[WIP] Rootless docker

Dockerfile

@@ -21,19 +21,16 @@ RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
 FROM alpine:3.7
 LABEL maintainer="maintainers@gitea.io"
 
-EXPOSE 22 3000
+EXPOSE 2222 3000
 
 RUN apk --no-cache add \
     bash \
     ca-certificates \
     curl \
     gettext \
     git \
-    linux-pam \
-    openssh \
-    s6 \
+    openssh-keygen \
     sqlite \
-    su-exec \
     tzdata
 
 RUN addgroup \
@@ -48,14 +45,18 @@ RUN addgroup \
     git && \
   echo "git:$(dd if=/dev/urandom bs=24 count=1 status=none | base64)" | chpasswd
 
-ENV USER git
+
+RUN mkdir -p /data /app/gitea && chown -R git:git /data /app/gitea
+RUN ln -s /app/gitea/gitea /usr/local/bin/gitea
+
+USER git
 ENV GITEA_CUSTOM /data/gitea
 
 VOLUME ["/data"]
 
+WORKDIR /app/gitea
 ENTRYPOINT ["/usr/bin/entrypoint"]
-CMD ["/bin/s6-svscan", "/etc/s6"]
+CMD ["/app/gitea/gitea", "web"]
 
 COPY docker /
 COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
-RUN ln -s /app/gitea/gitea /usr/local/bin/gitea

docker/etc/templates/app.ini

@@ -1,4 +1,6 @@
 APP_NAME = $APP_NAME
+;RUN_USER = $RUN_USER
+;TODO
 RUN_MODE = $RUN_MODE
 
 [repository]
@@ -17,7 +19,12 @@ HTTP_PORT        = $HTTP_PORT
 ROOT_URL         = $ROOT_URL
 DISABLE_SSH      = $DISABLE_SSH
 SSH_PORT         = $SSH_PORT
+START_SSH_SERVER = true
+BUILTIN_SSH_SERVER_USER = $RUN_USER
+SSH_LISTEN_PORT = $SSH_LISTEN_PORT
+LFS_START_SERVER = true
 LFS_CONTENT_PATH = /data/git/lfs
+;Config via env variable new config
 
 [database]
 PATH = /data/gitea/gitea.db

docker/usr/bin/entrypoint

@@ -1,29 +1,32 @@
 #!/bin/sh
 
-if [ "${USER}" != "git" ]; then
+#TODO check permissions if root less
+#if [ "${USER}" != "git" ]; then
     # rename user
-    sed -i -e "s/^git\:/${USER}\:/g" /etc/passwd
+#    sed -i -e "s/^git\:/${USER}\:/g" /etc/passwd
     # switch sshd config to different user
-    sed -i -e "s/AllowUsers git/AllowUsers ${USER}/g" /etc/ssh/sshd_config
-fi
+#    sed -i -e "s/AllowUsers git/AllowUsers ${USER}/g" /etc/ssh/sshd_config
+#fi
 
 ## Change GID for USER?
-if [ -n "${USER_GID}" ] && [ "${USER_GID}" != "`id -g ${USER}`" ]; then
-    sed -i -e "s/^${USER}:\([^:]*\):[0-9]*/${USER}:\1:${USER_GID}/" /etc/group
-    sed -i -e "s/^${USER}:\([^:]*\):\([0-9]*\):[0-9]*/${USER}:\1:\2:${USER_GID}/" /etc/passwd
-fi
+#if [ -n "${USER_GID}" ] && [ "${USER_GID}" != "`id -g ${USER}`" ]; then
+#    sed -i -e "s/^${USER}:\([^:]*\):[0-9]*/${USER}:\1:${USER_GID}/" /etc/group
+#    sed -i -e "s/^${USER}:\([^:]*\):\([0-9]*\):[0-9]*/${USER}:\1:\2:${USER_GID}/" /etc/passwd
+#fi
 
 ## Change UID for USER?
-if [ -n "${USER_UID}" ] && [ "${USER_UID}" != "`id -u ${USER}`" ]; then
-    sed -i -e "s/^${USER}:\([^:]*\):[0-9]*:\([0-9]*\)/${USER}:\1:${USER_UID}:\2/" /etc/passwd
-fi
+#if [ -n "${USER_UID}" ] && [ "${USER_UID}" != "`id -u ${USER}`" ]; then
+#    sed -i -e "s/^${USER}:\([^:]*\):[0-9]*:\([0-9]*\)/${USER}:\1:${USER_UID}:\2/" /etc/passwd
+#fi
+
+#for FOLDER in /data/gitea/conf /data/gitea/log /data/git /data/ssh; do
+#    mkdir -p ${FOLDER}
+#done
 
-for FOLDER in /data/gitea/conf /data/gitea/log /data/git /data/ssh; do
-    mkdir -p ${FOLDER}
-done
+[[ -f /usr/bin/setup ]] && source /usr/bin/setup
 
 if [ $# -gt 0 ]; then
     exec "$@"
 else
-    exec /bin/s6-svscan /etc/s6
+    exec /app/gitea/gitea web
 fi

docker/etc/s6/gitea/setup → docker/usr/bin/setup

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+echo "Setup Test"
+
 if [ ! -d /data/git/.ssh ]; then
     mkdir -p /data/git/.ssh
     chmod 700 /data/git/.ssh
@@ -22,11 +24,13 @@ if [ ! -f /data/gitea/conf/app.ini ]; then
     # Substitude the environment variables in the template
     APP_NAME=${APP_NAME:-"Gitea: Git with a cup of tea"} \
     RUN_MODE=${RUN_MODE:-"dev"} \
+    RUN_USER=${USER:-"git"} \
     SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
     HTTP_PORT=${HTTP_PORT:-"3000"} \
     ROOT_URL=${ROOT_URL:-""} \
     DISABLE_SSH=${DISABLE_SSH:-"false"} \
-    SSH_PORT=${SSH_PORT:-"22"} \
+    SSH_PORT=${SSH_PORT:-"2222"} \
+    SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-$SSH_PORT} \
     DB_TYPE=${DB_TYPE:-"sqlite3"} \
     DB_HOST=${DB_HOST:-"localhost:3306"} \
     DB_NAME=${DB_NAME:-"gitea"} \
@@ -37,7 +41,9 @@ if [ ! -f /data/gitea/conf/app.ini ]; then
     REQUIRE_SIGNIN_VIEW=${REQUIRE_SIGNIN_VIEW:-"false"} \
     SECRET_KEY=${SECRET_KEY:-""} \
     envsubst < /etc/templates/app.ini > /data/gitea/conf/app.ini
+
+    cat /data/gitea/conf/app.ini
 fi
 
-chown -R ${USER}:git /data/gitea /app/gitea /data/git
+#chown -R ${USER}:git /data/gitea /app/gitea /data/git
 chmod 0755 /data/gitea /app/gitea /data/git