docker compose wip

Dockerfile

@@ -1,19 +1,29 @@
 # Use an official Python runtime as a parent image
 FROM node:13.8.0-buster-slim AS static
-# why do I need python to install nodejs reqs? python 2 at that :/
-RUN apt update; apt install python3 make build-essential -y
+RUN apt-get update && apt-get install -y \
+    python3 make build-essential gosu \
+ && rm -rf /var/lib/apt/lists/*
 
 ENV PATH $PATH:env/bin
 ENV PYTHON python3
-COPY frontend /opt/frontend
+# we do not want node to run as id 1000
+RUN groupmod -g 999 node && usermod -u 999 -g 999 node
+RUN useradd --create-home application
+USER application
+COPY --chown=application frontend /opt/frontend
 WORKDIR /opt/frontend
+ENV FRONTEND_ASSSET_ROOT_DIR /opt/frontend/static_build
 RUN yarn
 RUN yarn jsdoc
 RUN yarn build
 # throw away the js container
 # Use an official Python runtime as a parent image
 FROM python:3.7.6-slim-stretch
 
+RUN apt-get update && apt-get install -y \
+    gosu \
+ && rm -rf /var/lib/apt/lists/*
+
 # Set the working directory to /opt/application
 WORKDIR /opt/application
 
@@ -40,15 +50,16 @@ RUN /opt/venv/bin/pip install --disable-pip-version-check --trusted-host pypi.py
 ENV PATH $PATH:/opt/venv/bin
 # Copy the current directory contents into the container at /opt/application
 COPY docker-entrypoint.sh /opt/docker-entrypoint.sh
-COPY backend /opt/application
+COPY --chown=application backend /opt/application
 # install the app
 RUN /opt/venv/bin/pip install --disable-pip-version-check --trusted-host pypi.python.org -e .
 
 # copy pre-built js
-COPY --from=static /opt/static_build /opt/rundir/static_build
+COPY --from=static --chown=application /opt/frontend/static_build /opt/rundir/static_build
 # Make port 6543 available to the world outside this container
 EXPOSE 6543
 VOLUME /opt/rundir
+USER root
 ENTRYPOINT ["/opt/docker-entrypoint.sh"]
 # Run application when the container launches
 CMD ["pserve", "/opt/rundir/config.ini"]

Dockerfile.static

@@ -1,15 +1,22 @@
 # Use an official Python runtime as a parent image
 FROM node:13.8.0-buster-slim
-# why do I need python to install nodejs reqs? python 2 at that :/
-RUN apt update; apt install python3 make build-essential -y
+RUN apt-get update && apt-get install -y \
+    python3 make build-essential gosu \
+ && rm -rf /var/lib/apt/lists/*
 
 ENV PATH $PATH:env/bin
 ENV PYTHON python3
-COPY frontend /opt/frontend
+# we do not want node to run as id 1000
+RUN groupmod -g 999 node && usermod -u 999 -g 999 node
+RUN useradd --create-home application
+USER application
+COPY --chown=application frontend /opt/frontend
 WORKDIR /opt/frontend
+ENV FRONTEND_ASSSET_ROOT_DIR /opt/frontend/static_build
 RUN yarn
 RUN yarn jsdoc
 RUN yarn build
 COPY docker-entrypoint-static.sh /opt/docker-entrypoint-static.sh
+USER root
 ENTRYPOINT ["/opt/docker-entrypoint-static.sh"]
 CMD ["yarn", "dev"]

docker-compose.dev.yml

@@ -19,7 +19,7 @@ services:
       context: .
       dockerfile: Dockerfile.static
     environment:
-      FRONTEND_ASSSET_ROOT_DIR: "/opt/rundir/static"
+      FRONTEND_ASSSET_ROOT_DIR: "/opt/rundir/static_build"
     volumes:
       - type: bind
         source: ./frontend

docker-entrypoint-static.sh

@@ -1,6 +1,13 @@
 #!/bin/bash
 set -e
+if [ -n "${USER_UID}" ]; then
+  usermod -u $USER_UID application
+fi
+if [ -n "${USER_GID}" ]; then
+  groupmod -g $USER_GID application
+fi
+
 if [ ! -d node_modules ]; then
-     yarn
+     gosu application yarn
 fi
-exec "$@"
+gosu application "$@"

docker-entrypoint.sh

@@ -1,6 +1,16 @@
 #!/bin/bash
 set -e
-cp /opt/application/development.ini /opt/rundir/config.ini
+
+# change the app uid to ones set from environment
+if [ -n "${USER_UID}" ]; then
+  usermod -u $USER_UID application
+fi
+if [ -n "${USER_GID}" ]; then
+  groupmod -g $USER_GID application
+fi
+
+gosu application cp /opt/application/development.ini /opt/rundir/config.ini
+
 if ! [ -z "$CHANNELSTREAM_URL" ]
 then
     sourceVar="\/"
@@ -34,8 +44,8 @@ fi
 
 if [ ! -f /opt/rundir/static_build/openapi.json ]; then
     pushd /opt/rundir
-    channelstream_landing_build_statics config.ini --with-main-assets=0 --with-jsdoc=0
+    gosu application channelstream_landing_build_statics config.ini --with-main-assets=0 --with-jsdoc=0
     popd
 fi;
 
-exec "$@"
+gosu application "$@"

readme.md

@@ -9,12 +9,12 @@ Or manually
     # build the image for landing page backend
     docker build . -t channelstream_landing
     # run the backend code
-    docker run -ti --rm -p 6543:6543 -e CHANNELSTREAM_URL=http://172.17.0.2:8000 channelstream_landing
+    docker run -ti --rm -p 6543:6543 USER_UID=`id -u` USER_GID=`id -g` -e CHANNELSTREAM_URL=http://172.17.0.2:8000 channelstream_landing
 
 
 # Running application via docker for development
 
-    docker-compose -f docker-compose.yml -f docker-compose.dev.yml up
+    USER_UID=`id -u` USER_GID=`id -g` docker-compose -f docker-compose.yml -f docker-compose.dev.yml up
 
 Or manually
 
@@ -25,7 +25,8 @@ Or manually
     docker build . -t channelstream_landing
 
     # run the backend code with hot reload
-    docker run -ti --rm -p 6543:6543 -e CHANNELSTREAM_URL=http://172.17.0.2:8000 \
+    docker run -ti --rm -p 6543:6543 -e USER_UID=`id -u` -e USER_GID=`id -g` \
+    -e CHANNELSTREAM_URL=http://172.17.0.2:8000 \
     --mount type=bind,source="$(pwd)"/backend,target=/opt/application \
     --mount type=bind,source="$(pwd)"/rundir,target=/opt/rundir \
     channelstream_landing
@@ -34,7 +35,8 @@ Or manually
     docker build . -f Dockerfile.static -t channelstream_landing_statics
 
     # run the frontend code with hot reload
-    docker run -ti --rm -e FRONTEND_ASSSET_ROOT_DIR=/opt/rundir/static_build \
+    docker run -ti --rm  -e USER_UID=`id -u` -e USER_GID=`id -g` \
+    -e FRONTEND_ASSSET_ROOT_DIR=/opt/rundir/static_build \
     --mount type=bind,source="$(pwd)"/frontend,target=/opt/frontend \
     --mount type=bind,source="$(pwd)"/rundir,target=/opt/rundir \
     channelstream_landing_statics