a
/
badguardhome
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge: docker: Run as non-root user 

Close #720

* commit '68f9ec70fb0f8ff2a73bf382bc15257c367b7967':
  Optimize Docker image layers; comment out runtime user; add sample docker-compose.yml
  Run as non-root user
This commit is contained in:
Simon Zolin 2019-05-13 14:42:50 +03:00
parent a45f0c519e 68f9ec70fb
commit 2178546e7b
3 changed files with 53 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Dockerfile
View File

@ -11,14 +11,22 @@ FROM alpine:latest
LABEL maintainer="AdGuard Team <devteam@adguard.com>" LABEL maintainer="AdGuard Team <devteam@adguard.com>"
# Update CA certs # Update CA certs
RUN apk --no-cache --update add ca-certificates && \ RUN apk --no-cache --update add ca-certificates libcap && \
rm -rf /var/cache/apk/* && mkdir -p /opt/adguardhome rm -rf /var/cache/apk/* && \
mkdir -p /opt/adguardhome/conf /opt/adguardhome/work && \
chown -R nobody: /opt/adguardhome
COPY --from=build /src/AdGuardHome/AdGuardHome /opt/adguardhome/AdGuardHome COPY --from=build --chown=nobody: /src/AdGuardHome/AdGuardHome /opt/adguardhome/AdGuardHome
RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome
EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp
VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"] VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"]
WORKDIR /opt/adguardhome/work
#USER nobody
ENTRYPOINT ["/opt/adguardhome/AdGuardHome"] ENTRYPOINT ["/opt/adguardhome/AdGuardHome"]
CMD ["-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"] CMD ["-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"]

13
Dockerfile.travis
View File

@ -2,15 +2,22 @@ FROM alpine:latest
LABEL maintainer="AdGuard Team <devteam@adguard.com>" LABEL maintainer="AdGuard Team <devteam@adguard.com>"
# Update CA certs # Update CA certs
RUN apk --no-cache --update add ca-certificates && \ RUN apk --no-cache --update add ca-certificates libcap && \
rm -rf /var/cache/apk/* && mkdir -p /opt/adguardhome rm -rf /var/cache/apk/* && \
mkdir -p /opt/adguardhome/conf /opt/adguardhome/work && \
chown -R nobody: /opt/adguardhome
COPY --chown=nobody: ./AdGuardHome /opt/adguardhome/AdGuardHome
COPY ./AdGuardHome /opt/adguardhome/AdGuardHome RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome
EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp
VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"] VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"]
WORKDIR /opt/adguardhome/work
#USER nobody
ENTRYPOINT ["/opt/adguardhome/AdGuardHome"] ENTRYPOINT ["/opt/adguardhome/AdGuardHome"]
CMD ["-h", "0.0.0.0", "-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"] CMD ["-h", "0.0.0.0", "-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"]

31
docker-compose.yml Normal file
View File

@ -0,0 +1,31 @@
%YAML 1.2
---
# https://docs.docker.com/compose/compose-file/
version: '2.4'
services:
adguard-home:
image: adguard/adguardhome:armhf-latest
init: true
ports:
- "53:53/tcp"
- "53:53/udp"
- "67:67/tcp"
- "67:67/udp"
- "68:68/tcp"
- "68:68/udp"
- "80:80/tcp"
- "443:443/tcp"
- "853:853/tcp"
- "853:853/udp"
- "3000:3000/tcp"
volumes:
- /opt/adguard-home:/opt/adguardhome/conf
- /srv/adguard-home:/opt/adguardhome/work
#user: nobody
read_only: true
restart: always
...