Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #1847 "Docker: Launch the php image with a non root user" #2189

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fixes #1847 "Docker: Launch the php image with a non root user" #2189

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions api/Dockerfile
View file
Open in desktop
Expand Up @@ -63,6 +63,8 @@ RUN apk add --no-cache --virtual .pgsql-deps postgresql-dev; \

COPY --from=composer:2 /usr/bin/composer /usr/bin/composer

RUN apk add --no-cache su-exec

RUN ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
COPY docker/php/conf.d/api-platform.prod.ini $PHP_INI_DIR/conf.d/api-platform.ini

Expand Down
15 changes: 9 additions & 6 deletions api/docker/php/docker-entrypoint.sh
View file
Open in desktop
@@ -1,9 +1,11 @@
#!/bin/sh
set -e

USER_ID=$(stat -c "%u" ./composer.json)

# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
set -- php-fpm "$@"
set -- su-exec $USER_ID php-fpm "$@"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't necessary. The official image is already designed to run FPM processes as non-root: docker-library/php#70

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes but I need to run the PHP script I developed as my current user ID when developing (for example to have read & write access to my folders) and by default it is running as another user id, so the files created when I execute my PHP script are not accessible by my current user ID (as a developer). This is a problem while developing... and this is why I wrote this patch.

fi

if [ "$1" = 'php-fpm' ] || [ "$1" = 'php' ] || [ "$1" = 'bin/console' ]; then
Expand All @@ -14,11 +16,12 @@ if [ "$1" = 'php-fpm' ] || [ "$1" = 'php' ] || [ "$1" = 'bin/console' ]; then
ln -sf "$PHP_INI_RECOMMENDED" "$PHP_INI_DIR/php.ini"

mkdir -p var/cache var/log
setfacl -R -m u:www-data:rwX -m u:"$(whoami)":rwX var
setfacl -dR -m u:www-data:rwX -m u:"$(whoami)":rwX var
setfacl -R -m u:www-data:rwX -m u:"$USER_ID":rwX var /var/run/php
setfacl -dR -m u:www-data:rwX -m u:"$USER_ID":rwX var /var/run/php
chown $USER_ID /proc/self/fd/1 /proc/self/fd/2

if [ "$APP_ENV" != 'prod' ]; then
composer install --prefer-dist --no-progress --no-interaction
su-exec $USER_ID composer install --prefer-dist --no-progress --no-interaction
fi

if grep -q DATABASE_URL= .env; then
Expand All @@ -44,9 +47,9 @@ if [ "$1" = 'php-fpm' ] || [ "$1" = 'php' ] || [ "$1" = 'bin/console' ]; then
fi

if [ "$( find ./migrations -iname '*.php' -print -quit )" ]; then
php bin/console doctrine:migrations:migrate --no-interaction
su-exec $USER_ID php bin/console doctrine:migrations:migrate --no-interaction
fi
fi
fi

exec docker-php-entrypoint "$@"
exec su-exec $USER_ID docker-php-entrypoint "$@"