未验证 提交 40a22df0 编写于 作者: 羽飞's avatar 羽飞 提交者: GitHub

fix docker security issues (#251)

### What problem were solved in this pull request?

ref #205

Problem:
docker image has some security issues

### What is changed and how it works?
move step chpassword to startup
上级 76221e46
...@@ -4,9 +4,6 @@ ...@@ -4,9 +4,6 @@
# make sure docker has been installed # make sure docker has been installed
FROM ubuntu:latest FROM ubuntu:latest
ARG HOME_DIR=/root
ARG DOCKER_CONFIG_DIR=${HOME_DIR}/docker
# ENV LANG=en_US.UTF-8 # ENV LANG=en_US.UTF-8
# locale # locale
RUN apt-get update && apt-get install -y locales apt-utils && rm -rf /var/lib/apt/lists/* \ RUN apt-get update && apt-get install -y locales apt-utils && rm -rf /var/lib/apt/lists/* \
...@@ -25,8 +22,6 @@ RUN git clone https://github.com/oceanbase/miniob /tmp/miniob \ ...@@ -25,8 +22,6 @@ RUN git clone https://github.com/oceanbase/miniob /tmp/miniob \
&& bash build.sh init \ && bash build.sh init \
&& rm -rf /tmp/miniob && rm -rf /tmp/miniob
# change root password
RUN echo "root:root" | chpasswd
RUN mkdir /var/run/sshd RUN mkdir /var/run/sshd
# install zsh and on-my-zsh # install zsh and on-my-zsh
...@@ -37,13 +32,13 @@ RUN apt-get install -y zsh \ ...@@ -37,13 +32,13 @@ RUN apt-get install -y zsh \
&& usermod --shell /bin/zsh root \ && usermod --shell /bin/zsh root \
&& echo "export LD_LIBRARY_PATH=/usr/local/lib64:\$LD_LIBRARY_PATH" >> ~/.zshrc && echo "export LD_LIBRARY_PATH=/usr/local/lib64:\$LD_LIBRARY_PATH" >> ~/.zshrc
RUN mkdir -p ${DOCKER_CONFIG_DIR}/bin RUN mkdir -p /root/docker/bin && touch /etc/.firstrun
WORKDIR ${DOCKER_CONFIG_DIR}/bin
# copy starter scripts # copy starter scripts
COPY bin/* ${DOCKER_CONFIG_DIR}/bin/ COPY bin/* /root/docker/bin/
RUN chmod +x /root/docker/bin/*
RUN chmod +x ${DOCKER_CONFIG_DIR}/bin/* WORKDIR /root
ENTRYPOINT ./starter.sh ENTRYPOINT /root/docker/bin/starter.sh
...@@ -2,6 +2,11 @@ ...@@ -2,6 +2,11 @@
HOST_KEY_DIR=/etc/ssh/ssh_host_rsa_key HOST_KEY_DIR=/etc/ssh/ssh_host_rsa_key
if [ -f /etc/.firstrun ]; then
echo "root:root" | chpasswd
rm -f /etc/.firstrun
fi
if [ ! -f "${HOST_KEY_DIR}" ]; then if [ ! -f "${HOST_KEY_DIR}" ]; then
ssh-keygen -A ssh-keygen -A
fi fi
......
#!/bin/bash #!/bin/bash
ls -lld $PWD/*starter-* | awk '{print $9;}' | xargs -L 1 bash -c ls -lld $HOME/docker/bin/*starter-* | awk '{print $9;}' | xargs -L 1 bash -c
echo 'starter scripts run successfully!' echo 'starter scripts run successfully!'
tail -f /dev/null tail -f /dev/null
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册