Nwokolo Bueze
03/27/2024, 4:08 AMNwokolo Bueze
03/27/2024, 7:49 AMNwokolo Bueze
03/27/2024, 7:52 AMFROM debian as debian-base
# install gosu
# We use gosu to step down from root and run as the atlantis user
ENV GOSU_VERSION 1.17
RUN set -eux; \
# save list of currently installed packages for later so we can clean up
savedAptMark="$(apt-mark showmanual)"; \
apt-get update; \
apt-get install -y --no-install-recommends ca-certificates gnupg wget; \
rm -rf /var/lib/apt/lists/*; \
\
dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
wget -O /usr/local/bin/gosu "<https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch>"; \
wget -O /usr/local/bin/gosu.asc "<https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc>"; \
\
# verify the signature
export GNUPGHOME="$(mktemp -d)"; \
gpg --batch --keyserver <hkps://keys.openpgp.org> --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
gpgconf --kill all; \
rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
\
# clean up fetch dependencies
apt-mark auto '.*' > /dev/null; \
[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
\
chmod +x /usr/local/bin/gosu; \
# verify that the binary works
gosu --version; \
gosu nobody true
FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>
COPY --from=debian-base /usr/local/bin/gosu /usr/local/bin/gosu
RUN gosu atlantis apt-get update -y && \
apt-get install -y build-essential \
ca-certificates \
curl jq \
python3 \
python3-pip \
zip && \
apt-get clean
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]
Here is my docker-entrypoint.sh file content:
#!/usr/bin/dumb-init /bin/sh
set -e
# Modified: <https://github.com/hashicorp/docker-consul/blob/2c2873f9d619220d1eef0bc46ec78443f55a10b5/0.X/docker-entrypoint.sh>
# If the user is trying to run atlantis directly with some arguments, then
# pass them to atlantis.
if [ "$(echo "${1}" | cut -c1)" = "-" ]; then
set -- atlantis "$@"
fi
# If the user is running an atlantis subcommand (ex. server) then we want to prepend
# atlantis as the first arg to exec. To detect if they're running a subcommand
# we take the potential subcommand and run it through atlantis help {subcommand}.
# If the output contains "atlantis subcommand" then we know it's a subcommand
# since the help output contains that string. For anything else (ex. sh)
# it won't contain that string.
# NOTE: We use grep instead of the exit code since help always returns 0.
if atlantis help "$1" 2>&1 | grep -q "atlantis $1"; then
# We can't use the return code to check for the existence of a subcommand, so
# we have to use grep to look for a pattern in the help output.
set -- atlantis "$@"
fi
# If the current uid running does not have a user create one in /etc/passwd
if ! whoami > /dev/null 2>&1; then
if [ -w /etc/passwd ]; then
echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:/home/atlantis:/sbin/nologin" >> /etc/passwd
fi
fi
# If we need to install some tools at entrypoint level, we can add shell scripts
# in folder /docker-entrypoint.d/ with extension .sh and this scripts will be executed
# at entrypount level.
if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
echo "/docker-entrypoint.d/ is not empty, will attempt to perform script execition"
echo "Looking for shell scripts in /docker-entrypoint.d/"
find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do
case "$f" in
*.sh)
if [ -x "$f" ]; then
echo "Launching $f";
"$f"
else
# warn on shell scripts without exec bit
echo "Ignoring $f, not executable";
fi
;;
*) echo "Ignoring $f";;
esac
done
echo "Configuration complete; ready for start up"
else
echo "No files found in /docker-entrypoint.d/, skipping"
fi
# If we're running as root and we're trying to execute atlantis then we use
# gosu to step down from root and run as the atlantis user.
# In OpenShift, containers are run as a random users so we don't need to use gosu.
if [ "$(id -u)" = 0 ] && [ "$1" = 'atlantis' ]; then
# If requested, set the capability to bind to privileged ports before
# we drop to the non-root user. Note that this doesn't work with all
# storage drivers (it won't work with AUFS).
if [ -n "${ATLANTIS_ALLOW_PRIVILEGED_PORTS+x}" ]; then
setcap "cap_net_bind_service=+ep" /bin/atlantis
fi
set -- gosu atlantis "$@"
fi
exec "$@"
Here is my docker-compose.yaml
version: '3'
services:
atlantis:
container_name: atlantis-test
build:
context: .
dockerfile: Dockerfile
image: atlantis:test
platform: linux/amd64
ports:
- 4141:4141
Here is the error I'm getting:
=> ERROR [atlantis stage-1 3/4] RUN gosu atlantis apt-get update -y && apt-get install -y build-essential ca-certificates curl jq python3 python3-pip zip && apt-g 0.2s
------
> [atlantis stage-1 3/4] RUN gosu atlantis apt-get update -y && apt-get install -y build-essential ca-certificates curl jq python3 python3-pip zip && apt-get clean:
0.190 error: failed switching to "atlantis": operation not permitted
------
failed to solve: process "/bin/sh -c gosu atlantis apt-get update -y && apt-get install -y build-essential ca-certificates curl jq python3 python3-pip zip && apt-get clean" did not complete successfully: exit code: 1Stas Ostrovskyi
03/27/2024, 8:03 AMUSER instead?Nwokolo Bueze
03/27/2024, 8:56 AMatlantis after this line:
FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>
bcus atlantis is not root. The idea was to install packages using root (probably doing something like USER root before RUN apt-get update -y &&...). I just want to make sure when the container is running that it is running not as root.Gabriel Martinez
03/27/2024, 9:29 AMStas Ostrovskyi
03/27/2024, 10:06 AMatlantis user in the end
FROM <http://ghcr.io/runatlantis/atlantis|ghcr.io/runatlantis/atlantis>
USER root
RUN apt-get update -y && \
apt-get install -y build-essential \
ca-certificates \
curl jq \
python3 \
python3-pip \
zip && \
apt-get clean
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
USER atlantis
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["server"]Nwokolo Bueze
03/27/2024, 2:38 PM