Alpine docker image improvements and hardening
Chris committed
Feb 23, 2018 at 18:11 UTC
bf75ba7a667aba1693af4f6cda9c80481c186a2b
1 file changed
+26
-5
Dockerfile.alpine
+26
-5
@@ -13,14 +13,17 @@ WORKDIR /opt/netdata.git
13
# Install source
14
RUN chmod +x ./netdata-installer.sh && \
15
sync && sleep 1 && \
16
- ./netdata-installer.sh --dont-wait --dont-start-it
16
+ ./netdata-installer.sh --dont-wait --dont-start-it && \
17
+ sync && sleep 1 && \
18
+# Compile fping
19
+ /usr/libexec/netdata/plugins.d/fping.plugin install
20
21
################################################################################
22
FROM alpine:edge
23
24
# Reinstall some prerequisites
25
RUN apk --no-cache add lm_sensors nodejs libuuid python py-mysqldb \
23
- py-psycopg2 py-yaml netcat-openbsd jq
26
+ py-psycopg2 py-yaml netcat-openbsd jq curl
27
28
# Copy files over
29
COPY --from=builder /usr/share/netdata /usr/share/netdata
@@ -29,9 +32,25 @@ COPY --from=builder /var/cache/netdata /var/cache/netdata
32
COPY --from=builder /var/lib/netdata /var/lib/netdata
33
COPY --from=builder /usr/sbin/netdata /usr/sbin/netdata
34
COPY --from=builder /etc/netdata /etc/netdata
32
-
33
-# Link log files to stdout
34
-RUN mkdir -p /var/log/netdata && \
35
+COPY --from=builder /usr/local/bin/fping /usr/local/bin/fping
36
+
37
+ARG NETDATA_UID=101
38
+ARG NETDATA_GID=101
39
+
40
+RUN \
41
+ mkdir -p /var/log/netdata && \
42
+ # Add netdata user
43
+ addgroup -g ${NETDATA_GID} -S netdata && \
44
+ adduser -S -H -s /bin/sh -u ${NETDATA_GID} -h /etc/netdata -G netdata netdata && \
45
+ # Apply the permissions as described in
46
+ # https://github.com/firehol/netdata/wiki/netdata-security#netdata-directories
47
+ find /usr/share/netdata -type f -exec chmod 0644 -- {} + && \
48
+ chown -R root:netdata /usr/share/netdata /etc/netdata && \
49
+ chown -R netdata:netdata /var/cache/netdata /var/lib/netdata && \
50
+ chown root:netdata /usr/libexec/netdata/plugins.d/apps.plugin /usr/libexec/netdata/plugins.d/cgroup-network && \
51
+ chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network /usr/libexec/netdata/plugins.d/apps.plugin /usr/local/bin/fping && \
52
+ chmod 0750 /var/lib/netdata /var/cache/netdata && \
53
+ # Link log files to stdout
54
ln -sf /dev/stdout /var/log/netdata/access.log && \
55
ln -sf /dev/stdout /var/log/netdata/debug.log && \
56
ln -sf /dev/stderr /var/log/netdata/error.log
@@ -39,3 +58,5 @@ RUN mkdir -p /var/log/netdata && \
58
EXPOSE 19999
59
60
CMD [ "/usr/sbin/netdata" , "-D", "-s", "/host", "-p", "19999"]
61
+
62
+USER netdata:netdata