gristlabs_grist-core

Commit Graph

Author	SHA1	Message	Date
Spoffy	1d92e69c43	Adds a home directory for non-root docker user in container (#1109 ) Fixes some edge cases where certain programs (e.g yarn) wouldn't work correctly due to HOME being set to a folder with bad permissions.	2 months ago
Spoffy	a8431c69a7	Makes docker images default to non-root execution (#1031 ) De-escalates to a normal user when the docker image is run as root. Allows GRIST_DOCKER_USER and GRIST_DOCKER_GROUP to be passed to override the default de-escalation behaviour. Backwards compatible with previous root installations. -------- This change adds a new docker_entrypoint.sh, which when run as root de-escalates to the provided user, defaulting to grist:grist. This is similar to the approach used by the official postgres docker image. To achieve backwards compatibility, it changes ownership of any files in `/persist` to the user it's given at runtime. Since the docker container is typically run as root, this should always work. If the container is run as a standard user from the very start: * It's the admin's responsibility to ensure `/persist` is writable by that user. * `/grist` remains owned by root and is read-only.	3 months ago

Author

SHA1

Message

Date

Spoffy

1d92e69c43

Adds a home directory for non-root docker user in container (#1109 )

Fixes some edge cases where certain programs (e.g yarn) wouldn't work correctly due to HOME being set to a folder with bad permissions.

Spoffy

a8431c69a7

Makes docker images default to non-root execution (#1031 )

De-escalates to a normal user when the docker image is run as root.

Allows GRIST_DOCKER_USER and GRIST_DOCKER_GROUP to be passed to override the default de-escalation behaviour.

Backwards compatible with previous root installations.

--------

This change adds a new docker_entrypoint.sh, which when run as root de-escalates to the provided user, defaulting to grist:grist. This is similar to the approach used by the official postgres docker image.

To achieve backwards compatibility, it changes ownership of any files in `/persist` to the user it's given at runtime. Since the docker container is typically run as root, this should always work.

If the container is run as a standard user from the very start:
* It's the admin's responsibility to ensure `/persist` is writable by that user.
* `/grist` remains owned by root and is read-only.

2 Commits (4a01c68a504cc96cde190aad4525d9e2f403ad4f)