Merge pull request #30 from sparkfabrik/proper_rootless

feat: proper rootless

Author: Monska85

Dockerfile

@@ -1,9 +1,35 @@
 FROM alpine:3.20
 
-RUN apk add --no-cache minio minio-client \
-  bash curl date file rsync tar unzip xz \
+RUN apk add --no-cache minio minio-client ca-certificates \
+  bash curl date file rsync tar unzip xz shadow \
   && ln -fs /usr/bin/mcli /usr/bin/mc
 
+# https://github.com/tianon/gosu/blob/3d395d499a92ffa47d70c79d24a738b85075f477/INSTALL.md
+ENV GOSU_VERSION=1.19
+RUN set -eux; \
+  \
+  apk add --no-cache --virtual .gosu-deps \
+    dpkg  gnupg ; \
+  \
+  dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
+  wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
+  wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
+  \
+# verify the signature
+  export GNUPGHOME="$(mktemp -d)"; \
+  gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
+  gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
+  gpgconf --kill all; \
+  rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
+  \
+# clean up fetch dependencies
+  apk del --no-network .gosu-deps; \
+  \
+  chmod +x /usr/local/bin/gosu; \
+# verify that the binary works
+  gosu --version; \
+  gosu nobody true
+
 # Copy scripts folder
 COPY scripts /scripts
 RUN chmod +x /scripts/entrypoint.sh

scripts/entrypoint.sh

@@ -113,8 +113,17 @@ if [ "${1}" = "minio" ]; then
   # Stop temporary MinIO server.
   minio_stop_temp_server
 
+  if [ -n "${MY_UID}" ]; then
+    usermod -u "${MY_UID}" minio
+    chown -R "${MY_UID}" "${BUCKET_ROOT}"
+  fi
+  if [ -n "${MY_GID}" ]; then
+    groupmod -g "${MY_GID}" minio
+    chgrp -R "${MY_GID}" "${BUCKET_ROOT}"
+  fi
+
   # Run minio.
-  exec /usr/bin/minio server "${BUCKET_ROOT}" --address ":${MINIO_PORT}" --console-address ":${MINIO_CONSOLE_PORT}" ${MINIO_OPTS}
+  gosu "${MY_UID:-root}:${MY_GID:-root}" /usr/bin/minio server "${BUCKET_ROOT}" --address ":${MINIO_PORT}" --console-address ":${MINIO_CONSOLE_PORT}" ${MINIO_OPTS}
 fi
 
 if [ "${1}" = "mc" ]; then