

tpl /defaults/logging.properties > /config/logging.properties
tpl /defaults/jicofo.conf > /config/jicofo.conf

chown -R jicofo:jitsi /config
4 changes: 2 additions & 2 deletions jicofo/rootfs/etc/services.d/jicofo/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

JAVA_SYS_PROPS="-Djava.util.logging.config.file=/config/logging.properties -Dconfig.file=/config/jicofo.conf"
DAEMON=/usr/share/jicofo/jicofo.sh
DAEMON_DIR=/usr/share/jicofo/

exec s6-setuidgid jicofo /bin/bash -c "cd $DAEMON_DIR; JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON"
exec /bin/bash -c "cd $DAEMON_DIR; JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON"
17 changes: 15 additions & 2 deletions jigasi/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,19 @@ RUN apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y jigasi jq && \
apt-cleanup

COPY rootfs/ /
COPY --chown=noroot:noroot rootfs/ /

VOLUME ["/config", "/tmp/transcripts"]
RUN chown -R noroot:noroot /etc/cont-init.d && \
chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /usr/share && \
chown -R noroot:noroot /defaults && \
mkdir -pm777 /config/transcripts && \
mkdir -p /config && chown -R noroot:noroot /config

RUN chmod +x /etc/cont-init.d/* && \
chmod +x /etc/services.d/jigasi/* && \
chmod +x /usr/share/jigasi/jigasi.sh

USER noroot

VOLUME /config
2 changes: 1 addition & 1 deletion jigasi/rootfs/defaults/sip-communicator.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ net.java.sip.communicator.service.gui.ALWAYS_TRUST_MODE_ENABLED=true
# Transcription config
org.jitsi.jigasi.ENABLE_TRANSCRIPTION=true
org.jitsi.jigasi.transcription.ENABLE_TRANSLATION=true
org.jitsi.jigasi.transcription.DIRECTORY=/tmp/transcripts
org.jitsi.jigasi.transcription.DIRECTORY=/config/transcripts
org.jitsi.jigasi.transcription.BASE_URL={{ .Env.PUBLIC_URL }}/transcripts
org.jitsi.jigasi.transcription.jetty.port=-1
org.jitsi.jigasi.transcription.ADVERTISE_URL={{ .Env.JIGASI_TRANSCRIBER_ADVERTISE_URL | default "false"}}
Expand Down
4 changes: 1 addition & 3 deletions jigasi/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

export SENTRY_RELEASE="${SENTRY_RELEASE:-$(apt-cache policy jigasi | sed -n '/Installed/p' | sed -e 's/[^:]*: //')}"

Expand All @@ -20,8 +20,6 @@ if [[ -f /config/custom-sip-communicator.properties ]]; then
cat /config/custom-sip-communicator.properties >> /config/sip-communicator.properties
fi

mkdir -pm777 /tmp/transcripts
chown jigasi:jitsi /tmp/transcripts

# Create Google Cloud Credentials
if [[ $ENABLE_TRANSCRIPTIONS -eq 1 || $ENABLE_TRANSCRIPTIONS == "true" ]]; then
Expand Down
4 changes: 2 additions & 2 deletions jigasi/rootfs/etc/services.d/jigasi/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

JAVA_SYS_PROPS="-Djava.util.logging.config.file=/config/logging.properties"

DAEMON=/usr/share/jigasi/jigasi.sh
DAEMON_OPTS="--nocomponent=true --configdir=/ --configdirname=config --min-port=${JIGASI_PORT_MIN:-20000} --max-port=${JIGASI_PORT_MAX:-20050}"

exec s6-setuidgid jigasi /bin/bash -c "JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON $DAEMON_OPTS"
exec /bin/bash -c "JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON $DAEMON_OPTS"
13 changes: 12 additions & 1 deletion jvb/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,17 @@ RUN apt-dpkg-wrap apt-get update && \
apt-dpkg-wrap apt-get install -y jitsi-videobridge2 jq curl iproute2 dnsutils && \
apt-cleanup

COPY rootfs/ /
COPY --chown=noroot:noroot rootfs/ /

RUN chown -R noroot:noroot /etc/cont-init.d && \
chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /run && \
chown -R noroot:noroot /var && \
mkdir -p /config && chown -R noroot:noroot /config

RUN chmod +x /etc/cont-init.d/* && \
chmod +x /etc/services.d/jvb/*

USER noroot

VOLUME /config
8 changes: 3 additions & 5 deletions jvb/rootfs/etc/cont-init.d/10-config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

if [[ -z $JVB_AUTH_PASSWORD ]]; then
echo 'FATAL ERROR: JVB auth password must be set'
Expand Down Expand Up @@ -38,10 +38,8 @@ fi
tpl /defaults/logging.properties > /config/logging.properties
tpl /defaults/jvb.conf > /config/jvb.conf

chown -R jvb:jitsi /config

# Configuration checks
if [[ (-z $ENABLE_COLIBRI_WEBSOCKET || $ENABLE_COLIBRI_WEBSOCKET == "0") && $ENABLE_OCTO == "1" ]]; then
echo "ERROR: In order to enable Octo relays (with ENABLE_OCTO=1), you MUST enable Colibri websockets (with ENABLE_COLIBRI_WEBSOCKET=1)";
exit 1;
echo "ERROR: In order to enable Octo relays (with ENABLE_OCTO=1), you MUST enable Colibri websockets (with ENABLE_COLIBRI_WEBSOCKET=1)";
exit 1;
fi
4 changes: 2 additions & 2 deletions jvb/rootfs/etc/services.d/jvb/run
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/with-contenv bash
#!/command/with-contenv bash

export JAVA_SYS_PROPS="-Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION=/ -Dnet.java.sip.communicator.SC_HOME_DIR_NAME=config -Djava.util.logging.config.file=/config/logging.properties -Dconfig.file=/config/jvb.conf"

DAEMON=/usr/share/jitsi-videobridge/jvb.sh

exec s6-setuidgid jvb /bin/bash -c "exec $DAEMON"
exec /bin/bash -c "exec $DAEMON"
31 changes: 28 additions & 3 deletions prosody/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,11 +61,36 @@ RUN wget -qO /etc/apt/trusted.gpg.d/prosody.gpg https://prosody.im/files/prosody
mv prosody-mod-auth-matrix-user-verification-$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN/mod_matrix_power_sync.lua /prosody-plugins && \
rm -rf prosody-mod-auth-matrix-user-verification-$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN v$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN.tar.gz

COPY rootfs/ /
COPY --chown=noroot:noroot rootfs/ /

COPY --from=builder /usr/local/lib/lua/5.4 /usr/local/lib/lua/5.4
COPY --from=builder /usr/local/share/lua/5.4 /usr/local/share/lua/5.4
COPY --chown=noroot:noroot --from=builder /usr/local/lib/lua/5.4 /usr/local/lib/lua/5.4
COPY --chown=noroot:noroot --from=builder /usr/local/share/lua/5.4 /usr/local/share/lua/5.4

RUN mkdir -pm777 /var/run/saslauthd && \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use a single RUN block, here and elsewhere.

mkdir -p /config/noroot_data && \
mkdir -p /config/certs && \
mkdir -p /config/conf.d && \
mkdir -p /prosody-plugins-custom

RUN chown -R noroot:noroot /etc/cont-init.d && \
chown -R noroot:noroot /etc/services.d && \
chown -R noroot:noroot /etc/ldap && \
chown -R noroot:noroot /run && \
chown -R noroot:noroot /var && \
chown -R noroot:noroot /defaults && \
chown -R noroot:noroot /prosody-plugins && \
chown -R noroot:noroot /prosody-plugins-custom && \
mkdir -p /config/saslauthd

RUN chmod +x /etc/cont-init.d/* && \
chmod +x /etc/services.d/10-saslauthd/* && \
chmod +x /etc/services.d/prosody/*

RUN cp -r /defaults/* /config
RUN chown -R noroot:noroot /config

EXPOSE 5222 5280

USER noroot

VOLUME ["/config", "/prosody-plugins-custom"]
2 changes: 1 addition & 1 deletion prosody/rootfs/defaults/prosody.cfg.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@ http_interfaces = { "*", "::" }
http_interfaces = { "*" }
{{ end }}

data_path = "/config/data"
data_path = "/config/noroot_data"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't do this please. It will break existing installations for no good reason.

Copy link
Author

@bsobbe bsobbe Aug 2, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the only way I could get over permission issues while generating TLS certificates by prosody to /config/data.
it appears to me that something sets the permission of /config/data to root no matter what we set it in the Dockerfile. After creating noroot_data and setting the right ownerships, the SSL issue was solved and I was finally able to make a call. otherwise, JVB and Jicofo both failed while trying to reach prosody internally because it doesn't have cert files.

If you have any ideas that can preserve the current setup and still solve the SSL issue with this user I am definitely open to hearing. but I'm curious to know why this will break the existing installations. since the /config/data is still there and the prosody PID is also still in /config/data. this is just changing the data directory to noroot_data to be able to generate SSLs. It appears to me that once the 10-config script is done it will even move the certificates to /config/certs and removes them from noroot_data at the end of the file.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What user does the 10-config script run as? A cursory look at https://github.com/bjc/prosody/blob/master/util/prosodyctl/cert.lua reveals some ownership changes if the user is root. Or maybe we should set prosody_user and prosody_group to the new user on the config file.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The user is noroot, with user and group ids = 1000. I bet that's why it can't create the certs in /config/data since apparently we can't change that one's ownership but it can create the certs in noroot_data and move them to the correct location since it's the owner. I could not find a better way to make this work, so I reverted it back to noroot_data so prosody doesn't break.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But we can configure the prosody user and group with the options I showed above, did you test that? Why can noroot create stuff in /config/data tough?

We need to fix this before this PR can land.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it uses ~= that line checks if the user is NOT root and is NOT the owner of the certs directory, doesn't it? Maybe try creating the certs directory inside data?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@saghul yes precisely. our uid = 1000 and the owner is root:daemon. therefore we hit that if statement and get the error: The directory /config/data is not owned by the current user, won't be able to write files to it.

I don't see why putting /config/certs directory inside/config/datawould help solve this problem. I feel like there is a misunderstanding about the nature of the issue. Ownership over /config/certs is not the issue here. Ownership over /config/data is the actual problem.
Prosody expects noroot to be the owner of that directory. But, regardless of changing that ownership to noroot in the dockerfile, something always overwrites its ownership to root:daemon. My guess is it has something to do with prosody.pid being there (not actually sure if it can be because of this).

The bottom line is, if we can't use noroot_data as a temp path for generating certificates, we need to find a way to change ownership of /config/data. Otherwise, it will keep trying to write the certs in that one and floods the container log with failed to load TLS certificates errors.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes precisely. our uid = 1000 and the owner is root:daemon. therefore we hit that if statement and get the error: The directory /config/data is not owned by the current user, won't be able to write files to it.

Oh hold on. Why can't we change the permissions of that?

But, regardless of changing that ownership to noroot in the dockerfile, something always overwrites its ownership to root:daemon. My guess is it has something to do with prosody.pid being there (not actually sure if it can be because of this).

Aha. Maybe try with chattr -i ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@saghul did not work. tried this:
// to install chattr cause it did not exist by default.
RUN apt-get install -y e2fsprogs
// Create /config/data (cause it does not exist at this stage) - change ownership - change attribute and remove immutability.
RUN mkdir -p /config/data && chown -R noroot:noroot /config/data && chattr -R -i /config/data

all of that resulted in:
│ The directory /config/data is not owned by the current user, won't be able to write files to it │
│ The directory /config/data is not owned by the current user, won't be able to write files to it │
│ mv: cannot stat '/config/data/.crt': No such file or directory │
│ mv: cannot stat '/config/data/.key': No such file or directory

same old same old.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hum, that's very odd, as if the user running prosodyctl is root or something. Can you please take care of the rest of the items and leave this one for last? I'll try to take a look too.


smacks_max_unacked_stanzas = 5;
smacks_hibernation_time = 60;
Expand Down
Loading
Loading