Dockerfiles: do not set gecos field on user add. Set group.
I think this was unintended: useradd -g sets the gecos field to "100". Probably we meant to use -G to set the ipfs user group. -G does not take gids, so it needs to be set by name. The group with gid 100 is "users". Additionally, since we install the ca-certificates package (which is already installed), at least we should attempt to update it to get the latest version of certs. License: MIT Signed-off-by: Hector Sanjuan <hector@protocol.ai>
Hector Sanjuan committed
Oct 20, 2017 at 20:59 UTC
b57539c1095a3b609821e38bcf9b91cd002568fa
2 files changed
+5
-5
Dockerfile
+3
-3
@@ -35,7 +35,7 @@ RUN set -x \
35
&& chmod +x tini
36
37
# Get the TLS CA certificates, they're not provided by busybox.
38
-RUN apt-get install -y ca-certificates
38
+RUN apt-get update && apt-get install -y ca-certificates
39
40
# Now comes the actual target image, which aims to be as small as possible.
41
FROM busybox:1-glibc
@@ -62,8 +62,8 @@ EXPOSE 8081
62
# Create the fs-repo directory and switch to a non-privileged user.
63
ENV IPFS_PATH /data/ipfs
64
RUN mkdir -p $IPFS_PATH \
65
- && adduser -D -h $IPFS_PATH -u 1000 -g 100 ipfs \
66
- && chown 1000:100 $IPFS_PATH
65
+ && adduser -D -h $IPFS_PATH -u 1000 -G users ipfs \
66
+ && chown ipfs:users $IPFS_PATH
67
68
# Expose the fs-repo as a volume.
69
# start_ipfs initializes an fs-repo if none is mounted.
Dockerfile.fast
+2
-2
@@ -58,8 +58,8 @@ EXPOSE 8081
58
# Create the fs-repo directory and switch to a non-privileged user.
59
ENV IPFS_PATH /data/ipfs
60
RUN mkdir -p $IPFS_PATH \
61
- && useradd -s /usr/sbin/nologin -d $IPFS_PATH -u 1000 -g 100 ipfs \
62
- && chown 1000:100 $IPFS_PATH
61
+ && useradd -s /usr/sbin/nologin -d $IPFS_PATH -u 1000 -G users ipfs \
62
+ && chown ipfs:users $IPFS_PATH
63
64
# Expose the fs-repo as a volume.
65
# start_ipfs initializes an fs-repo if none is mounted.