summaryrefslogtreecommitdiff
path: root/Dockerfile
diff options
context:
space:
mode:
authorTakuya Yoshida <hawaiianphoto@geekhost.net>2023-01-14 21:09:11 +0900
committerGitHub <noreply@github.com>2023-01-14 21:09:11 +0900
commite1bd61c70ee512a90666904eba8cf279f4366808 (patch)
treecb09e028469e1ff94db8d42fd5f21f95df0e172b /Dockerfile
parentNew Crowdin updates (#9552) (diff)
downloadsharkey-e1bd61c70ee512a90666904eba8cf279f4366808.tar.gz
sharkey-e1bd61c70ee512a90666904eba8cf279f4366808.tar.bz2
sharkey-e1bd61c70ee512a90666904eba8cf279f4366808.zip
Change docker user to non-root (#9560)
Diffstat (limited to 'Dockerfile')
-rw-r--r--Dockerfile30
1 files changed, 19 insertions, 11 deletions
diff --git a/Dockerfile b/Dockerfile
index 2383b5dc27..a86686426f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
-FROM node:18.13.0-bullseye AS builder
+ARG NODE_VERSION=18.13.0-bullseye
+
+FROM node:${NODE_VERSION} AS builder
ARG NODE_ENV=production
@@ -22,23 +24,29 @@ COPY . ./
RUN git submodule update --init
RUN yarn build
-FROM node:18.13.0-bullseye-slim AS runner
+FROM node:${NODE_VERSION}-slim AS runner
-WORKDIR /misskey
+ARG UID="991"
+ARG GID="991"
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
ffmpeg tini \
&& apt-get -y clean \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd -g "${GID}" misskey \
+ && useradd -l -u "${UID}" -g "${GID}" -m -d /misskey misskey
-COPY --from=builder /misskey/.yarn/install-state.gz ./.yarn/install-state.gz
-COPY --from=builder /misskey/node_modules ./node_modules
-COPY --from=builder /misskey/built ./built
-COPY --from=builder /misskey/packages/backend/node_modules ./packages/backend/node_modules
-COPY --from=builder /misskey/packages/backend/built ./packages/backend/built
-COPY --from=builder /misskey/packages/frontend/node_modules ./packages/frontend/node_modules
-COPY . ./
+USER misskey
+WORKDIR /misskey
+
+COPY --chown=misskey:misskey --from=builder /misskey/.yarn/install-state.gz ./.yarn/install-state.gz
+COPY --chown=misskey:misskey --from=builder /misskey/node_modules ./node_modules
+COPY --chown=misskey:misskey --from=builder /misskey/built ./built
+COPY --chown=misskey:misskey --from=builder /misskey/packages/backend/node_modules ./packages/backend/node_modules
+COPY --chown=misskey:misskey --from=builder /misskey/packages/backend/built ./packages/backend/built
+COPY --chown=misskey:misskey --from=builder /misskey/packages/frontend/node_modules ./packages/frontend/node_modules
+COPY --chown=misskey:misskey . ./
ENV NODE_ENV=production
ENTRYPOINT ["/usr/bin/tini", "--"]