mirror of
https://github.com/cookiecutter/cookiecutter-django.git
synced 2025-08-01 02:39:48 +03:00
user host permissions are restricted inside container with django user
This commit is contained in:
parent
d41ac3b508
commit
5898589a72
|
@ -25,20 +25,10 @@ RUN \
|
||||||
npm install -g npm && \
|
npm install -g npm && \
|
||||||
printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc
|
printf '\n# Node.js\nexport PATH="node_modules/.bin:$PATH"' >> /root/.bashrc
|
||||||
|
|
||||||
RUN npm install -g grunt grunt-cli
|
RUN npm install -g grunt-cli
|
||||||
|
|
||||||
RUN groupadd -r django && useradd -r -g django django
|
|
||||||
ADD . /app
|
ADD . /app
|
||||||
|
|
||||||
RUN chown -R django /app
|
|
||||||
|
|
||||||
ADD ./compose/django/gunicorn.sh /gunicorn.sh
|
|
||||||
ADD ./compose/django/entrypoint.sh /entrypoint.sh
|
|
||||||
|
|
||||||
RUN chmod +x /entrypoint.sh && chown django /entrypoint.sh
|
|
||||||
RUN chmod +x /gunicorn.sh && chown django /gunicorn.sh
|
|
||||||
|
|
||||||
WORKDIR /app
|
WORKDIR /app
|
||||||
USER django
|
|
||||||
|
|
||||||
ENTRYPOINT ["/entrypoint.sh"]
|
ENTRYPOINT ["/app/compose/django/entrypoint.sh"]
|
||||||
|
|
16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh
Normal file → Executable file
16
{{cookiecutter.repo_name}}/compose/django/entrypoint.sh
Normal file → Executable file
|
@ -16,7 +16,17 @@ export DATABASE_URL=postgres://$POSTGRES_ENV_POSTGRES_USER:$POSTGRES_ENV_POSTGRE
|
||||||
export CELERY_BROKER_URL=$DJANGO_CACHE_URL
|
export CELERY_BROKER_URL=$DJANGO_CACHE_URL
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
npm install
|
# create a user, with UID of host user,
|
||||||
grunt build
|
# read more about that trick: http://stackoverflow.com/a/28596874/338581
|
||||||
|
TARGET_USER_GID=$(stat -c "%u" /app)
|
||||||
|
useradd -m -s /bin/bash -u $TARGET_USER_GID django
|
||||||
|
|
||||||
exec "$@"
|
echo -e "\n------------------------------------------------------------\n"
|
||||||
|
su -c "npm install" django
|
||||||
|
echo -e "\n------------------------------------------------------------\n"
|
||||||
|
su -c "grunt build" django
|
||||||
|
echo -e "\n------------------------------------------------------------\n"
|
||||||
|
|
||||||
|
# somehow, when $@ is used directly, this doesn't work
|
||||||
|
COMMAND=$@
|
||||||
|
su -c "$COMMAND" django
|
||||||
|
|
0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh
Normal file → Executable file
0
{{cookiecutter.repo_name}}/compose/django/gunicorn.sh
Normal file → Executable file
|
@ -10,7 +10,7 @@ django:
|
||||||
links:
|
links:
|
||||||
- postgres
|
- postgres
|
||||||
- redis
|
- redis
|
||||||
command: /gunicorn.sh
|
command: /app/compose/django/gunicorn.sh
|
||||||
env_file: .env
|
env_file: .env
|
||||||
|
|
||||||
nginx:
|
nginx:
|
||||||
|
|
Loading…
Reference in New Issue
Block a user