DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run as user dropping privileges

Browse source
This commit is contained in:
Manuel de Brito Fontes 2018-06-10 22:30:37 -04:00 • committed by Manuel Alejandro de Brito Fontes
parent f7359a6062
commit 79199dd84c
No known key found for this signature in database
GPG key ID: 786136016A8BA02A
7 changed files with 34 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

11
rootfs/Dockerfile
View file

@ -20,7 +20,8 @@ WORKDIR /etc/nginx
RUN clean-install \
diffutils \
dumb-init
dumb-init \
libcap2-bin
# Create symlinks to redirect nginx logs to stdout and stderr docker log collector
# This only works if nginx is started with CMD or ENTRYPOINT
@ -30,6 +31,14 @@ RUN mkdir -p /var/log/nginx \
COPY . /
RUN setcap cap_net_bind_service=+ep /usr/sbin/nginx \
&& setcap cap_net_bind_service=+ep /nginx-ingress-controller
RUN mkdir -p /etc/ingress-controller/ssl /etc/ingress-controller/auth \
&& chown -R www-data.www-data /etc/nginx /etc/ingress-controller
USER www-data
ENTRYPOINT ["/usr/bin/dumb-init"]
CMD ["/nginx-ingress-controller"]