From afd619278f63860d2c9494c748af4b00c1c05f5a Mon Sep 17 00:00:00 2001 From: blackandred <22807686+blackandred@users.noreply.github.com> Date: Fri, 3 Mar 2023 09:57:02 +0100 Subject: [PATCH 1/5] feat: Run as non-root by default to allow easier deployment on the restricted environments like OpenShift, Kubernetes and any corporate (or just secure) environments where root privileges are not allowed --- Dockerfile | 43 ++++++++++++++++---- README.md | 2 + base/etc/php-fpm.d/listen.conf | 2 +- base/etc/supervisord.conf | 17 -------- base/etc/supervisord.conf.d/cron.conf | 5 --- base/etc/supervisord.conf.d/humhub-log.conf | 7 ---- base/etc/supervisord.conf.d/php-fpm.conf | 8 ---- nginx/docker-entrypoint.d/60-nginx-config.sh | 2 +- nginx/etc/nginx/nginx.conf | 2 +- nginx/etc/supervisord.conf.d/nginx.conf | 8 ---- 10 files changed, 41 insertions(+), 55 deletions(-) delete mode 100644 base/etc/supervisord.conf delete mode 100644 base/etc/supervisord.conf.d/cron.conf delete mode 100644 base/etc/supervisord.conf.d/humhub-log.conf delete mode 100644 base/etc/supervisord.conf.d/php-fpm.conf delete mode 100644 nginx/etc/supervisord.conf.d/nginx.conf diff --git a/Dockerfile b/Dockerfile index 27ac3557..c0753e3e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -59,7 +59,7 @@ ARG RUNTIME_DEPS="\ php7-xmlwriter \ php7-zip \ sqlite \ - supervisor \ + multirun \ tzdata \ " @@ -112,7 +112,8 @@ RUN apk add --no-cache --update $RUNTIME_DEPS && \ apk add --no-cache --virtual temp_pkgs gettext && \ cp /usr/bin/envsubst /usr/local/bin/envsubst && \ apk del temp_pkgs && \ - rm -rf /var/cache/apk/* + rm -rf /var/cache/apk/* && \ + chmod +x /usr/bin/multirun ENV PHP_POST_MAX_SIZE=16M ENV PHP_UPLOAD_MAX_FILESIZE=10M @@ -120,9 +121,6 @@ ENV PHP_MAX_EXECUTION_TIME=60 ENV PHP_MEMORY_LIMIT=1G ENV PHP_TIMEZONE=UTC -RUN touch /var/run/supervisor.sock && \ - chmod 777 /var/run/supervisor.sock - # 100=nginx 101=nginx (group) COPY --from=builder --chown=100:101 /usr/src/humhub /var/www/localhost/htdocs/ COPY --chown=100:101 humhub/ /var/www/localhost/htdocs/ @@ -132,10 +130,18 @@ RUN mkdir -p /usr/src/humhub/protected/config/ && \ rm -f var/www/localhost/htdocs/protected/config/common.php /usr/src/humhub/protected/config/common.php && \ echo "v${HUMHUB_VERSION}" > /usr/src/humhub/.version +# Non-root directories +RUN mkdir -p /var/www/localhost/htdocs/protected/runtime/logs && \ + mkdir -p /run/nginx /run/php-fpm && \ + touch /var/www/localhost/htdocs/protected/runtime/logs/app.log && \ + chown 100:101 /var/www/localhost/htdocs/protected/runtime/logs /run/nginx /run/php-fpm -R + COPY base/ / COPY docker-entrypoint.sh /docker-entrypoint.sh RUN chmod 600 /etc/crontabs/nginx && \ + chown 100:101 /etc/crontabs/nginx && \ + rm /etc/crontabs/root && \ chmod +x /docker-entrypoint.sh VOLUME /var/www/localhost/htdocs/uploads @@ -143,12 +149,16 @@ VOLUME /var/www/localhost/htdocs/protected/config VOLUME /var/www/localhost/htdocs/protected/modules ENTRYPOINT ["/docker-entrypoint.sh"] -CMD ["supervisord", "-n", "-c", "/etc/supervisord.conf"] + +#+----------- +# HumHub PHP +#+----------- FROM base as humhub_phponly LABEL variant="phponly" +USER root RUN apk add --no-cache fcgi COPY phponly/ / @@ -159,7 +169,13 @@ RUN chmod +x /usr/local/bin/php-fpm-healthcheck \ && adduser --uid 100 -g 101 -S nginx EXPOSE 9000 +USER nginx +CMD ["multirun", "/usr/sbin/php-fpm7 --fpm-config /etc/php-fpm.d/pool.conf -O -F", "tail -f /var/www/localhost/htdocs/protected/runtime/logs/app.log", "crond -f -L /proc/self/fd/2"] + +#+------------- +# HumHub NGINX +#+------------- FROM docker.io/library/nginx:1.23.3-alpine as humhub_nginx LABEL variant="nginx" @@ -168,16 +184,29 @@ ENV NGINX_CLIENT_MAX_BODY_SIZE=10m \ NGINX_KEEPALIVE_TIMEOUT=65 \ NGINX_UPSTREAM=humhub:9000 +USER root COPY nginx/ / COPY --from=builder --chown=nginx:nginx /usr/src/humhub/ /var/www/localhost/htdocs/ +RUN chown nginx:nginx -R /etc/nginx + +USER nginx +CMD ["multirun", "/usr/sbin/nginx -g 'daemon off;'"] +#+------------------ +# HumHub All-in-one +#+------------------ FROM base as humhub_allinone LABEL variant="allinone" +USER root RUN apk add --no-cache nginx && \ - chown -R nginx:nginx /var/lib/nginx/ + mkdir -p /etc/nginx && \ + chown -R nginx:nginx /var/lib/nginx/ /etc/nginx COPY nginx/ / +RUN chown nginx:nginx -R /etc/nginx EXPOSE 80 +USER nginx +CMD ["/usr/bin/multirun", "/usr/sbin/php-fpm7 --fpm-config /etc/php-fpm.d/pool.conf -O -F", "tail -f /var/www/localhost/htdocs/protected/runtime/logs/app.log", "crond -f -L /proc/self/fd/2", "/usr/sbin/nginx -g 'daemon off;'"] diff --git a/README.md b/README.md index ea8e1f39..37db9069 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,8 @@ > :warning: **Image Removal**: We have purged all registries from End-Of-Life images (1.4,1.5,1.6,1.7,1.8). These images were not maintained anymore and contained major security flaws. To protect the public we removed them. If you really want to use these images, you have to build them from source. +> :warning: **Default privileges change:** This container is no longer starting as root and then dropping the privileges. Supervisord (running previously as root) was changed to lighter alternative "multirun" that runs as "nginx" user directly. This change opens possibility to easily run on OpenShift and Kubernetes. + [HumHub](https://github.com/humhub/humhub) is a feature rich and highly flexible OpenSource Social Network Kit written in PHP. This container provides a quick, flexible and lightweight way to set up a proof-of-concept for detailed evaluation. Using this in production is possible, but please note that there is currently no official support available for this kind of setup. diff --git a/base/etc/php-fpm.d/listen.conf b/base/etc/php-fpm.d/listen.conf index fccb72ee..f812f5f0 100644 --- a/base/etc/php-fpm.d/listen.conf +++ b/base/etc/php-fpm.d/listen.conf @@ -1,3 +1,3 @@ -listen = /run/php-fpm.sock +listen = /run/nginx/php-fpm.sock listen.owner = nginx listen.group = nginx diff --git a/base/etc/supervisord.conf b/base/etc/supervisord.conf deleted file mode 100644 index 25b3ede1..00000000 --- a/base/etc/supervisord.conf +++ /dev/null @@ -1,17 +0,0 @@ -[supervisord] -user=root -nodaemon=true -loglevel=warn -pidfile=/var/run/supervisord.pid -logfile=/proc/self/fd/2 -stdout_logfile=/proc/self/fd/2 -stdout_logfile_maxbytes=0 - -[rpcinterface:supervisor] -supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface - -[supervisorctl] -serverurl=unix:///var/run/supervisor.sock - -[include] -files=/etc/supervisord.conf.d/*.conf diff --git a/base/etc/supervisord.conf.d/cron.conf b/base/etc/supervisord.conf.d/cron.conf deleted file mode 100644 index 2f01ec34..00000000 --- a/base/etc/supervisord.conf.d/cron.conf +++ /dev/null @@ -1,5 +0,0 @@ -[program:cron] -command=crond -f -L /proc/self/fd/2 -user=root -autostart=true -autorestart=true diff --git a/base/etc/supervisord.conf.d/humhub-log.conf b/base/etc/supervisord.conf.d/humhub-log.conf deleted file mode 100644 index 8bf6a87e..00000000 --- a/base/etc/supervisord.conf.d/humhub-log.conf +++ /dev/null @@ -1,7 +0,0 @@ -[program:humhub-log] -command=tail -f /var/www/localhost/htdocs/protected/runtime/logs/app.log -autostart = true -stdout_logfile=/proc/self/fd/2 -stdout_logfile_maxbytes=0 -stderr_logfile=/proc/self/fd/2 -stderr_logfile_maxbytes=0 diff --git a/base/etc/supervisord.conf.d/php-fpm.conf b/base/etc/supervisord.conf.d/php-fpm.conf deleted file mode 100644 index 8788a729..00000000 --- a/base/etc/supervisord.conf.d/php-fpm.conf +++ /dev/null @@ -1,8 +0,0 @@ -[program:php-fpm] -command=/usr/sbin/php-fpm7 --fpm-config /etc/php-fpm.d/pool.conf -O -F -user=root -autostart = true -stdout_logfile=/proc/self/fd/2 -stdout_logfile_maxbytes=0 -stderr_logfile=/proc/self/fd/2 -stderr_logfile_maxbytes=0 diff --git a/nginx/docker-entrypoint.d/60-nginx-config.sh b/nginx/docker-entrypoint.d/60-nginx-config.sh index 70c9677c..7f3eee65 100755 --- a/nginx/docker-entrypoint.d/60-nginx-config.sh +++ b/nginx/docker-entrypoint.d/60-nginx-config.sh @@ -2,7 +2,7 @@ set -e -export NGINX_UPSTREAM="${NGINX_UPSTREAM:-unix:/run/php-fpm.sock}" +export NGINX_UPSTREAM="${NGINX_UPSTREAM:-unix:/run/nginx/php-fpm.sock}" export NGINX_CLIENT_MAX_BODY_SIZE="${NGINX_CLIENT_MAX_BODY_SIZE:-10m}" export NGINX_KEEPALIVE_TIMEOUT="${NGINX_KEEPALIVE_TIMEOUT:-65}" diff --git a/nginx/etc/nginx/nginx.conf b/nginx/etc/nginx/nginx.conf index f2f2b684..b0fb7790 100644 --- a/nginx/etc/nginx/nginx.conf +++ b/nginx/etc/nginx/nginx.conf @@ -5,7 +5,7 @@ worker_processes 1; error_log /dev/stderr notice; #error_log logs/error.log info; -pid /run/nginx.pid; +pid /run/nginx/nginx.pid; events { diff --git a/nginx/etc/supervisord.conf.d/nginx.conf b/nginx/etc/supervisord.conf.d/nginx.conf deleted file mode 100644 index 75b9c7d8..00000000 --- a/nginx/etc/supervisord.conf.d/nginx.conf +++ /dev/null @@ -1,8 +0,0 @@ -[program:nginx] -command=/usr/sbin/nginx -g 'daemon off;' -user=root -autostart = true -stdout_logfile=/proc/self/fd/2 -stdout_logfile_maxbytes=0 -stderr_logfile=/proc/self/fd/2 -stderr_logfile_maxbytes=0 From 13fb15933e1c20795bb8c6c0275bdef4811a9d6d Mon Sep 17 00:00:00 2001 From: blackandred <22807686+blackandred@users.noreply.github.com> Date: Fri, 3 Mar 2023 13:03:05 +0100 Subject: [PATCH 2/5] ci: Increase verbosity --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f548e260..10e857fa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -103,7 +103,7 @@ jobs: - name: Check status run: docker ps -a - name: Test - run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -q + run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -vvv - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q test_prod: @@ -144,7 +144,7 @@ jobs: - name: Check status run: docker ps -a - name: Test - run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -q + run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -vvv - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q push_ghcr: From 94d6aac8f5bbe8d313d432e67fb0eae20982a745 Mon Sep 17 00:00:00 2001 From: blackandred <22807686+blackandred@users.noreply.github.com> Date: Fri, 3 Mar 2023 17:09:46 +0100 Subject: [PATCH 3/5] ci: Increase verbosity --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 10e857fa..31f816ba 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -103,7 +103,7 @@ jobs: - name: Check status run: docker ps -a - name: Test - run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -vvv + run: curl http://localhost:8080/ -L --fail -vvv | grep 'Sign in' -q - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q test_prod: @@ -144,7 +144,7 @@ jobs: - name: Check status run: docker ps -a - name: Test - run: curl http://localhost:8080/ -L --fail -s | grep 'Sign in' -vvv + run: curl http://localhost:8080/ -L --fail -vvv | grep 'Sign in' -q - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q push_ghcr: From e2f4980fd88c9f93d0d83ef1995edf65894c74a1 Mon Sep 17 00:00:00 2001 From: blackandred <22807686+blackandred@users.noreply.github.com> Date: Fri, 3 Mar 2023 17:50:52 +0100 Subject: [PATCH 4/5] fix: Set initial volume permissions by creating empty directories with proper permissions / https://github.com/mriedmann/humhub-docker/pull/308 --- Dockerfile | 11 ++++++++--- docker-entrypoint.sh | 9 --------- 2 files changed, 8 insertions(+), 12 deletions(-) diff --git a/Dockerfile b/Dockerfile index c0753e3e..c4470a6d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -132,9 +132,14 @@ RUN mkdir -p /usr/src/humhub/protected/config/ && \ # Non-root directories RUN mkdir -p /var/www/localhost/htdocs/protected/runtime/logs && \ + mkdir -p /var/www/localhost/htdocs/uploads /var/www/localhost/htdocs/assets /var/www/localhost/htdocs/protected/modules /var/www/localhost/htdocs/themes /var/www/localhost/htdocs/protected/config && \ mkdir -p /run/nginx /run/php-fpm && \ touch /var/www/localhost/htdocs/protected/runtime/logs/app.log && \ - chown 100:101 /var/www/localhost/htdocs/protected/runtime/logs /run/nginx /run/php-fpm -R + chown 100:101 -R /var/www/localhost/htdocs/protected/runtime/logs /run/nginx /run/php-fpm \ + /var/www/localhost/htdocs/uploads /var/www/localhost/htdocs/assets \ + /var/www/localhost/htdocs/protected/modules /var/www/localhost/htdocs/themes \ + /var/www/localhost/htdocs/protected/config + COPY base/ / COPY docker-entrypoint.sh /docker-entrypoint.sh @@ -187,10 +192,10 @@ ENV NGINX_CLIENT_MAX_BODY_SIZE=10m \ USER root COPY nginx/ / COPY --from=builder --chown=nginx:nginx /usr/src/humhub/ /var/www/localhost/htdocs/ -RUN chown nginx:nginx -R /etc/nginx +RUN mkdir -p /var/cache/nginx /run/nginx && \ + chown nginx:nginx -R /etc/nginx /var/cache/nginx /run/nginx USER nginx -CMD ["multirun", "/usr/sbin/nginx -g 'daemon off;'"] #+------------------ # HumHub All-in-one diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index 0e0ffc2d..7eae256d 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -128,12 +128,6 @@ else mkdir -p /var/www/localhost/htdocs/protected/runtime/logs/ touch /var/www/localhost/htdocs/protected/runtime/logs/app.log - echo >&3 "$0: Setting permissions..." - chown -R nginx:nginx /var/www/localhost/htdocs/uploads - chown -R nginx:nginx /var/www/localhost/htdocs/protected/modules - chown -R nginx:nginx /var/www/localhost/htdocs/protected/config - chown -R nginx:nginx /var/www/localhost/htdocs/protected/runtime - wait_for_db echo >&3 "$0: Creating database..." @@ -191,9 +185,6 @@ else php yii 'settings/set' 'base' 'mailer.encryption' "${HUMHUB_MAILER_ENCRYPTION}" php yii 'settings/set' 'base' 'mailer.allowSelfSignedCerts' "${HUMHUB_MAILER_ALLOW_SELF_SIGNED_CERTS}" fi - - chown -R nginx:nginx /var/www/localhost/htdocs/protected/runtime - chown nginx:nginx /var/www/localhost/htdocs/protected/config/dynamic.php fi fi From ff2ea1c43181ee6d5a5be00845b83b01707b0995 Mon Sep 17 00:00:00 2001 From: blackandred <22807686+blackandred@users.noreply.github.com> Date: Fri, 3 Mar 2023 19:38:38 +0100 Subject: [PATCH 5/5] feat: Increase verbosity / https://github.com/mriedmann/humhub-docker/pull/308 --- .github/workflows/build.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 31f816ba..089f7bef 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -99,13 +99,16 @@ jobs: - name: Spin up services run: docker-compose -f docker-compose.yml up -d - name: Wait - run: sleep 60 + run: sleep 70 - name: Check status run: docker ps -a - name: Test run: curl http://localhost:8080/ -L --fail -vvv | grep 'Sign in' -q - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q + - name: Collect logs + if: ${{ always() }} + run: docker-compose -f docker-compose.prod.yml logs test_prod: needs: build_variants runs-on: ubuntu-latest @@ -140,13 +143,16 @@ jobs: - name: Spin up services run: docker-compose -f docker-compose.prod.yml up -d - name: Wait - run: sleep 60 + run: sleep 70 - name: Check status run: docker ps -a - name: Test run: curl http://localhost:8080/ -L --fail -vvv | grep 'Sign in' -q - name: Test Email run: docker-compose exec -T humhub php /var/www/localhost/htdocs/protected/yii test/email 'test@example.com' | grep 'Message successfully sent!' -q + - name: Collect logs + if: ${{ always() }} + run: docker-compose -f docker-compose.prod.yml logs push_ghcr: needs: ["test_aio", "test_prod"] runs-on: ubuntu-latest