Implement dockerPermissionStrategy

[eed3si9n]

Fixes #1189

This implements a non-root Docker container that's safer by default and compatible with Red Hat OpenShift.

Current ADD --chown=daemon:daemon opt /opt and USER daemon combination nominally implements non-root image, but by giving ownership of the working directory to the daemon user, it reduces the safety.
Instead we should use chmod to default to read-only access unless the build user opts into writable working directory.

The challenge is calling chmod without incurring the fs layer overhead (#883).
Multi-stage builds can be used to pre-stage the files with desired file permissions.

This adds new dockerPermissionStrategy setting which decides how file permissions are set for the working directory inside the Docker image generated by sbt-native-packager. The strategies are:

• DockerPermissionStrategy.MultiStage (default): uses multi-stage Docker build to call chmod ahead of time.
• DockerPermissionStrategy.None: does not attempt to change the file permissions, and use the host machine's file mode bits.
• DockerPermissionStrategy.Run: calls RUN in the Dockerfile. This has regression on the resulting Docker image file size.
• DockerPermissionStrategy.CopyChown: calls COPY --chown in the Dockerfile. Provided as a backward compatibility.

Working directory is read-only by default

For MultiStage and Run strategies, dockerChmodType is used in addition to call chmod during Docker build.

• DockerChmodType.UserGroupReadExecute (default): chmod -R u=rX,g=rX
• DockerChmodType.UserGroupWriteExecute: chmod -R u=rwX,g=rwX
• DockerChmodType.SyncGroupToUser: chmod -R g=u
• DockerChmodType.Custom: Custom argument provided by the user.

How to opt-in to writable working directory

Some application will require writing files to the working directory.
In that case the setting should be changed as follows:

import com.typesafe.sbt.packager.docker.DockerChmodType

dockerChmodType := DockerChmodType.UserGroupWriteExecute

Docker package validation

During docker:stage, Docker package validation is called to check if the selected strategy is compatible with the detected Docker version.
This fixes the current repeatability issue reported as #1187. If the incompatibility is detected, the user is advised to either upgrade their Docker, pick another strategy, or override the dockerVersion setting.

Use gid=0

daemonGroup is set to root instead of copying the value from the daemonUser setting.
This matches the semantics of USER as well as OpenShift, which uses gid=0.

[muuki88]

Thanks for the pull request @eed3si9n . I'll take a deeper look when I have some time. Hopefully this week.

[eed3si9n]

Cool. Let me squash the intermediate commits with failing tests.

[muuki88]

Awesome PR @eed3si9n . I really like the approach 😍

Only minor comments. Could you also add the the setting to the docker.rst documentation.

[muuki88]

Awesome! Thanks for the quick response. I'll trigger a release immediately.

[muuki88]

I always use the Squash and merge button from github 😁

[muuki88]

Documentation in the docker.rst can be added in a separate PR.

[aoboturov]

Hi, could anyone explain, how to make non-entrypoint executables executable?

here's an example of the ls -lah:

I tried different combinations of permission strategies and chmodtypes to no avail.