-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile
104 lines (89 loc) · 3.93 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
FROM node:18.14.1 as Builder
RUN mkdir -p /home/message-manager/web
WORKDIR /home/message-manager/web
COPY . /home/message-manager/web
RUN npm install pnpm -g
RUN pnpm install
RUN pnpm build-only
FROM swr.cn-north-4.myhuaweicloud.com/opensourceway/openeuler/nginx:1.24.0-22.03-lts-sp1 as NginxBuilder
FROM openeuler/openeuler:22.03
ENV NGINX_CONFIG_FILE /etc/nginx/nginx.conf
ENV NGINX_CONFIG_PATH /etc/nginx/
ENV NGINX_PID /var/run/nginx.pid
ENV NGINX_USER nginx
ENV NGINX_GROUP nginx
ENV NGINX_BIN /usr/share/nginx/sbin/
ENV NGINX_HOME /usr/share/nginx/
ENV NGINX_EXE_FILE /usr/share/nginx/sbin/nginx
ENV DST_PATH /etc/nginx/cert
COPY --from=NginxBuilder /usr/share/nginx /usr/share/nginx
COPY --from=NginxBuilder /usr/share/nginx/sbin/nginx /usr/share/nginx/sbin/nginx
COPY --from=NginxBuilder /etc/nginx/modules /etc/nginx/modules
COPY --from=NginxBuilder /etc/nginx/geoip /etc/nginx/geoip
COPY --from=NginxBuilder /etc/nginx/mime.types /etc/nginx/mime.types
COPY --from=Builder /home/message-manager/web/dist /usr/share/nginx/www/
RUN sed -i "s|repo.openeuler.org|mirrors.nju.edu.cn/openeuler|g" /etc/yum.repos.d/openEuler.repo \
&& sed -i '/metalink/d' /etc/yum.repos.d/openEuler.repo \
&& sed -i '/metadata_expire/d' /etc/yum.repos.d/openEuler.repo \
&& yum update -y \
&& yum install -y findutils passwd shadow \
&& find /usr/share/nginx/www -type d -print0| xargs -0 chmod 500 \
&& find /usr/share/nginx/www -type f -print0| xargs -0 chmod 400
COPY ./deploy/nginx/nginx.conf /etc/nginx/nginx.conf
RUN touch /var/run/nginx.pid \
&& groupadd -g 1000 nginx \
&& useradd -u 1000 -g nginx -s /sbin/nologin nginx \
&& chown -R nginx:nginx /usr/share/nginx \
&& find /usr/share/nginx -type d -print0 | xargs -0 chmod 500 \
&& chmod 500 /usr/share/nginx/sbin/nginx \
&& mkdir -p /var/log/nginx \
&& chown -R nginx:nginx /var/log/nginx \
&& chmod -R 640 /var/log/nginx \
&& mkdir -p /var/lib/nginx/tmp/client_body \
&& chown -R nginx:nginx /var/lib/nginx/tmp/client_body \
&& mkdir -p /var/lib/nginx/tmp/fastcgi \
&& chown -R nginx:nginx /var/lib/nginx/tmp/fastcgi \
&& mkdir -p /var/lib/nginx/tmp/proxy \
&& chown -R nginx:nginx /var/lib/nginx/tmp/proxy \
&& mkdir -p /var/lib/nginx/tmp/scgi \
&& chown -R nginx:nginx /var/lib/nginx/tmp/scgi \
&& mkdir -p /var/lib/nginx/tmp/uwsgi \
&& chown -R nginx:nginx /var/lib/nginx/tmp/uwsgi \
&& chmod -R 500 /var/lib/nginx/ \
&& chmod -R 750 /var/lib/nginx/tmp/proxy \
&& chown -R nginx:nginx /var/lib/nginx/ \
&& chown -R nginx:nginx /var/run/nginx.pid \
&& chmod 640 /var/run/nginx.pid \
&& chown -R nginx:nginx /etc/nginx \
&& chmod 550 /etc/nginx \
&& chmod 550 /etc/nginx/geoip/ \
&& chmod 440 /etc/nginx/geoip/* \
&& chmod 550 /etc/nginx/modules \
&& chmod 440 /etc/nginx/modules/* \
&& chmod 440 /etc/nginx/nginx.conf \
&& chmod 440 /etc/nginx/mime.types \
&& chmod 700 /var/lib/nginx/tmp/client_body \
&& rm -rf /usr/share/nginx/html/ \
&& rm -rf /usr/share/nginx/logs/ \
&& echo "umask 0027" >> /etc/bashrc \
&& echo "set +o history" >> /etc/bashrc \
&& sed -i "s|HISTSIZE=1000|HISTSIZE=0|" /etc/profile \
&& sed -i "s|PASS_MAX_DAYS[ \t]*99999|PASS_MAX_DAYS 30|" /etc/login.defs \
&& passwd -l $NGINX_USER \
&& yum clean all \
&& usermod -s /sbin/nologin sync \
&& usermod -s /sbin/nologin shutdown \
&& usermod -s /sbin/nologin halt \
&& echo "export TMOUT=1800 readonly TMOUT" >> /etc/profile \
&& rm -rf /usr/bin/gdb* \
&& rm -rf /usr/share/gdb \
&& rm -rf /usr/share/gcc-10.3.1 \
&& yum remove gdb-gdbserver findutils passwd shadow -y
COPY ./deploy/monitor.sh ./deploy/entrypoint.sh /etc/nginx/
RUN chmod 500 /etc/nginx/monitor.sh \
&& chmod 500 /etc/nginx/entrypoint.sh \
&& chown nginx:nginx /etc/nginx/monitor.sh \
&& chown nginx:nginx /etc/nginx/entrypoint.sh
EXPOSE 8080
USER nginx
ENTRYPOINT ["/etc/nginx/entrypoint.sh"]