docker: Automatically fix permissions
This patch is delaying the point where permissions are dropped into the `start_ipfs` script. This way, instead of exiting on permission issues, we can fix them on our own inside the script, then drop privileges and continue doing ipfs specific stuff with the correct user. I've removed the `chmod 0777` step from the readme since it's not needed anymore. License: MIT Signed-off-by: kpcyrd <git@rxv.cc>
kpcyrd committed
Mar 3, 2017 at 21:10 UTC
3c96b09ae7de09fa10a0d012d24898363cf505f3
4 files changed
+23
-38
Dockerfile
+9
-20
@@ -13,10 +13,6 @@ EXPOSE 4002/udp
13
EXPOSE 5001
14
EXPOSE 8080
15
16
-# Volume for mounting an IPFS fs-repo
17
-# This is moved to the bottom for technical reasons.
18
-#VOLUME $IPFS_PATH
19
-
16
# IPFS API to use for fetching gx packages.
17
# This can be a gateway too, since its read-only API provides all gx needs.
18
# - e.g. /ip4/172.17.0.1/tcp/8080 if the Docker host
@@ -33,14 +29,17 @@ ENV GOPATH /go
29
ENV PATH /go/bin:$PATH
30
ENV SRC_PATH /go/src/github.com/ipfs/go-ipfs
31
32
+# Expose the fs-repo as a volume.
33
+# start_ipfs initializes an fs-repo if none is mounted
34
+VOLUME $IPFS_PATH
35
+
36
# Get the go-ipfs sourcecode
37
COPY . $SRC_PATH
38
39
-RUN apk add --update musl-dev gcc go git bash wget ca-certificates \
40
- # Setup user and fs-repo directory
41
- && mkdir -p $IPFS_PATH \
39
+RUN apk add --no-cache --virtual .build-deps-ipfs musl-dev gcc go git \
40
+ && apk add --no-cache tini su-exec bash wget ca-certificates \
41
+ # Setup user
42
&& adduser -D -h $IPFS_PATH -u 1000 ipfs \
43
- && chown ipfs:ipfs $IPFS_PATH && chmod 755 $IPFS_PATH \
43
# Install gx
44
&& go get -u github.com/whyrusleeping/gx \
45
&& go get -u github.com/whyrusleeping/gx-go \
@@ -58,22 +57,12 @@ RUN apk add --update musl-dev gcc go git bash wget ca-certificates \
57
&& cp $SRC_PATH/bin/container_daemon /usr/local/bin/start_ipfs \
58
&& chmod 755 /usr/local/bin/start_ipfs \
59
# Remove all build-time dependencies
61
- && apk del --purge musl-dev gcc go git && rm -rf $GOPATH && rm -vf $IPFS_PATH/api
62
-
63
-# Call uid 1000 "ipfs"
64
-USER ipfs
65
-
66
-# Expose the fs-repo as a volume.
67
-# We're doing this down here (and not at the top),
68
-# so that the overlay directory is owned by the ipfs user.
69
-# start_ipfs initializes an ephemeral fs-repo if none is mounted,
70
-# which is why uid=1000 needs write permissions there.
71
-VOLUME $IPFS_PATH
60
+ && apk del --purge .build-deps-ipfs && rm -rf $GOPATH && rm -vf $IPFS_PATH/api
61
62
# This just makes sure that:
63
# 1. There's an fs-repo, and initializes one if there isn't.
64
# 2. The API and Gateway are accessible from outside the container.
76
-ENTRYPOINT ["/usr/local/bin/start_ipfs"]
65
+ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/start_ipfs"]
66
67
# Execute the daemon subcommand by default
68
CMD ["daemon", "--migrate=true"]
Dockerfile.fast
+6
-7
@@ -19,6 +19,8 @@ ENV GOPATH /go
19
ENV PATH /go/bin:$PATH
20
ENV SRC_PATH /go/src/github.com/ipfs/go-ipfs
21
22
+VOLUME $IPFS_PATH
23
+
24
# This is an optimization which avoids rebuilding
25
# of the gx dependencies every time anything changes.
26
# gx will only be invoked if the dependencies have changed.
@@ -28,10 +30,9 @@ ENV SRC_PATH /go/src/github.com/ipfs/go-ipfs
30
# and trigger a re-run of all following commands.
31
COPY ./package.json $SRC_PATH/package.json
32
31
-RUN apk add --update musl-dev gcc go git bash wget ca-certificates \
32
- && mkdir -p $IPFS_PATH \
33
+RUN apk add --no-cache --virtual .build-deps-ipfs musl-dev gcc go git \
34
+ && apk add --no-cache tini su-exec bash wget ca-certificates \
35
&& adduser -D -h $IPFS_PATH -u 1000 ipfs \
34
- && chown ipfs:ipfs $IPFS_PATH && chmod 755 $IPFS_PATH \
36
&& go get -u github.com/whyrusleeping/gx \
37
&& go get -u github.com/whyrusleeping/gx-go \
38
&& ([ -z "$GX_IPFS" ] || echo $GX_IPFS > $IPFS_PATH/api) \
@@ -48,9 +49,7 @@ RUN cd $SRC_PATH \
49
&& cp ipfs /usr/local/bin/ipfs \
50
&& cp $SRC_PATH/bin/container_daemon /usr/local/bin/start_ipfs \
51
&& chmod 755 /usr/local/bin/start_ipfs \
51
- && apk del --purge musl-dev gcc go git && rm -rf $GOPATH && rm -vf $IPFS_PATH/api
52
+ && apk del --purge .build-deps-ipfs && rm -rf $GOPATH && rm -vf $IPFS_PATH/api
53
53
-USER ipfs
54
-VOLUME $IPFS_PATH
55
-ENTRYPOINT ["/usr/local/bin/start_ipfs"]
54
+ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/start_ipfs"]
55
CMD ["daemon", "--migrate=true"]
README.md
-5
@@ -237,11 +237,6 @@ IPFS files that will persist when you restart the container.
237
export ipfs_staging=</absolute/path/to/somewhere/>
238
export ipfs_data=</absolute/path/to/somewhere_else/>
239
240
-Make sure docker can access these folders:
241
-
242
- sudo chmod -R 777 /absolute/path/to/somewhere/
243
- sudo chmod -R 777 /absolute/path/to/somewhere_else/
244
-
240
Start a container running ipfs and expose ports 4001, 5001 and 8080:
241
242
docker run -d --name ipfs_host -v $ipfs_staging:/export -v $ipfs_data:/data/ipfs -p 8080:8080 -p 4001:4001 -p 5001:5001 ipfs/go-ipfs:latest
bin/container_daemon
+8
-6
@@ -1,14 +1,16 @@
1
#!/bin/sh
2
-
3
-user=$(whoami)
2
+set -e
3
+user=ipfs
4
repo="$IPFS_PATH"
5
6
-# Test whether the mounted directory is writable for us
7
-if [ ! -w "$repo" 2>/dev/null ]; then
8
- echo "error: $repo is not writable for user $user (uid=$(id -u $user))"
9
- exit 1
6
+if [ `id -u` -eq 0 ]; then
7
+ # ensure folder is writable
8
+ su-exec "$user" test -w "$repo" || chown -R -- "$user" "$repo"
9
+ # restart script with new privileges
10
+ exec su-exec "$user" "$0" "$@"
11
fi
12
13
+# 2nd invocation with regular user
14
ipfs version
15
16
if [ -e "$repo/config" ]; then