dbeaver/dbeaver-devops#1553 Added user dbeaver in dockerfile cloudbea…

…ver (#3067)

* dbeaver/dbeaver-devops#1553 Added user dbeaver in dockerfile cloudbeaver

* dbeaver/dbeaver-devops#1553 Create dockerfile for cloudbeaver update

* dbeaver/dbeaver-devops#1553 Added dockerfile with upgrade script

* dbeaver/dbeaver-devops#1553 Fixed script path

* dbeaver/dbeaver-devops#1553 Fixed entrypoint

* dbeaver/dbeaver-devops#1574 Reworked script, added start process as dbeaver user

* dbeaver/dbeaver-devops#1574 Renamed script for launch container

* dbeaver/dbeaver-devops#1574 Added comments to script launch-products

---------

Co-authored-by: Daria Marutkina <125263541+dariamarutkina@users.noreply.github.com>

deploy/docker/cloudbeaver-ce/Dockerfile

@@ -2,12 +2,17 @@ FROM dbeaver/base-java
 
 MAINTAINER DBeaver Corp, devops@dbeaver.com
 
-RUN apt-get update; \
+RUN useradd -m -s /bin/bash dbeaver && \ 
+    apt-get update; \
     apt-get upgrade -y; 
 
 COPY cloudbeaver /opt/cloudbeaver
+COPY scripts/launch-product.sh /opt/cloudbeaver/launch-product.sh
+RUN chmod +x /opt/cloudbeaver/launch-product.sh
+RUN chown -R dbeaver:dbeaver /opt/cloudbeaver
 
 EXPOSE 8978
 RUN find /opt/cloudbeaver -type d -exec chmod 775 {} \;
 WORKDIR /opt/cloudbeaver/
-ENTRYPOINT ["./run-server.sh"]
+
+ENTRYPOINT ["./launch-product.sh"]

deploy/scripts/launch-product.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# This script is needed to change ownership and run the application as user dbeaver during the upgrade from version 24.2.0
+
+# Define the path to the workspace volume and user/group for ownership changes
+VOLUME_PATH="/opt/cloudbeaver/workspace"
+NEW_USER="dbeaver"
+NEW_GROUP="dbeaver"
+
+# Change ownership of the VOLUME_PATH to the dbeaver user and group
+chown -R $NEW_USER:$NEW_GROUP $VOLUME_PATH
+
+# This allows the dbeaver user and group to have read, write, and execute permissions, while others have only read and execute
+find $VOLUME_PATH -type d -exec chmod 775 {} +
+
+# This allows the dbeaver user and group to read and write files, while others can only read
+find $VOLUME_PATH -type f -exec chmod 664 {} +
+
+# This ensures that the root workspace directory itself has the correct permissions
+chmod 775 $VOLUME_PATH
+
+# Execute run-server.sh as the dbeaver user with the JAVA_HOME and PATH environment variables
+exec su $NEW_USER -c "JAVA_HOME=$JAVA_HOME PATH=$PATH ./run-server.sh"