Skip to content

Commit c01ffa4

Browse files
tianontianon
committed
Adjust bits per review
1 parent 7db7ecc commit c01ffa4

File tree

13 files changed

+44
-63
lines changed

13 files changed

+44
-63
lines changed

‎18.09-rc/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ COPY docker-entrypoint.sh /usr/local/bin/
5454
# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH
5555
# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.)
5656
ENV DOCKER_TLS_CERTDIR=
57+
# also, ensure the directory pre-exists and has wide enough permissions for "dockerd-entrypoint.sh" to create subdirectories, even when run in "rootless" mode
58+
RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client
59+
# (doing both /certs and /certs/client so that if Docker does a "copy-up" into a volume defined on /certs/client, it will "do the right thing" by default in a way that still works for rootless users)
5760

5861
ENTRYPOINT ["docker-entrypoint.sh"]
5962
CMD ["sh"]

‎18.09-rc/dind/dockerd-entrypoint.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,11 @@ if [ "$1" = 'dockerd' ]; then
173173
--port-driver=builtin \
174174
--copy-up=/etc --copy-up=/run \
175175
${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
176-
sh -c '
177-
rm -f /run/docker /run/xtables.lock
178-
exec "$@" --userland-proxy-path=rootlesskit-docker-proxy
179-
' -- "$@"
176+
"$@" --userland-proxy-path=rootlesskit-docker-proxy
180177
fi
181-
elif [ "$1" = 'docker' ]; then
182-
exec docker-entrypoint.sh "$@"
178+
else
179+
# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too
180+
set -- docker-entrypoint.sh "$@"
183181
fi
184182

185183
exec "$@"

‎18.09/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ COPY docker-entrypoint.sh /usr/local/bin/
5454
# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH
5555
# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.)
5656
ENV DOCKER_TLS_CERTDIR=
57+
# also, ensure the directory pre-exists and has wide enough permissions for "dockerd-entrypoint.sh" to create subdirectories, even when run in "rootless" mode
58+
RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client
59+
# (doing both /certs and /certs/client so that if Docker does a "copy-up" into a volume defined on /certs/client, it will "do the right thing" by default in a way that still works for rootless users)
5760

5861
ENTRYPOINT ["docker-entrypoint.sh"]
5962
CMD ["sh"]

‎18.09/dind/dockerd-entrypoint.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,11 @@ if [ "$1" = 'dockerd' ]; then
173173
--port-driver=builtin \
174174
--copy-up=/etc --copy-up=/run \
175175
${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
176-
sh -c '
177-
rm -f /run/docker /run/xtables.lock
178-
exec "$@" --userland-proxy-path=rootlesskit-docker-proxy
179-
' -- "$@"
176+
"$@" --userland-proxy-path=rootlesskit-docker-proxy
180177
fi
181-
elif [ "$1" = 'docker' ]; then
182-
exec docker-entrypoint.sh "$@"
178+
else
179+
# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too
180+
set -- docker-entrypoint.sh "$@"
183181
fi
184182

185183
exec "$@"

‎19.03-rc/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ COPY docker-entrypoint.sh /usr/local/bin/
5454
# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH
5555
# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.)
5656
ENV DOCKER_TLS_CERTDIR=/certs
57+
# also, ensure the directory pre-exists and has wide enough permissions for "dockerd-entrypoint.sh" to create subdirectories, even when run in "rootless" mode
58+
RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client
59+
# (doing both /certs and /certs/client so that if Docker does a "copy-up" into a volume defined on /certs/client, it will "do the right thing" by default in a way that still works for rootless users)
5760

5861
ENTRYPOINT ["docker-entrypoint.sh"]
5962
CMD ["sh"]

‎19.03-rc/dind-rootless/Dockerfile‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -65,17 +65,9 @@ RUN set -eux; \
6565
apk del --no-network .rootlesskit-build-deps; \
6666
rootlesskit --version
6767

68-
# pre-create a few useful directories for our rootless user
68+
# pre-create "/var/lib/docker" for our rootless user
6969
RUN set -eux; \
70-
mkdir -p \
71-
/home/rootless/.local/share/docker \
72-
/home/rootless/certs/ca \
73-
/home/rootless/certs/client \
74-
/home/rootless/certs/server \
75-
; \
76-
chown -R rootless:rootless \
77-
/home/rootless/.local/share/docker \
78-
/home/rootless/certs
79-
ENV DOCKER_TLS_CERTDIR=/home/rootless/certs
70+
mkdir -p /home/rootless/.local/share/docker; \
71+
chown -R rootless:rootless /home/rootless/.local/share/docker
8072
VOLUME /home/rootless/.local/share/docker
8173
USER rootless

‎19.03-rc/dind/dockerd-entrypoint.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,11 @@ if [ "$1" = 'dockerd' ]; then
173173
--port-driver=builtin \
174174
--copy-up=/etc --copy-up=/run \
175175
${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
176-
sh -c '
177-
rm -f /run/docker /run/xtables.lock
178-
exec "$@" --userland-proxy-path=rootlesskit-docker-proxy
179-
' -- "$@"
176+
"$@" --userland-proxy-path=rootlesskit-docker-proxy
180177
fi
181-
elif [ "$1" = 'docker' ]; then
182-
exec docker-entrypoint.sh "$@"
178+
else
179+
# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too
180+
set -- docker-entrypoint.sh "$@"
183181
fi
184182

185183
exec "$@"

‎19.03/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ COPY docker-entrypoint.sh /usr/local/bin/
5454
# docker-entrypoint.sh uses DOCKER_TLS_CERTDIR for auto-setting DOCKER_TLS_VERIFY and DOCKER_CERT_PATH
5555
# (For this to work, at least the "client" subdirectory of this path needs to be shared between the client and server containers via a volume, "docker cp", or other means of data sharing.)
5656
ENV DOCKER_TLS_CERTDIR=/certs
57+
# also, ensure the directory pre-exists and has wide enough permissions for "dockerd-entrypoint.sh" to create subdirectories, even when run in "rootless" mode
58+
RUN mkdir /certs /certs/client && chmod 1777 /certs /certs/client
59+
# (doing both /certs and /certs/client so that if Docker does a "copy-up" into a volume defined on /certs/client, it will "do the right thing" by default in a way that still works for rootless users)
5760

5861
ENTRYPOINT ["docker-entrypoint.sh"]
5962
CMD ["sh"]

‎19.03/dind-rootless/Dockerfile‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -65,17 +65,9 @@ RUN set -eux; \
6565
apk del --no-network .rootlesskit-build-deps; \
6666
rootlesskit --version
6767

68-
# pre-create a few useful directories for our rootless user
68+
# pre-create "/var/lib/docker" for our rootless user
6969
RUN set -eux; \
70-
mkdir -p \
71-
/home/rootless/.local/share/docker \
72-
/home/rootless/certs/ca \
73-
/home/rootless/certs/client \
74-
/home/rootless/certs/server \
75-
; \
76-
chown -R rootless:rootless \
77-
/home/rootless/.local/share/docker \
78-
/home/rootless/certs
79-
ENV DOCKER_TLS_CERTDIR=/home/rootless/certs
70+
mkdir -p /home/rootless/.local/share/docker; \
71+
chown -R rootless:rootless /home/rootless/.local/share/docker
8072
VOLUME /home/rootless/.local/share/docker
8173
USER rootless

‎19.03/dind/dockerd-entrypoint.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,11 @@ if [ "$1" = 'dockerd' ]; then
173173
--port-driver=builtin \
174174
--copy-up=/etc --copy-up=/run \
175175
${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
176-
sh -c '
177-
rm -f /run/docker /run/xtables.lock
178-
exec "$@" --userland-proxy-path=rootlesskit-docker-proxy
179-
' -- "$@"
176+
"$@" --userland-proxy-path=rootlesskit-docker-proxy
180177
fi
181-
elif [ "$1" = 'docker' ]; then
182-
exec docker-entrypoint.sh "$@"
178+
else
179+
# if it isn't `dockerd` we're trying to run, pass it through `docker-entrypoint.sh` so it gets `DOCKER_HOST` set appropriately too
180+
set -- docker-entrypoint.sh "$@"
183181
fi
184182

185183
exec "$@"

0 commit comments

Comments
 (0)