Commit Graph

12 Commits

Author SHA1 Message Date
Pierre Prinetti eea99fe507 docker: Run as unprivileged user
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes https://github.com/ether/etherpad-lite/issues/3629
2019-10-24 11:29:19 +02:00
muxator bf7c7241fc docker: base our image on 10-buster-slim instead of buster-slim
A Docker base image without version is a bit of a moving target. Buster-slim,
for example, is currently based on nodejs 12.

For now, let's base our official Docker image on nodejs 10 (an LTS, non at End
of Life, which we explicitly mention in the documentation).

Amends a9a3bf9bd2 and the corresponding PR #3646.
2019-10-22 22:47:40 +02:00
Pierre Prinetti 6d9264cf3c docker: enable environment variables settings by default
By leveraging the templating mechanism in `settings.json`, this change allows a
Docker client to run a prebuilt image and change some basic configuration
settings, like the instance name or, more importantly, the database
coordinates.

By default, the image runs witho no administrative user enabled. If a value is
given to ADMIN_PASSWORD, the `admin` user will be activated.

Also closes https://github.com/ether/etherpad-lite/issues/3623

---
Modified by muxator to support conditional user activation at runtime.
2019-10-19 02:39:20 +02:00
Stefan Schwarz 070a5fd74f remove npm cache from image 2019-10-08 19:51:11 +02:00
Stefan Schwarz a9a3bf9bd2 use buster slim 2019-10-08 19:51:11 +02:00
Lars Olafsen 1789129b35 NODE_ENV controls run-time behaviour, thus needs to be set by ENV 2019-08-08 21:53:47 +02:00
muxator 4582f9daeb docker: support including plugins in custom builds.
This commit introduces the support for the ETHERPAD_PLUGINS build parameter,
which contains a list of plugins to be installed while building the container.

EXAMPLE:
  docker build --build-arg ETHERPAD_PLUGINS="ep_codepad ep_author_neat" --tag <YOUR_USERNAME>/etherpad .

Resolves #3618.
2019-07-16 14:14:34 +02:00
muxator e8e2284884 docker: move WORKDIR as on top as possible.
WORKDIR is also valid at build time, thus it makes sense to move it as towards
the top as possible.
This will come in hand in the next commits, when we will introduce support for
installing plugins while building the container.

Source: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#workdir

    [...] you should use WORKDIR instead of proliferating instructions like
         RUN cd … && do-something,
    which are hard to read, troubleshoot, and maintain.
2019-07-16 14:14:34 +02:00
Samuel Lelièvre aca1640fdf Fix typos in docker/Dockerfile
Fix "one" -> "done", and add missing closing parenthesis.
2019-04-01 12:28:14 +02:00
Adrien le Maire c1321f5b14 remove devdeps from prod builds 2019-03-29 17:52:06 +01:00
Eddie Barraco 7433d749f0 docker: remove supervisord from the Docker image
Supervision/management should not be done from inside the container, but
externally, by container managers.
The container now simply runs node on server.js.

The logs are now readable from docker logs <container_name>.
2019-03-21 23:52:35 +01:00
muxator bf68666ae1 docker: move the docker image creation inside the main repository
This is a super simple start.
At minimum, configuration via environment variables (see #3543) needs to be
integrated in Etherpad to make this user-friendly.

Resolves #3524.
2019-03-08 01:38:36 +01:00