prosody-docker icon indicating copy to clipboard operation
prosody-docker copied to clipboard

Proper user&permission management

Open 5andr0 opened this issue 4 years ago • 0 comments

Changelog:

  • changed user management based on Best practices for writing Dockerfiles

  • it's better to set a consistent default uid/gid to avoid mismatches with future builds when upgrading

  • it's necessary to create the group/user beforehand instead by installing packages (there was a different uid/gid set for the /var/run/prosody dir in the latest build)

  • instead of gosu for root step-down we can use setpriv on debian

  • changed parent image to 'debian:stable-slim' - no need for a bloated image. no need to change the codename anymore when a new stable debian is released

  • Maintainer is deprecated using LABEL maintainer instead

The entrypoint.sh will automatically adjust permissions for imported files with another uid/gid. If you want to run prosody as a specific user you can do this:

docker-compose:

tmpfs:
  - /run/prosody:uid=1000,gid=1000
user: 1000:1000

docker run cli: docker run --user="1000:1000" --tmpfs /run/prosody:uid=1000,gid=1000 ...

But another user won't have access to /run/prosody You either have to mount /run/prosody with the users uid/gid like above or change the path of the pidfile to one of your other mounted directories

5andr0 avatar Apr 01 '20 17:04 5andr0