user host permissions are restricted inside container with django user

This commit is contained in:
Krzysztof Szumny 2015-08-21 13:02:32 +02:00
parent d41ac3b508
commit 5898589a72
4 changed files with 16 additions and 16 deletions

View File

@ -25,20 +25,10 @@ RUN \
npm install -g npm && \ npm install -g npm && \
printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc
RUN npm install -g grunt grunt-cli RUN npm install -g grunt-cli
RUN groupadd -r django && useradd -r -g django django
ADD . /app ADD . /app
RUN chown -R django /app
ADD ./compose/django/gunicorn.sh /gunicorn.sh
ADD ./compose/django/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh && chown django /entrypoint.sh
RUN chmod +x /gunicorn.sh && chown django /gunicorn.sh
WORKDIR /app WORKDIR /app
USER django
ENTRYPOINT ["/entrypoint.sh"] ENTRYPOINT ["/app/compose/django/entrypoint.sh"]

16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh Normal file → Executable file
View File

@ -16,7 +16,17 @@ export DATABASE_URL=postgres://$POSTGRES_ENV_POSTGRES_USER:$POSTGRES_ENV_POSTGRE
export CELERY_BROKER_URL=$DJANGO_CACHE_URL export CELERY_BROKER_URL=$DJANGO_CACHE_URL
{% endif %} {% endif %}
npm install # create a user, with UID of host user,
grunt build # read more about that trick: http://stackoverflow.com/a/28596874/338581
TARGET_USER_GID=$(stat -c "%u" /app)
useradd -m -s /bin/bash -u $TARGET_USER_GID django
exec "$@" echo -e "\n------------------------------------------------------------\n"
su -c "npm install" django
echo -e "\n------------------------------------------------------------\n"
su -c "grunt build" django
echo -e "\n------------------------------------------------------------\n"
# somehow, when $@ is used directly, this doesn't work
COMMAND=$@
su -c "$COMMAND" django

0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh Normal file → Executable file
View File

View File

@ -10,7 +10,7 @@ django:
links: links:
- postgres - postgres
- redis - redis
command: /gunicorn.sh command: /app/compose/django/gunicorn.sh
env_file: .env env_file: .env
nginx: nginx: