user host permissions are restricted inside container with django user

This commit is contained in:
Krzysztof Szumny 2015-08-21 13:02:32 +02:00
parent d41ac3b508
commit 5898589a72
4 changed files with 16 additions and 16 deletions

View File

@ -25,20 +25,10 @@ RUN \
npm install -g npm && \
printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc
RUN npm install -g grunt grunt-cli
RUN npm install -g grunt-cli
RUN groupadd -r django && useradd -r -g django django
ADD . /app
RUN chown -R django /app
ADD ./compose/django/gunicorn.sh /gunicorn.sh
ADD ./compose/django/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh && chown django /entrypoint.sh
RUN chmod +x /gunicorn.sh && chown django /gunicorn.sh
WORKDIR /app
USER django
ENTRYPOINT ["/entrypoint.sh"]
ENTRYPOINT ["/app/compose/django/entrypoint.sh"]

16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh Normal file → Executable file
View File

@ -16,7 +16,17 @@ export DATABASE_URL=postgres://$POSTGRES_ENV_POSTGRES_USER:$POSTGRES_ENV_POSTGRE
export CELERY_BROKER_URL=$DJANGO_CACHE_URL
{% endif %}
npm install
grunt build
# create a user, with UID of host user,
# read more about that trick: http://stackoverflow.com/a/28596874/338581
TARGET_USER_GID=$(stat -c "%u" /app)
useradd -m -s /bin/bash -u $TARGET_USER_GID django
exec "$@"
echo -e "\n------------------------------------------------------------\n"
su -c "npm install" django
echo -e "\n------------------------------------------------------------\n"
su -c "grunt build" django
echo -e "\n------------------------------------------------------------\n"
# somehow, when $@ is used directly, this doesn't work
COMMAND=$@
su -c "$COMMAND" django

0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh Normal file → Executable file
View File

View File

@ -10,7 +10,7 @@ django:
links:
- postgres
- redis
command: /gunicorn.sh
command: /app/compose/django/gunicorn.sh
env_file: .env
nginx: