mirror of
https://github.com/cookiecutter/cookiecutter-django.git
synced 2025-07-31 10:19:54 +03:00
user host permissions are restricted inside container with django user
This commit is contained in:
parent
d41ac3b508
commit
5898589a72
|
@ -25,20 +25,10 @@ RUN \
|
|||
npm install -g npm && \
|
||||
printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc
|
||||
|
||||
RUN npm install -g grunt grunt-cli
|
||||
RUN npm install -g grunt-cli
|
||||
|
||||
RUN groupadd -r django && useradd -r -g django django
|
||||
ADD . /app
|
||||
|
||||
RUN chown -R django /app
|
||||
|
||||
ADD ./compose/django/gunicorn.sh /gunicorn.sh
|
||||
ADD ./compose/django/entrypoint.sh /entrypoint.sh
|
||||
|
||||
RUN chmod +x /entrypoint.sh && chown django /entrypoint.sh
|
||||
RUN chmod +x /gunicorn.sh && chown django /gunicorn.sh
|
||||
|
||||
WORKDIR /app
|
||||
USER django
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
ENTRYPOINT ["/app/compose/django/entrypoint.sh"]
|
||||
|
|
16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh
Normal file → Executable file
16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh
Normal file → Executable file
|
@ -16,7 +16,17 @@ export DATABASE_URL=postgres://$POSTGRES_ENV_POSTGRES_USER:$POSTGRES_ENV_POSTGRE
|
|||
export CELERY_BROKER_URL=$DJANGO_CACHE_URL
|
||||
{% endif %}
|
||||
|
||||
npm install
|
||||
grunt build
|
||||
# create a user, with UID of host user,
|
||||
# read more about that trick: http://stackoverflow.com/a/28596874/338581
|
||||
TARGET_USER_GID=$(stat -c "%u" /app)
|
||||
useradd -m -s /bin/bash -u $TARGET_USER_GID django
|
||||
|
||||
exec "$@"
|
||||
echo -e "\n------------------------------------------------------------\n"
|
||||
su -c "npm install" django
|
||||
echo -e "\n------------------------------------------------------------\n"
|
||||
su -c "grunt build" django
|
||||
echo -e "\n------------------------------------------------------------\n"
|
||||
|
||||
# somehow, when $@ is used directly, this doesn't work
|
||||
COMMAND=$@
|
||||
su -c "$COMMAND" django
|
||||
|
|
0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh
Normal file → Executable file
0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh
Normal file → Executable file
|
@ -10,7 +10,7 @@ django:
|
|||
links:
|
||||
- postgres
|
||||
- redis
|
||||
command: /gunicorn.sh
|
||||
command: /app/compose/django/gunicorn.sh
|
||||
env_file: .env
|
||||
|
||||
nginx:
|
||||
|
|
Loading…
Reference in New Issue
Block a user