Merge: docker: Run as non-root user
Close #720 * commit '68f9ec70fb0f8ff2a73bf382bc15257c367b7967': Optimize Docker image layers; comment out runtime user; add sample docker-compose.yml Run as non-root user
This commit is contained in:
commit
2178546e7b
16
Dockerfile
16
Dockerfile
|
@ -11,14 +11,22 @@ FROM alpine:latest
|
|||
LABEL maintainer="AdGuard Team <devteam@adguard.com>"
|
||||
|
||||
# Update CA certs
|
||||
RUN apk --no-cache --update add ca-certificates && \
|
||||
rm -rf /var/cache/apk/* && mkdir -p /opt/adguardhome
|
||||
RUN apk --no-cache --update add ca-certificates libcap && \
|
||||
rm -rf /var/cache/apk/* && \
|
||||
mkdir -p /opt/adguardhome/conf /opt/adguardhome/work && \
|
||||
chown -R nobody: /opt/adguardhome
|
||||
|
||||
COPY --from=build /src/AdGuardHome/AdGuardHome /opt/adguardhome/AdGuardHome
|
||||
COPY --from=build --chown=nobody: /src/AdGuardHome/AdGuardHome /opt/adguardhome/AdGuardHome
|
||||
|
||||
RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome
|
||||
|
||||
EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp
|
||||
|
||||
VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"]
|
||||
|
||||
WORKDIR /opt/adguardhome/work
|
||||
|
||||
#USER nobody
|
||||
|
||||
ENTRYPOINT ["/opt/adguardhome/AdGuardHome"]
|
||||
CMD ["-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"]
|
||||
CMD ["-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"]
|
||||
|
|
|
@ -2,15 +2,22 @@ FROM alpine:latest
|
|||
LABEL maintainer="AdGuard Team <devteam@adguard.com>"
|
||||
|
||||
# Update CA certs
|
||||
RUN apk --no-cache --update add ca-certificates && \
|
||||
rm -rf /var/cache/apk/* && mkdir -p /opt/adguardhome
|
||||
RUN apk --no-cache --update add ca-certificates libcap && \
|
||||
rm -rf /var/cache/apk/* && \
|
||||
mkdir -p /opt/adguardhome/conf /opt/adguardhome/work && \
|
||||
chown -R nobody: /opt/adguardhome
|
||||
|
||||
COPY --chown=nobody: ./AdGuardHome /opt/adguardhome/AdGuardHome
|
||||
|
||||
COPY ./AdGuardHome /opt/adguardhome/AdGuardHome
|
||||
RUN setcap 'cap_net_bind_service=+eip' /opt/adguardhome/AdGuardHome
|
||||
|
||||
EXPOSE 53/tcp 53/udp 67/tcp 67/udp 68/tcp 68/udp 80/tcp 443/tcp 853/tcp 853/udp 3000/tcp
|
||||
|
||||
VOLUME ["/opt/adguardhome/conf", "/opt/adguardhome/work"]
|
||||
|
||||
WORKDIR /opt/adguardhome/work
|
||||
|
||||
#USER nobody
|
||||
|
||||
ENTRYPOINT ["/opt/adguardhome/AdGuardHome"]
|
||||
CMD ["-h", "0.0.0.0", "-c", "/opt/adguardhome/conf/AdGuardHome.yaml", "-w", "/opt/adguardhome/work"]
|
||||
|
|
|
@ -0,0 +1,31 @@
|
|||
%YAML 1.2
|
||||
---
|
||||
# https://docs.docker.com/compose/compose-file/
|
||||
|
||||
version: '2.4'
|
||||
|
||||
services:
|
||||
|
||||
adguard-home:
|
||||
image: adguard/adguardhome:armhf-latest
|
||||
init: true
|
||||
ports:
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
- "67:67/tcp"
|
||||
- "67:67/udp"
|
||||
- "68:68/tcp"
|
||||
- "68:68/udp"
|
||||
- "80:80/tcp"
|
||||
- "443:443/tcp"
|
||||
- "853:853/tcp"
|
||||
- "853:853/udp"
|
||||
- "3000:3000/tcp"
|
||||
volumes:
|
||||
- /opt/adguard-home:/opt/adguardhome/conf
|
||||
- /srv/adguard-home:/opt/adguardhome/work
|
||||
#user: nobody
|
||||
read_only: true
|
||||
restart: always
|
||||
|
||||
...
|
Loading…
Reference in New Issue