From 89ca542f01f5e6cb54895f9ac2539ee97940b2a9 Mon Sep 17 00:00:00 2001 From: chainchad <96362174+chainchad@users.noreply.github.com> Date: Thu, 22 Aug 2024 09:19:33 -0400 Subject: [PATCH] Make Dockerfile use specified user with uid/gid (#10070) * Make Dockerfile use specified user with uid/gid * Disable password access for blockscout user Co-authored-by: Kirill Fedoseev * Use chown during final copy --------- Co-authored-by: Kirill Fedoseev --- docker/Dockerfile | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 6e49e61b0c..e0bd205c91 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -82,13 +82,21 @@ ARG SHRINK_INTERNAL_TRANSACTIONS_ENABLED ENV SHRINK_INTERNAL_TRANSACTIONS_ENABLED=${SHRINK_INTERNAL_TRANSACTIONS_ENABLED} ARG BLOCKSCOUT_VERSION ENV BLOCKSCOUT_VERSION=${BLOCKSCOUT_VERSION} +ARG BLOCKSCOUT_USER=blockscout +ARG BLOCKSCOUT_GROUP=blockscout +ARG BLOCKSCOUT_UID=10001 +ARG BLOCKSCOUT_GID=10001 -RUN apk --no-cache --update add jq curl +RUN apk --no-cache --update add jq curl && \ + addgroup --system --gid ${BLOCKSCOUT_GID} ${BLOCKSCOUT_GROUP} && \ + adduser --system --uid ${BLOCKSCOUT_UID} --ingroup ${BLOCKSCOUT_GROUP} --disabled-password ${BLOCKSCOUT_USER} WORKDIR /app -COPY --from=builder /opt/release/blockscout . -COPY --from=builder /app/apps/explorer/node_modules ./node_modules -COPY --from=builder /app/config/config_helper.exs ./config/config_helper.exs -COPY --from=builder /app/config/config_helper.exs /app/releases/${RELEASE_VERSION}/config_helper.exs -COPY --from=builder /app/config/assets/precompiles-arbitrum.json ./config/assets/precompiles-arbitrum.json +COPY --from=builder --chown=${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP} /opt/release/blockscout . +COPY --from=builder --chown=${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP} /app/apps/explorer/node_modules ./node_modules +COPY --from=builder --chown=${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP} /app/config/config_helper.exs ./config/config_helper.exs +COPY --from=builder --chown=${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP} /app/config/config_helper.exs /app/releases/${RELEASE_VERSION}/config_helper.exs +COPY --from=builder --chown=${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP} /app/config/assets/precompiles-arbitrum.json ./config/assets/precompiles-arbitrum.json + +USER ${BLOCKSCOUT_USER}:${BLOCKSCOUT_GROUP}