mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-11-21 21:05:34 +03:00
5e819ee1de
* specify user in rootless container numerically With kubernetes' PodSecurityPolicy set to runAsNonRoot it will not allow starting the container. The error message is ``` Error: container has runAsNonRoot and image has non-numeric user (git), cannot verify user is non-root ``` The `USER` directive has to be numerical for that to work. * mention the name of the uid/gid Co-authored-by: 6543 <6543@obermui.de>
73 lines
1.7 KiB
Text
73 lines
1.7 KiB
Text
|
|
###################################
|
|
#Build stage
|
|
FROM golang:1.16-alpine3.14 AS build-env
|
|
|
|
ARG GOPROXY
|
|
ENV GOPROXY ${GOPROXY:-direct}
|
|
|
|
ARG GITEA_VERSION
|
|
ARG TAGS="sqlite sqlite_unlock_notify"
|
|
ENV TAGS "bindata timetzdata $TAGS"
|
|
ARG CGO_EXTRA_CFLAGS
|
|
|
|
#Build deps
|
|
RUN apk --no-cache add build-base git nodejs npm
|
|
|
|
#Setup repo
|
|
COPY . ${GOPATH}/src/code.gitea.io/gitea
|
|
WORKDIR ${GOPATH}/src/code.gitea.io/gitea
|
|
|
|
#Checkout version if set
|
|
RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
|
|
&& make clean-all build
|
|
|
|
# Begin env-to-ini build
|
|
RUN go build contrib/environment-to-ini/environment-to-ini.go
|
|
|
|
FROM alpine:3.14
|
|
LABEL maintainer="maintainers@gitea.io"
|
|
|
|
EXPOSE 2222 3000
|
|
|
|
RUN apk --no-cache add \
|
|
bash \
|
|
ca-certificates \
|
|
gettext \
|
|
git \
|
|
curl \
|
|
gnupg
|
|
|
|
RUN addgroup \
|
|
-S -g 1000 \
|
|
git && \
|
|
adduser \
|
|
-S -H -D \
|
|
-h /var/lib/gitea/git \
|
|
-s /bin/bash \
|
|
-u 1000 \
|
|
-G git \
|
|
git
|
|
|
|
RUN mkdir -p /var/lib/gitea /etc/gitea
|
|
RUN chown git:git /var/lib/gitea /etc/gitea
|
|
|
|
COPY docker/rootless /
|
|
COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /usr/local/bin/gitea
|
|
COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
|
|
|
|
USER 1000:1000 # git:git
|
|
ENV GITEA_WORK_DIR /var/lib/gitea
|
|
ENV GITEA_CUSTOM /var/lib/gitea/custom
|
|
ENV GITEA_TEMP /tmp/gitea
|
|
ENV TMPDIR /tmp/gitea
|
|
|
|
#TODO add to docs the ability to define the ini to load (usefull to test and revert a config)
|
|
ENV GITEA_APP_INI /etc/gitea/app.ini
|
|
ENV HOME "/var/lib/gitea/git"
|
|
VOLUME ["/var/lib/gitea", "/etc/gitea"]
|
|
WORKDIR /var/lib/gitea
|
|
|
|
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
|
|
CMD []
|
|
|