mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-15 23:50:09 +00:00
a164a44e7f
Runs `corescope-server` and `corescope-ingestor` unprivileged, opt-in with `RUN_AS_UID`. A code-execution bug in either one then no longer lands as root next to the mounted data and `config.json`. `supervisord` stays root, for mosquitto and caddy. | `RUN_AS_UID` | Go services run as | |---|---| | unset (default) | root, as before. Upgrades change nothing | | set | `RUN_AS_UID` / `RUN_AS_GID` | With `RUN_AS_UID` set: - Each start hands the data directory to that uid (`chown -h`), except `.env` and anything mounted into it on its own. Failures are logged. - `.env` is read only if it is root-owned and only root can write it. `RUN_AS_UID` and `RUN_AS_GID` are never taken from it. - `/app` stays root's. **Depends on #2137.** - A uid with no account in the image gets one at start; `caddy` and `mosquitto` are reused. A uid that can't be provided fails startup instead of falling back to root. The logic is in `docker/select-service-user.sh`, tested by `docker/test-select-service-user.sh`, which needs no Docker or root and runs in CI. See also "Running the Go services unprivileged" in `docs/deployment.md`. Verified in the built image (master + this + #2137) across 14 cases. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Mythos 5.1 <noreply@anthropic.com> Co-authored-by: nullrouten <201262769+nullrouten0@users.noreply.github.com>
43 lines
2.1 KiB
Bash
43 lines
2.1 KiB
Bash
#!/bin/sh
|
|
|
|
# Config lives in the data directory (bind-mounted from host)
|
|
# The Go server already searches /app/data/config.json via LoadConfig
|
|
# but the ingestor expects a direct path — symlink for compatibility
|
|
if [ -f /app/data/config.json ]; then
|
|
ln -sf /app/data/config.json /app/config.json
|
|
elif [ ! -f /app/config.json ]; then
|
|
echo "[entrypoint] No config.json found in /app/data/ — using built-in defaults"
|
|
fi
|
|
|
|
# theme.json: check data/ volume (admin-editable on host)
|
|
if [ -f /app/data/theme.json ]; then
|
|
ln -sf /app/data/theme.json /app/theme.json
|
|
fi
|
|
|
|
# Which user runs the two Go services, and what they are handed. supervisord
|
|
# itself stays root so that mosquitto and caddy can still bind their ports.
|
|
# Unprivileged operation is opt-in via RUN_AS_UID, taken from the container's
|
|
# environment before .env is read; .env is then read (with the services
|
|
# unprivileged, only if root owns it) and the data directory handed over. The
|
|
# order matters and lives in one function: see docker/select-service-user.sh,
|
|
# and "Running the Go services unprivileged" in docs/deployment.md.
|
|
. /select-service-user.sh
|
|
prepare_service_user || exit 1
|
|
|
|
SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord.conf"
|
|
if [ "${DISABLE_MOSQUITTO:-false}" = "true" ] && [ "${DISABLE_CADDY:-false}" = "true" ]; then
|
|
echo "[config] internal MQTT broker disabled (DISABLE_MOSQUITTO=true)"
|
|
echo "[config] Caddy reverse proxy disabled (DISABLE_CADDY=true)"
|
|
SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-mosquitto-no-caddy.conf"
|
|
elif [ "${DISABLE_MOSQUITTO:-false}" = "true" ]; then
|
|
echo "[config] internal MQTT broker disabled (DISABLE_MOSQUITTO=true)"
|
|
SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-mosquitto.conf"
|
|
elif [ "${DISABLE_CADDY:-false}" = "true" ]; then
|
|
echo "[config] Caddy reverse proxy disabled (DISABLE_CADDY=true)"
|
|
SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-caddy.conf"
|
|
fi
|
|
|
|
echo "[entrypoint] Go services run as $CORESCOPE_SERVICE_USER (uid=$(id -u "$CORESCOPE_SERVICE_USER") gid=$(id -g "$CORESCOPE_SERVICE_USER"))"
|
|
|
|
exec /usr/bin/supervisord -c "$SUPERVISORD_CONF"
|