Adding support for non-root containers

base/Dockerfile

@@ -4,32 +4,41 @@ ARG JITSI_RELEASE=stable
 ARG TARGETPLATFORM
 ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
-COPY rootfs /
+RUN groupadd --gid 1000 noroot; \
+  useradd --uid 1000 --gid 1000 -m noroot
+
+COPY --chown=noroot:noroot rootfs /
 
 RUN case ${TARGETPLATFORM} in \
          "linux/amd64")  TPL_ARCH=amd64  ;; \
          "linux/arm64")  TPL_ARCH=arm64  ;; \
     esac && \
     case ${TARGETPLATFORM} in \
-         "linux/amd64")  S6_ARCH=amd64  ;; \
+         "linux/amd64")  S6_ARCH=x86_64  ;; \
          "linux/arm64")  S6_ARCH=aarch64  ;; \
     esac && \
     apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget && \
+    apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget xz-utils && \
     wget -qO /usr/bin/tpl https://github.com/jitsi/tpl/releases/download/v1.0.4/tpl-linux-${TPL_ARCH} && \
-    wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-${S6_ARCH}.tar.gz | tar xfz - -C / && \
+    wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v3.1.5.0/s6-overlay-${S6_ARCH}.tar.xz | tar -xJp -C / && \
+    wget -qO - https://github.com/just-containers/s6-overlay/releases/download/v3.1.5.0/s6-overlay-noarch.tar.xz | tar -xJp -C / && \
     wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmour > /etc/apt/trusted.gpg.d/jitsi.gpg && \
     echo "deb https://download.jitsi.org $JITSI_RELEASE/" > /etc/apt/sources.list.d/jitsi.list && \
     echo "deb http://ftp.debian.org/debian bullseye-backports main" > /etc/apt/sources.list.d/backports.list && \
     apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get dist-upgrade -y && \
     apt-cleanup && \
-    chmod +x /usr/bin/tpl
-
+    chown -R noroot:noroot /usr/bin/tpl && \
+    chown -R noroot:noroot /etc/cont-init.d && \
+    chown -R noroot:noroot /etc/services.d && \
+    chown -R noroot:noroot /etc/timezone && \
+    chmod +x /usr/bin/tpl && \
+    chmod +x /etc/cont-init.d/*
+
 RUN [ "$JITSI_RELEASE" = "unstable" ] && \
     apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y jq procps curl vim iputils-ping net-tools && \
     apt-cleanup || \
     true
 
-ENTRYPOINT [ "/init" ]
+ENTRYPOINT [ "/init" ]

base/rootfs/etc/cont-init.d/01-set-timezone

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 if [[ ! -z "$TZ" ]]; then
     if [[ -f /usr/share/zoneinfo/$TZ ]]; then

docker-compose.yml

@@ -4,6 +4,12 @@ services:
     # Frontend
     web:
         image: jitsi/web:${JITSI_IMAGE_VERSION:-unstable}
+        # build:
+        #   context: ./web
+        #   dockerfile: Dockerfile
+        #   args:
+        #     UID: 1000
+        #     GID: 1000
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '${HTTP_PORT}:80'
@@ -162,6 +168,12 @@ services:
     # XMPP server
     prosody:
         image: jitsi/prosody:${JITSI_IMAGE_VERSION:-unstable}
+        # build:
+        #   context: ./prosody
+        #   dockerfile: Dockerfile
+        #   args:
+        #     UID: 1000
+        #     GID: 1000
         restart: ${RESTART_POLICY:-unless-stopped}
         expose:
             - '${XMPP_PORT:-5222}'
@@ -265,6 +277,12 @@ services:
     # Focus component
     jicofo:
         image: jitsi/jicofo:${JITSI_IMAGE_VERSION:-unstable}
+        # build:
+        #   context: ./jicofo
+        #   dockerfile: Dockerfile
+        #   args:
+        #     UID: 1000
+        #     GID: 1000
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '127.0.0.1:${JICOFO_REST_PORT:-8888}:8888'
@@ -334,6 +352,12 @@ services:
     # Video bridge
     jvb:
         image: jitsi/jvb:${JITSI_IMAGE_VERSION:-unstable}
+        # build:
+        #   context: ./jvb
+        #   dockerfile: Dockerfile
+        #   args:
+        #     UID: 1000
+        #     GID: 1000
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'

jibri/Dockerfile

@@ -15,12 +15,37 @@ ARG USE_CHROMIUM=0
 ARG CHROME_RELEASE=114.0.5735.90
 ARG CHROMEDRIVER_MAJOR_RELEASE=114
 
-COPY rootfs/ /
+COPY --chown=noroot:noroot rootfs/ /
 
 RUN apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" jibri libgl1-mesa-dri procps jitsi-upload-integrations jitsi-autoscaler-sidecar jq pulseaudio dbus dbus-x11 rtkit unzip fonts-noto && \
     /usr/bin/install-chrome.sh && \
-    apt-cleanup && \
-    adduser jibri rtkit
+    apt-cleanup
+
+RUN mkdir -p /etc/jitsi/autoscaler-sidecar
+RUN mkdir -p /config/logs
+RUN mkdir -p /config/recordings
+RUN mkdir -p /jibri
+
+RUN chown -R noroot:noroot /etc/cont-init.d
+RUN chown -R noroot:noroot /etc/services.d
+RUN chown -R noroot:noroot /etc/jitsi
+RUN chown -R noroot:noroot /run
+RUN chown -R noroot:noroot /jibri
+RUN chown -R noroot:noroot /config
+RUN chown -R noroot:noroot /var
+RUN chown -R noroot:noroot /opt/jitsi
+RUN chown -R noroot:noroot /tmp
+RUN chown -R noroot:noroot /defaults
+RUN chown -R noroot:noroot /usr/bin
+RUN chmod +x /etc/cont-init.d/*
+RUN chmod +x /etc/services.d/10-xorg/*
+RUN chmod +x /etc/services.d/20-icewm/*
+RUN chmod +x /etc/services.d/30-pulse/*
+RUN chmod +x /etc/services.d/40-jibri/*
+RUN chmod +x /etc/services.d/50-autoscaler-sidecar/*
+RUN chmod +x /opt/jitsi/jibri/launch.sh
+
+USER noroot
 
 VOLUME /config

jibri/rootfs/etc/cont-init.d/10-config

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 if [[ -z $JIBRI_RECORDER_PASSWORD || -z $JIBRI_XMPP_PASSWORD ]]; then
     echo 'FATAL ERROR: Jibri recorder password and auth password must be set'
@@ -52,7 +52,6 @@ if [ -n "$AUTOSCALER_URL" ]; then
         [ -z "$AUTOSCALER_SIDECAR_GROUP_NAME" ] && export AUTOSCALER_SIDECAR_GROUP_NAME="docker-jibri"
         [ -z "$LOCAL_ADDRESS" ] && export LOCAL_ADDRESS="$(ip route get 1 | grep -oP '(?<=src ).*' | awk '{ print $1 '})"
 
-        mkdir -p /etc/jitsi/autoscaler-sidecar
         tpl /defaults/autoscaler-sidecar.config > /etc/jitsi/autoscaler-sidecar/config
     else
         echo "No key file at $AUTOSCALER_SIDECAR_KEY_FILE, leaving autoscaler sidecar disabled"
@@ -66,12 +65,8 @@ tpl /defaults/jibri.conf > /etc/jitsi/jibri/jibri.conf
 tpl /defaults/logging.properties > /etc/jitsi/jibri/logging.properties
 tpl /defaults/xorg-video-dummy.conf > /etc/jitsi/jibri/xorg-video-dummy.conf
 
-# make recording dir
+# set recording dir
 [ -z "${JIBRI_RECORDING_DIR}" ] && export JIBRI_RECORDING_DIR=/config/recordings
-mkdir -p ${JIBRI_RECORDING_DIR}
-chown -R jibri ${JIBRI_RECORDING_DIR}
 
-# make logs dir
+# set logs dir
 JIBRI_LOGS_DIR=/config/logs
-mkdir -p ${JIBRI_LOGS_DIR}
-chown -R jibri ${JIBRI_LOGS_DIR}

jibri/rootfs/etc/services.d/10-xorg/run

@@ -1,5 +1,5 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 DAEMON="/usr/bin/Xorg -nocursor -noreset  +extension RANDR +extension RENDER -logfile /tmp/xorg.log  -config /etc/jitsi/jibri/xorg-video-dummy.conf ${DISPLAY}"
-exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
+exec s6-setuidgid /bin/bash -c "exec $DAEMON"
 

jibri/rootfs/etc/services.d/20-icewm/run

@@ -1,5 +1,5 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 DAEMON="/usr/bin/icewm-session"
-exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
+exec s6-setuidgid /bin/bash -c "exec $DAEMON"
 

jibri/rootfs/etc/services.d/30-pulse/run

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
-HOME=/home/jibri
-exec s6-setuidgid jibri /bin/bash -c "exec /usr/bin/pulseaudio"
+HOME=/jibri
+exec s6-setuidgid /bin/bash -c "exec /usr/bin/pulseaudio"

jibri/rootfs/etc/services.d/40-jibri/finish

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 # When jibri is shutdown (or gracefully shutdown), it exits with code 255.
 # In this case, we don't want S6 to restart the service. We want to stop all

jibri/rootfs/etc/services.d/40-jibri/run

@@ -1,10 +1,10 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 # we have to set it, otherwise chrome won't find ~/.asoundrc file
-HOME=/home/jibri
+HOME=/jibri
 
 DAEMON=/opt/jitsi/jibri/launch.sh
 # pre-warm google chrome before jibri launches to ensure fast chrome launch during recordings
-s6-setuidgid jibri /usr/bin/google-chrome --timeout=1000 --headless about:blank
-exec s6-setuidgid jibri /bin/bash -c "exec $DAEMON"
+s6-setuidgid /usr/bin/google-chrome --timeout=1000 --headless about:blank
+exec s6-setuidgid /bin/bash -c "exec $DAEMON"
 

jibri/rootfs/etc/services.d/50-autoscaler-sidecar/run

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 if [[ -n "$AUTOSCALER_URL" ]] && [[ -f "/etc/jitsi/autoscaler-sidecar/config" ]]; then
     DAEMON="/usr/bin/node /usr/share/jitsi-autoscaler-sidecar/app.js"

jicofo/Dockerfile

@@ -12,6 +12,22 @@ RUN apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y jicofo && \
     apt-cleanup
 
-COPY rootfs/ /
+COPY --chown=noroot:noroot rootfs/ /
+
+RUN mkdir -p /config
+RUN chown -R noroot:noroot /etc/cont-init.d
+RUN chown -R noroot:noroot /etc/services.d
+RUN chown -R noroot:noroot /run
+RUN chown -R noroot:noroot /var
+RUN chown -R noroot:noroot /usr/share/jicofo
+RUN chown -R noroot:noroot /etc/jitsi
+RUN chown -R noroot:noroot /etc/jitsi/jicofo
+RUN chmod +x /usr/share/jicofo/jicofo.sh
+RUN chmod +x /etc/cont-init.d/*
+RUN chmod +x /etc/services.d/jicofo/*
+
+RUN chown -R noroot:noroot /config
+
+USER noroot
 
 VOLUME /config

jicofo/rootfs/etc/cont-init.d/10-config

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 export SENTRY_RELEASE="${SENTRY_RELEASE:-$(apt-cache policy jicofo | sed -n '/Installed/p' | sed -e 's/[^:]*: //')}"
 
@@ -15,5 +15,3 @@ fi
 
 tpl /defaults/logging.properties > /config/logging.properties
 tpl /defaults/jicofo.conf > /config/jicofo.conf
-
-chown -R jicofo:jitsi /config

jicofo/rootfs/etc/services.d/jicofo/run

@@ -1,7 +1,7 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 JAVA_SYS_PROPS="-Djava.util.logging.config.file=/config/logging.properties -Dconfig.file=/config/jicofo.conf"
 DAEMON=/usr/share/jicofo/jicofo.sh
 DAEMON_DIR=/usr/share/jicofo/
 
-exec s6-setuidgid jicofo /bin/bash -c "cd $DAEMON_DIR; JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON"
+exec /bin/bash -c "cd $DAEMON_DIR; JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON"

jigasi/Dockerfile

@@ -14,6 +14,23 @@ RUN apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y jigasi jq && \
     apt-cleanup
 
-COPY rootfs/ /
+COPY --chown=noroot:noroot rootfs/ /
+
+RUN mkdir /config
+RUN mkdir -pm777 /tmp/transcripts
+
+RUN chown -R noroot:noroot /etc/cont-init.d
+RUN chown -R noroot:noroot /etc/services.d
+RUN chown -R noroot:noroot /tmp
+RUN chown -R noroot:noroot /run
+RUN chown -R noroot:noroot /config
+RUN chown -R noroot:noroot /var
+RUN chown -R noroot:noroot /usr/share
+RUN chown -R noroot:noroot /defaults
+RUN chmod +x /etc/cont-init.d/*
+RUN chmod +x /etc/services.d/jigasi/*
+RUN chmod +x /usr/share/jigasi/jigasi.sh
+
+USER noroot
 
 VOLUME ["/config", "/tmp/transcripts"]

jigasi/rootfs/etc/cont-init.d/10-config

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 export SENTRY_RELEASE="${SENTRY_RELEASE:-$(apt-cache policy jigasi | sed -n '/Installed/p' | sed -e 's/[^:]*: //')}"
 
@@ -20,8 +20,6 @@ if [[ -f /config/custom-sip-communicator.properties ]]; then
     cat /config/custom-sip-communicator.properties >> /config/sip-communicator.properties
 fi
 
-mkdir -pm777 /tmp/transcripts
-chown jigasi:jitsi /tmp/transcripts
 
 # Create Google Cloud Credentials
 if [[ $ENABLE_TRANSCRIPTIONS -eq 1 || $ENABLE_TRANSCRIPTIONS == "true" ]]; then

jigasi/rootfs/etc/services.d/jigasi/run

@@ -1,8 +1,8 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 JAVA_SYS_PROPS="-Djava.util.logging.config.file=/config/logging.properties"
 
 DAEMON=/usr/share/jigasi/jigasi.sh
 DAEMON_OPTS="--nocomponent=true --configdir=/ --configdirname=config --min-port=${JIGASI_PORT_MIN:-20000} --max-port=${JIGASI_PORT_MAX:-20050}"
 
-exec s6-setuidgid jigasi /bin/bash -c "JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON $DAEMON_OPTS"
+exec s6-setuidgid /bin/bash -c "JAVA_SYS_PROPS=\"$JAVA_SYS_PROPS\" exec $DAEMON $DAEMON_OPTS"

jvb/Dockerfile

@@ -12,6 +12,18 @@ RUN apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y jitsi-videobridge2 jq curl iproute2 dnsutils && \
     apt-cleanup
 
-COPY rootfs/ /
+COPY --chown=noroot:noroot rootfs/ /
+
+RUN chown -R noroot:noroot /etc/cont-init.d
+RUN chown -R noroot:noroot /etc/services.d
+RUN chown -R noroot:noroot /run
+RUN chown -R noroot:noroot /var
+RUN mkdir -p /config
+RUN chmod +x /etc/cont-init.d/*
+RUN chmod +x /etc/services.d/jvb/*
+
+RUN chown -R noroot:noroot /config
+
+USER noroot
 
 VOLUME /config

jvb/rootfs/etc/cont-init.d/10-config

@@ -1,4 +1,4 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 if [[ -z $JVB_AUTH_PASSWORD ]]; then
     echo 'FATAL ERROR: JVB auth password must be set'
@@ -32,14 +32,12 @@ export LOCAL_ADDRESS=$(ip route get 1 | grep -oP '(?<=src ).*' | awk '{ print $1
 export SENTRY_RELEASE="${SENTRY_RELEASE:-$(apt-cache policy jitsi-videobridge2 | sed -n '/Installed/p' | sed -e 's/[^:]*: //')}"
 
 if [[ -f /config/custom-sip-communicator.properties ]]; then
-    cat /config/custom-sip-communicator.properties > /config/sip-communicator.properties
+  cat /config/custom-sip-communicator.properties > /config/sip-communicator.properties; 
 fi
 
 tpl /defaults/logging.properties > /config/logging.properties
 tpl /defaults/jvb.conf > /config/jvb.conf
 
-chown -R jvb:jitsi /config
-
 # Configuration checks
 if [[ (-z $ENABLE_COLIBRI_WEBSOCKET || $ENABLE_COLIBRI_WEBSOCKET == "0") && $ENABLE_OCTO == "1"  ]]; then
   echo "ERROR: In order to enable Octo relays (with ENABLE_OCTO=1), you MUST enable Colibri websockets (with ENABLE_COLIBRI_WEBSOCKET=1)";

jvb/rootfs/etc/services.d/jvb/run

@@ -1,7 +1,7 @@
-#!/usr/bin/with-contenv bash
+#!/command/with-contenv bash
 
 export JAVA_SYS_PROPS="-Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION=/ -Dnet.java.sip.communicator.SC_HOME_DIR_NAME=config -Djava.util.logging.config.file=/config/logging.properties -Dconfig.file=/config/jvb.conf"
 
 DAEMON=/usr/share/jitsi-videobridge/jvb.sh
 
-exec s6-setuidgid jvb /bin/bash -c "exec $DAEMON"
+exec /bin/bash -c "exec $DAEMON"