Skip to content

Commit fe458ce

Browse files
sapksapk
authored
docker: rootless image (#10154)
* docker: rootless image * improve docs + remove check for write perm on custom * add more info on ssh passtrough * Add comment for internal ssh server in container config
1 parent f3bbd46 commit fe458ce

File tree

7 files changed

+549
-0
lines changed

7 files changed

+549
-0
lines changed

‎.drone.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -667,6 +667,25 @@ steps:
667667
exclude:
668668
- pull_request
669669

670+
- name: publish-rootless
671+
pull: always
672+
image: plugins/docker:linux-amd64
673+
settings:
674+
dockerfile: Dockerfile.rootless
675+
auto_tag: true
676+
auto_tag_suffix: linux-amd64-rootless
677+
repo: gitea/gitea
678+
build_args:
679+
- GOPROXY=off
680+
password:
681+
from_secret: docker_password
682+
username:
683+
from_secret: docker_username
684+
when:
685+
event:
686+
exclude:
687+
- pull_request
688+
670689
---
671690
kind: pipeline
672691
name: docker-linux-arm64-dry-run
@@ -745,6 +764,25 @@ steps:
745764
exclude:
746765
- pull_request
747766

767+
- name: publish-rootless
768+
pull: always
769+
image: plugins/docker:linux-arm64
770+
settings:
771+
dockerfile: Dockerfile.rootless
772+
auto_tag: true
773+
auto_tag_suffix: linux-arm64-rootless
774+
repo: gitea/gitea
775+
build_args:
776+
- GOPROXY=off
777+
password:
778+
from_secret: docker_password
779+
username:
780+
from_secret: docker_username
781+
when:
782+
event:
783+
exclude:
784+
- pull_request
785+
748786
---
749787
kind: pipeline
750788
name: docker-manifest
@@ -766,6 +804,17 @@ steps:
766804
username:
767805
from_secret: docker_username
768806

807+
- name: manifest-rootless
808+
pull: always
809+
image: plugins/manifest
810+
settings:
811+
auto_tag: true
812+
ignore_missing: true
813+
spec: docker/manifest.rootless.tmpl
814+
password:
815+
from_secret: docker_password
816+
username:
817+
from_secret: docker_username
769818
trigger:
770819
ref:
771820
- refs/heads/master

‎Dockerfile.rootless

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
2+
###################################
3+
#Build stage
4+
FROM golang:1.15-alpine3.12 AS build-env
5+
6+
ARG GOPROXY
7+
ENV GOPROXY ${GOPROXY:-direct}
8+
9+
ARG GITEA_VERSION
10+
ARG TAGS="sqlite sqlite_unlock_notify"
11+
ENV TAGS "bindata timetzdata $TAGS"
12+
ARG CGO_EXTRA_CFLAGS
13+
14+
#Build deps
15+
RUN apk --no-cache add build-base git nodejs npm
16+
17+
#Setup repo
18+
COPY . ${GOPATH}/src/code.gitea.io/gitea
19+
WORKDIR ${GOPATH}/src/code.gitea.io/gitea
20+
21+
#Checkout version if set
22+
RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
23+
&& make clean-all build
24+
25+
FROM alpine:3.12
26+
LABEL maintainer="[email protected]"
27+
28+
EXPOSE 2222 3000
29+
30+
RUN apk --no-cache add \
31+
bash \
32+
ca-certificates \
33+
gettext \
34+
git \
35+
gnupg
36+
37+
RUN addgroup \
38+
-S -g 1000 \
39+
git && \
40+
adduser \
41+
-S -H -D \
42+
-h /var/lib/gitea/git \
43+
-s /bin/bash \
44+
-u 1000 \
45+
-G git \
46+
git && \
47+
echo "git:$(dd if=/dev/urandom bs=24 count=1 status=none | base64)" | chpasswd
48+
49+
RUN mkdir -p /var/lib/gitea /etc/gitea
50+
RUN chown git:git /var/lib/gitea /etc/gitea
51+
52+
COPY docker/rootless /
53+
COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /usr/local/bin/gitea
54+
RUN chown root:root /usr/local/bin/* && chmod 755 /usr/local/bin/*
55+
56+
USER git:git
57+
ENV GITEA_WORK_DIR /var/lib/gitea
58+
ENV GITEA_CUSTOM /var/lib/gitea/custom
59+
ENV GITEA_TEMP /tmp/gitea
60+
#TODO add to docs the ability to define the ini to load (usefull to test and revert a config)
61+
ENV GITEA_APP_INI /etc/gitea/app.ini
62+
ENV HOME "/var/lib/gitea/git"
63+
VOLUME ["/var/lib/gitea", "/etc/gitea"]
64+
WORKDIR /var/lib/gitea
65+
66+
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
67+
CMD []
68+

‎docker/manifest.rootless.tmpl

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-rootless
2+
{{#if build.tags}}
3+
tags:
4+
{{#each build.tags}}
5+
- {{this}}
6+
{{/each}}
7+
{{/if}}
8+
manifests:
9+
-
10+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64-rootless
11+
platform:
12+
architecture: amd64
13+
os: linux
14+
-
15+
image: gitea/gitea:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm64-rootless
16+
platform:
17+
architecture: arm64
18+
os: linux
19+
variant: v8

‎docker/rootless/etc/templates/app.ini

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
APP_NAME = $APP_NAME
2+
RUN_USER = $RUN_USER
3+
RUN_MODE = $RUN_MODE
4+
5+
[repository]
6+
ROOT = $GITEA_WORK_DIR/git/repositories
7+
8+
[repository.local]
9+
LOCAL_COPY_PATH = $GITEA_TEMP/local-repo
10+
11+
[repository.upload]
12+
TEMP_PATH = $GITEA_TEMP/uploads
13+
14+
[server]
15+
APP_DATA_PATH = $GITEA_WORK_DIR
16+
SSH_DOMAIN = $SSH_DOMAIN
17+
HTTP_PORT = $HTTP_PORT
18+
ROOT_URL = $ROOT_URL
19+
DISABLE_SSH = $DISABLE_SSH
20+
; In rootless gitea container only internal ssh server is supported
21+
START_SSH_SERVER = true
22+
SSH_PORT = $SSH_PORT
23+
SSH_LISTEN_PORT = $SSH_LISTEN_PORT
24+
BUILTIN_SSH_SERVER_USER = $RUN_USER
25+
LFS_START_SERVER = $LFS_START_SERVER
26+
LFS_CONTENT_PATH = $GITEA_WORK_DIR/git/lfs
27+
28+
[database]
29+
PATH = $GITEA_WORK_DIR/data/gitea.db
30+
DB_TYPE = $DB_TYPE
31+
HOST = $DB_HOST
32+
NAME = $DB_NAME
33+
USER = $DB_USER
34+
PASSWD = $DB_PASSWD
35+
36+
[indexer]
37+
ISSUE_INDEXER_PATH = $GITEA_WORK_DIR/data/indexers/issues.bleve
38+
39+
[session]
40+
PROVIDER_CONFIG = $GITEA_WORK_DIR/data/sessions
41+
42+
[picture]
43+
AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/avatars
44+
REPOSITORY_AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/gitea/repo-avatars
45+
46+
[attachment]
47+
PATH = $GITEA_WORK_DIR/data/attachments
48+
49+
[log]
50+
ROOT_PATH = $GITEA_WORK_DIR/data/log
51+
52+
[security]
53+
INSTALL_LOCK = $INSTALL_LOCK
54+
SECRET_KEY = $SECRET_KEY
55+
56+
[service]
57+
DISABLE_REGISTRATION = $DISABLE_REGISTRATION
58+
REQUIRE_SIGNIN_VIEW = $REQUIRE_SIGNIN_VIEW

‎docker/rootless/usr/local/bin/docker-entrypoint.sh

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/sh
2+
3+
if [ -x /usr/local/bin/docker-setup.sh ]; then
4+
/usr/local/bin/docker-setup.sh || { echo 'docker setup failed' ; exit 1; }
5+
fi
6+
7+
if [ $# -gt 0 ]; then
8+
exec "$@"
9+
else
10+
exec /usr/local/bin/gitea -c ${GITEA_APP_INI} web
11+
fi

‎docker/rootless/usr/local/bin/docker-setup.sh

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
3+
# Prepare git folder
4+
mkdir -p ${HOME} && chmod 0700 ${HOME}
5+
if [ ! -w ${HOME} ]; then echo "${HOME} is not writable"; exit 1; fi
6+
7+
# Prepare custom folder
8+
mkdir -p ${GITEA_CUSTOM} && chmod 0500 ${GITEA_CUSTOM}
9+
10+
# Prepare temp folder
11+
mkdir -p ${GITEA_TEMP} && chmod 0700 ${GITEA_TEMP}
12+
if [ ! -w ${GITEA_TEMP} ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
13+
14+
#Prepare config file
15+
if [ ! -f ${GITEA_APP_INI} ]; then
16+
17+
#Prepare config file folder
18+
GITEA_APP_INI_DIR=$(dirname ${GITEA_APP_INI})
19+
mkdir -p ${GITEA_APP_INI_DIR} && chmod 0700 ${GITEA_APP_INI_DIR}
20+
if [ ! -w ${GITEA_APP_INI_DIR} ]; then echo "${GITEA_APP_INI_DIR} is not writable"; exit 1; fi
21+
22+
# Set INSTALL_LOCK to true only if SECRET_KEY is not empty and
23+
# INSTALL_LOCK is empty
24+
if [ -n "$SECRET_KEY" ] && [ -z "$INSTALL_LOCK" ]; then
25+
INSTALL_LOCK=true
26+
fi
27+
28+
# Substitude the environment variables in the template
29+
APP_NAME=${APP_NAME:-"Gitea: Git with a cup of tea"} \
30+
RUN_MODE=${RUN_MODE:-"dev"} \
31+
RUN_USER=${USER:-"git"} \
32+
SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
33+
HTTP_PORT=${HTTP_PORT:-"3000"} \
34+
ROOT_URL=${ROOT_URL:-""} \
35+
DISABLE_SSH=${DISABLE_SSH:-"false"} \
36+
SSH_PORT=${SSH_PORT:-"2222"} \
37+
SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-$SSH_PORT} \
38+
DB_TYPE=${DB_TYPE:-"sqlite3"} \
39+
DB_HOST=${DB_HOST:-"localhost:3306"} \
40+
DB_NAME=${DB_NAME:-"gitea"} \
41+
DB_USER=${DB_USER:-"root"} \
42+
DB_PASSWD=${DB_PASSWD:-""} \
43+
INSTALL_LOCK=${INSTALL_LOCK:-"false"} \
44+
DISABLE_REGISTRATION=${DISABLE_REGISTRATION:-"false"} \
45+
REQUIRE_SIGNIN_VIEW=${REQUIRE_SIGNIN_VIEW:-"false"} \
46+
SECRET_KEY=${SECRET_KEY:-""} \
47+
envsubst < /etc/templates/app.ini > ${GITEA_APP_INI}
48+
fi

0 commit comments

Comments
 (0)