Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor entrypoint to avoid issues with volumes #2877

Merged
merged 1 commit into from
Jul 30, 2018
Merged

Refactor entrypoint to avoid issues with volumes #2877

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions rootfs/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,25 @@ RUN clean-install \

COPY . /

# Fix permission during the build to avoid issues at runtime
# with volumes (custom templates)
RUN bash -eux -c ' \
writeDirs=( \
/etc/nginx/template \
/etc/ingress-controller/ssl \
/etc/ingress-controller/auth \
/var/log \
/var/log/nginx \
/tmp \
); \
for dir in "${writeDirs[@]}"; do \
mkdir -p ${dir}; \
chown -R www-data.www-data ${dir}; \
done' \
&& chown www-data.www-data /etc/nginx/nginx.conf \
&& chown www-data.www-data /etc/nginx/opentracing.json \
&& chown www-data.www-data /etc/nginx

ENTRYPOINT ["/entrypoint.sh"]

CMD ["/nginx-ingress-controller"]
24 changes: 8 additions & 16 deletions rootfs/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,32 +16,24 @@

set -e

mkdir -p /var/log/nginx
echo 0 > /tmp/nginx.pid
# fix directory permissions
writeDirs=( \
/etc/nginx/template \
/etc/ingress-controller/ssl \
/etc/ingress-controller/auth \
/var/log \
/var/log/nginx \
/tmp \
/var/log
/var/log/nginx
/tmp
Copy link
Member

@ElvinEfendi ElvinEfendi Jul 30, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we leaving these last three folders here while we remove the others?

Copy link
Member Author

@aledbf aledbf Jul 30, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because entrypoint.sh runs at startup and the removed items from a list could be a volume and clean-install removes temporal paths

);

for dir in "${writeDirs[@]}"; do
for dir in "${writeDirs[@]}";do
mkdir -p ${dir};
chown -R www-data.www-data ${dir};
done

ln -sf /dev/stdout /var/log/nginx/access.log
ln -sf /dev/stderr /var/log/nginx/error.log

ln -sf /dev/stdout /var/log/nginx/access.log
ln -sf /dev/stderr /var/log/nginx/error.log
chown www-data.www-data /var/log/nginx/*
chown www-data.www-data /etc/nginx/nginx.conf
chown www-data.www-data /etc/nginx/opentracing.json
chown www-data.www-data /etc/nginx

echo "Testing if setcap is supported..."
if test 'setcap cap_net_bind_service=+ep /usr/sbin/nginx'; then
if setcap cap_net_bind_service=+ep /usr/sbin/nginx; then
echo "setcap is supported. Setting cap_net_bind_service=+ep to allow binding port lower than 1024 as non-root"
setcap cap_net_bind_service=+ep /usr/sbin/nginx
setcap -v cap_net_bind_service=+ep /usr/sbin/nginx
Expand Down