Any work around for using gosu in atlantis
# atlantis-community
n
Any work around for using gosu in atlantis
sorry for the heavy lifting of my code.
Hey friends, I'm trying to get atlantis working again since gosu was dropped in the recent release. Please I need ideas. here is my test Dockerfile content:
Copy code
FROM debian as debian-base

# install gosu
# We use gosu to step down from root and run as the atlantis user
ENV GOSU_VERSION 1.17
RUN set -eux; \
# save list of currently installed packages for later so we can clean up
	savedAptMark="$(apt-mark showmanual)"; \
	apt-get update; \
	apt-get install -y --no-install-recommends ca-certificates gnupg wget; \
	rm -rf /var/lib/apt/lists/*; \
	\
	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
	wget -O /usr/local/bin/gosu "<https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch>"; \
	wget -O /usr/local/bin/gosu.asc "<https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc>"; \
	\
# verify the signature
	export GNUPGHOME="$(mktemp -d)"; \
	gpg --batch --keyserver <hkps://keys.openpgp.org> --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
	gpgconf --kill all; \
	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
	\
# clean up fetch dependencies
	apt-mark auto '.*' > /dev/null; \
	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
	\
	chmod +x /usr/local/bin/gosu; \
# verify that the binary works
	gosu --version; \
	gosu nobody true

FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>

COPY --from=debian-base /usr/local/bin/gosu /usr/local/bin/gosu

RUN gosu atlantis apt-get update -y && \
    apt-get install -y build-essential \
    ca-certificates \
    curl jq \
    python3 \
    python3-pip \
    zip && \
    apt-get clean

COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]
Here is my docker-entrypoint.sh file content:
Copy code
#!/usr/bin/dumb-init /bin/sh
set -e

# Modified: <https://github.com/hashicorp/docker-consul/blob/2c2873f9d619220d1eef0bc46ec78443f55a10b5/0.X/docker-entrypoint.sh>

# If the user is trying to run atlantis directly with some arguments, then
# pass them to atlantis.
if [ "$(echo "${1}" | cut -c1)" = "-" ]; then
    set -- atlantis "$@"
fi

# If the user is running an atlantis subcommand (ex. server) then we want to prepend
# atlantis as the first arg to exec. To detect if they're running a subcommand
# we take the potential subcommand and run it through atlantis help {subcommand}.
# If the output contains "atlantis subcommand" then we know it's a subcommand
# since the help output contains that string. For anything else (ex. sh)
# it won't contain that string.
# NOTE: We use grep instead of the exit code since help always returns 0.
if atlantis help "$1" 2>&1 | grep -q "atlantis $1"; then
    # We can't use the return code to check for the existence of a subcommand, so
    # we have to use grep to look for a pattern in the help output.
    set -- atlantis "$@"
fi

# If the current uid running does not have a user create one in /etc/passwd
if ! whoami > /dev/null 2>&1; then
  if [ -w /etc/passwd ]; then
    echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:/home/atlantis:/sbin/nologin" >> /etc/passwd
  fi
fi

# If we need to install some tools at entrypoint level, we can add shell scripts
# in folder /docker-entrypoint.d/ with extension .sh and this scripts will be executed
# at entrypount level.
if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
  echo "/docker-entrypoint.d/ is not empty, will attempt to perform script execition"
  echo "Looking for shell scripts in /docker-entrypoint.d/"
  find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do
    case "$f" in
      *.sh)
        if [ -x "$f" ]; then
          echo "Launching $f";
          "$f"
        else
          # warn on shell scripts without exec bit
          echo "Ignoring $f, not executable";
        fi
        ;;
      *) echo "Ignoring $f";;
    esac
  done
  echo "Configuration complete; ready for start up"
else
  echo "No files found in /docker-entrypoint.d/, skipping"
fi

# If we're running as root and we're trying to execute atlantis then we use
# gosu to step down from root and run as the atlantis user.
# In OpenShift, containers are run as a random users so we don't need to use gosu.
if [ "$(id -u)" = 0 ] && [ "$1" = 'atlantis' ]; then
    # If requested, set the capability to bind to privileged ports before
    # we drop to the non-root user. Note that this doesn't work with all
    # storage drivers (it won't work with AUFS).
    if [ -n "${ATLANTIS_ALLOW_PRIVILEGED_PORTS+x}" ]; then
        setcap "cap_net_bind_service=+ep" /bin/atlantis
    fi

    set -- gosu atlantis "$@"
fi

exec "$@"
Here is my docker-compose.yaml
Copy code
version: '3'

services:
  atlantis:
    container_name: atlantis-test
    build:
      context: .
      dockerfile: Dockerfile
    image: atlantis:test
    platform: linux/amd64
    ports:
      - 4141:4141
Here is the error I'm getting:
Copy code
=> ERROR [atlantis stage-1 3/4] RUN gosu atlantis apt-get update -y &&     apt-get install -y build-essential     ca-certificates     curl jq     python3     python3-pip     zip &&     apt-g  0.2s
------
 > [atlantis stage-1 3/4] RUN gosu atlantis apt-get update -y &&     apt-get install -y build-essential     ca-certificates     curl jq     python3     python3-pip     zip &&     apt-get clean:
0.190 error: failed switching to "atlantis": operation not permitted
------
failed to solve: process "/bin/sh -c gosu atlantis apt-get update -y &&     apt-get install -y build-essential     ca-certificates     curl jq     python3     python3-pip     zip &&     apt-get clean" did not complete successfully: exit code: 1
s
Just out of curiousity - why not use docker
USER
instead?
n
I have issue running apt-get command using
atlantis
after this line:
Copy code
FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>
bcus atlantis is not root. The idea was to install packages using root (probably doing something like
USER root
before
RUN apt-get update -y &&...
). I just want to make sure when the container is running that it is running not as root.
g
You usually only set the user after installing all the dependencies. Exceptions are for configuration commands that specifically need to run under the user session.
s
Exactly, so you can do something like below and you will have all the packages installed and the image will use
atlantis
user in the end
Copy code
FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>

USER root
RUN apt-get update -y && \
    apt-get install -y build-essential \
    ca-certificates \
    curl jq \
    python3 \
    python3-pip \
    zip && \
    apt-get clean

COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
USER atlantis
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]
👍 3
🙌 1
n
Thanks Stas.
🙌 1