This commit is contained in:
@@ -22,21 +22,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
zlib1g \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Herald drives the container daemon through its socket (DOCKER_HOST, default
|
||||
# unix:///var/run/docker.sock), so neither docker nor podman is needed here: the
|
||||
# compose file mounts the socket. Reaching that socket is what this user needs,
|
||||
# and the socket is root-equivalent, so either run the container as root or give
|
||||
# it the socket's group, e.g. `group_add: ["<gid of the host docker group>"]`.
|
||||
RUN useradd --create-home --shell /usr/sbin/nologin --uid 10001 herald
|
||||
|
||||
WORKDIR /app
|
||||
COPY --from=builder /app/target/release/herald-server ./herald-server
|
||||
|
||||
# git looks for its configuration under $HOME.
|
||||
ENV HOME=/home/herald
|
||||
|
||||
USER herald
|
||||
|
||||
# Exec form, so the binary is PID 1 and receives the SIGTERM it handles to shut
|
||||
# down gracefully.
|
||||
CMD ["./herald-server"]
|
||||
|
||||
Reference in New Issue
Block a user