112 lines
4.4 KiB
Docker
112 lines
4.4 KiB
Docker
# Copyright 2016 The Kubernetes Authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# HOW TO USE THIS CONTAINER:
|
|
#
|
|
# The only commandline argument (or env var) that is really required is
|
|
# `--repo` ($GIT_SYNC_REPO). Everything else is optional (run this with
|
|
# `--man` for details).
|
|
#
|
|
# This container will run as UID:GID 65533:65533 by default. For most users,
|
|
# the simplest ways to use this container are either:
|
|
# a) use the default UID/GID and mount a volume on /git writeable by those
|
|
# b) set your own UID/GID and mount a volume on /git writeable by those
|
|
#
|
|
# If you mount a volume anywhere else, you must set `--root` ($GIT_SYNC_ROOT).
|
|
# If you do not mount a volume, this will run but you can't access the results
|
|
# (which might be useful for testing, but not much else).
|
|
#
|
|
# Newly created docker volumes (the very first `docker run -v`) are initialized
|
|
# based on the in-image mountpoint's UID/GID?mode, so another solution for
|
|
# using this with docker is to set your own UID/GID and also add the default
|
|
# GID as a supplemental group (see `docker run --group-add`).
|
|
#
|
|
# Kubernetes offers `Pod.spec.securityContext.fsGroup` to manage volume
|
|
# permissions.
|
|
#
|
|
# If you set any UID other than the default and want to use git over SSH, you
|
|
# should set `--add-user` ($GIT_SYNC_ADD_USER).
|
|
|
|
#############################################################################
|
|
# First we prepare the image that we want, regardless of build layers.
|
|
#############################################################################
|
|
FROM {ARG_FROM} as prep
|
|
|
|
# When building, we can pass a unique value (e.g. `date +%s`) for this arg,
|
|
# which will force a rebuild from here (by invalidating docker's cache).
|
|
ARG FORCE_REBUILD=0
|
|
|
|
RUN apt-get -q -y update
|
|
RUN apt-get -q -y upgrade
|
|
RUN apt-get -q -y install --no-install-recommends \
|
|
ca-certificates \
|
|
coreutils \
|
|
socat \
|
|
openssh-client \
|
|
git
|
|
RUN apt-get -q -y autoremove
|
|
RUN rm -rf /var/lib/apt/lists/*
|
|
|
|
# Add the default UID to /etc/passwd so SSH is satisfied.
|
|
RUN echo "git-sync:x:65533:65533::/tmp:/sbin/nologin" >> /etc/passwd
|
|
# A user might choose a different UID and set the `--add-user` flag, which
|
|
# needs to be able to write to /etc/passwd.
|
|
RUN chmod 0666 /etc/passwd
|
|
|
|
# Add the default GID to /etc/group for completeness.
|
|
RUN echo "git-sync:x:65533:git-sync" >> /etc/group
|
|
|
|
# Make a directory that can be used to mount volumes. Setting the mode to
|
|
# include group-write allows users to run this image as a different user, as
|
|
# long as they use our git-sync group.
|
|
RUN mkdir -m 02775 /git && chown 65533:65533 /git
|
|
|
|
# When building, we can pass a hash of the licenses tree, which docker checks
|
|
# against its cache and can force a rebuild from here.
|
|
ARG HASH_LICENSES=0
|
|
|
|
# Add third-party licenses.
|
|
COPY .licenses/ /LICENSES/
|
|
|
|
# When building, we can pass a hash of the binary, which docker checks against
|
|
# its cache and can force a rebuild from here.
|
|
ARG HASH_BINARY=0
|
|
|
|
# Add the platform-specific binary.
|
|
COPY bin/{ARG_OS}_{ARG_ARCH}/{ARG_BIN} /{ARG_BIN}
|
|
|
|
#############################################################################
|
|
# Now we make a "clean" final image.
|
|
#############################################################################
|
|
FROM scratch
|
|
COPY --from=prep / /
|
|
|
|
# Run as non-root by default. There's simply no reason to run as root.
|
|
USER 65533:65533
|
|
|
|
# Setting HOME ensures that whatever UID this ultimately runs as can write to
|
|
# files like ~/.gitconfig.
|
|
ENV HOME=/tmp
|
|
WORKDIR /tmp
|
|
|
|
# Default values for flags.
|
|
# Git-sync itself does not default the `--root` ($GIT_SYNC_ROOT) flag, but we
|
|
# can set a default here, which makes the container image easier to use. The
|
|
# permissions were set for the default git-sync UID and GID. If the user needs
|
|
# a different group or sets `--root` ($GIT_SYNC_ROOT), their values will
|
|
# override this, and we assume they are handling permissions themselves.
|
|
ENV GIT_SYNC_ROOT=/git
|
|
|
|
ENTRYPOINT ["/{ARG_BIN}"]
|