Incrementing version AFFECTS #485

fixed syslog warning when using --tty as described in #468

.travis.yml

@@ -3,5 +3,20 @@ sudo: required
 services:
   - docker
 
+env:
+  global:
+    - NAME=phusion/baseimage
+    # - VERSION=${TRAVIS_TAG}
+    - VERSION=${TRAVIS_BRANCH}
+
 script:
-  - make build
+  - docker build -t ${NAME}:${VERSION} --rm image
+  - env NAME=${NAME} VERSION=${VERSION} ./test/runner.sh
+
+after_success:
+  - docker login -u "${DOCKER_USERNAME}" -p "${DOCKER_PASSWORD}";
+    docker push ${NAME}:${VERSION};
+  # - if [ "${TRAVIS_BRANCH}" == "master" ]; then
+  #   docker tag ${NAME}:${VERSION} ${NAME}:latest
+  #   docker push ${NAME}:latest;
+  #   fi

CODE_OF_CONDUCT.md

@@ -0,0 +1,52 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at Phusion Passenger:
+
+[FloorD](https://github.com/floord) (she/her), floor@phusion.nl, English / Dutch / German
+
+[OnixGH](https://github.com/OnixGH) (he/his), daniel@phusion.nl, English / Dutch
+
+The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

Makefile

@@ -1,5 +1,5 @@
 NAME = phusion/baseimage
-VERSION = 0.9.21
+VERSION = 0.10.1
 
 .PHONY: all build test tag_latest release ssh
 
@@ -16,9 +16,8 @@ tag_latest:
 
 release: test tag_latest
 	@if ! docker images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi
-	@if ! head -n 1 Changelog.md | grep -q 'release date'; then echo 'Please note the release date in Changelog.md.' && false; fi
 	docker push $(NAME)
-	@echo "*** Don't forget to create a tag. git tag $(VERSION) && git push origin $(VERSION)"
+	@echo "*** Don't forget to create a tag by creating an official GitHub release."
 
 ssh:
 	chmod 600 image/services/sshd/keys/insecure_key
@@ -27,3 +26,11 @@ ssh:
 		IP=$$(docker inspect $$ID | grep IPAddr | sed 's/.*: "//; s/".*//') && \
 		echo "SSHing into $$IP" && \
 		ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i image/services/sshd/keys/insecure_key root@$$IP
+
+test_release:
+	echo test_release
+	env
+
+test_master:
+	echo test_master
+	env

README.md

@@ -1,9 +1,9 @@
 # A minimal Ubuntu base image modified for Docker-friendliness
 
-[![](https://badge.imagelayers.io/phusion/baseimage:0.9.17.svg)](https://imagelayers.io/?images=phusion/baseimage:latest 'Get your own badge on imagelayers.io')
+[![](https://badge.imagelayers.io/phusion/baseimage:latest.svg)](https://imagelayers.io/?images=phusion/baseimage:latest 'Get your own badge on imagelayers.io')
 [![Travis](https://img.shields.io/travis/phusion/baseimage-docker.svg)](https://travis-ci.org/phusion/baseimage-docker)
 
-_Baseimage-docker only consumes 6 MB RAM and is much powerful than Busybox or Alpine. See why below._
+_Baseimage-docker only consumes 8.3 MB RAM and is much more powerful than Busybox or Alpine. See why below._
 
 Baseimage-docker is a special [Docker](https://www.docker.com) image that is configured for correct use within Docker containers. It is Ubuntu, plus:
 
@@ -57,6 +57,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why
      * [Environment variable dumps](#envvar_dumps)
      * [Modifying environment variables](#modifying_envvars)
      * [Security](#envvar_security)
+   * [System logging](#logging)
    * [Upgrading the operating system inside the container](#upgrading_os)
  * [Container administration](#container_administration)
    * [Running a one-shot command in a new container](#oneshot)
@@ -95,8 +96,9 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why
 | cron | The cron daemon must be running for cron jobs to work. |
 | [runit](http://smarden.org/runit/) | Replaces Ubuntu's Upstart. Used for service supervision and management. Much easier to use than SysV init and supports restarting daemons when they crash. Much easier to use and more lightweight than Upstart. |
 | `setuser` | A tool for running a command as another user. Easier to use than `su`, has a smaller attack vector than `sudo`, and unlike `chpst` this tool sets `$HOME` correctly. Available as `/sbin/setuser`. |
+| `install_clean` | A tool for installing `apt` packages that automatically cleans up after itself.  All arguments are passed to `apt-get -y install --no-install-recommends` and after installation the apt caches are cleared.  To include recommended packages, add `--install-recommends`. |
 
-Baseimage-docker is very lightweight: it only consumes 6 MB of memory.
+Baseimage-docker is very lightweight: it only consumes 8.3 MB of memory.
 
 <a name="docker_single_process"></a>
 ### Wait, I thought Docker is about running a single process in a container?
@@ -198,7 +200,7 @@ In `Dockerfile`:
 
     RUN mkdir -p /etc/my_init.d
     COPY logtime.sh /etc/my_init.d/logtime.sh
-	  RUN chmod +x /etc/my_init.d/logtime.sh
+    RUN chmod +x /etc/my_init.d/logtime.sh
 
 <a name="environment_variables"></a>
 
@@ -302,6 +304,14 @@ If you are sure that your environment variables don't contain sensitive data, th
     RUN chmod 755 /etc/container_environment
     RUN chmod 644 /etc/container_environment.sh /etc/container_environment.json
 
+<a name="logging"></a>
+### System logging
+
+Baseimage-docker uses syslog-ng to provide a syslog facility to the container. Syslog-ng is not managed as an runit service (see below). Syslog messages are forwarded to the console.
+
+#### Log startup/shutdown sequence
+In order to ensure that all application log messages are captured by syslog-ng, syslog-ng is started separately before the runit supervisor process, and shutdown after runit exits. This uses the [startup script facility](#running_startup_scripts) provided by this image. This avoids a race condition which would exist if syslog-ng were managed as an runit service, where runit kills syslog-ng in parallel with the container's other services, causing log messages to be dropped during a graceful shutdown if syslog-ng exits while logs are still being produced by other services.
+
 <a name="upgrading_os"></a>
 ### Upgrading the operating system inside the container
 
@@ -440,7 +450,7 @@ Then, you can start your container with
 
     docker run -d -v `pwd`/myfolder:/etc/my_init.d my/dockerimage
 
-This will initialize sshd on container boot.  You can then access it with the insecure key as below, or using the methods to add a secure key.  Further, you can publish the port to your machine with -p 22:2222 allowing you to ssh to localhost:2222 instead of looking up the ip address.
+This will initialize sshd on container boot.  You can then access it with the insecure key as below, or using the methods to add a secure key.  Further, you can publish the port to your machine with -p 2222:22 allowing you to ssh to 127.0.0.1:2222 instead of looking up the ip address of the container.
 
 <a name="ssh_keys"></a>
 #### About SSH keys
@@ -485,7 +495,7 @@ Edit your Dockerfile to install the insecure key permanently:
 
     RUN /usr/sbin/enable_insecure_key
 
-Instructions for logging in the container is the same as in section [Using the insecure key for one container only](#using_the_insecure_key_for_one_container_only).
+Instructions for logging into the container is the same as in section [Using the insecure key for one container only](#using_the_insecure_key_for_one_container_only).
 
 <a name="using_your_own_key"></a>
 #### Using your own key

image/Dockerfile

@@ -6,11 +6,11 @@ COPY . /bd_build
 RUN /bd_build/prepare.sh && \
 	/bd_build/system_services.sh && \
 	/bd_build/utilities.sh && \
-	/bd_build/fix_pam_bug.sh && \
 	/bd_build/cleanup.sh
 
-ENV LANG en_US.UTF-8
+ENV DEBIAN_FRONTEND="teletype" \
-ENV LANGUAGE en_US:en
+    LANG="en_US.UTF-8" \
-ENV LC_ALL en_US.UTF-8
+    LANGUAGE="en_US:en" \
+    LC_ALL="en_US.UTF-8"
 
 CMD ["/sbin/my_init"]

image/bin/install_clean

@@ -0,0 +1,17 @@
+#!/bin/bash -e
+#  Apt installer helper for Docker images
+
+ARGS="$*"
+NO_RECOMMENDS="--no-install-recommends"
+RECOMMENDS="--install-recommends"
+if [[ $ARGS =~ "$RECOMMENDS" ]]; then
+    NO_RECOMMENDS=""
+    ARGS=$(sed "s/$RECOMMENDS//g" <<<"$ARGS")
+fi
+
+echo "Installing $ARGS"
+
+apt-get -q update && apt-get -qy install $NO_RECOMMENDS $ARGS \
+    && apt-get -qy autoremove \
+    && apt-get clean \
+    && rm -r /var/lib/apt/lists/*

image/bin/my_init

@@ -1,359 +1,420 @@
 #!/usr/bin/python3 -u
-import os, os.path, sys, stat, signal, errno, argparse, time, json, re
+# -*- coding: utf-8 -*-
+
+import argparse
+import errno
+import json
+import os
+import os.path
+import re
+import signal
+import stat
+import sys
+import time
+
+ENV_INIT_DIRECTORY = os.environ.get('ENV_INIT_DIRECTORY', '/etc/my_init.d')
 
 KILL_PROCESS_TIMEOUT = int(os.environ.get('KILL_PROCESS_TIMEOUT', 5))
 KILL_ALL_PROCESSES_TIMEOUT = int(os.environ.get('KILL_ALL_PROCESSES_TIMEOUT', 5))
 
 LOG_LEVEL_ERROR = 1
-LOG_LEVEL_WARN  = 1
+LOG_LEVEL_WARN = 1
-LOG_LEVEL_INFO  = 2
+LOG_LEVEL_INFO = 2
 LOG_LEVEL_DEBUG = 3
 
-SHENV_NAME_WHITELIST_REGEX = re.compile('[^\w\-_\.]')
+SHENV_NAME_WHITELIST_REGEX = re.compile('\W')
 
 log_level = None
 
 terminated_child_processes = {}
 
-class AlarmException(Exception):
-	pass
-
-def error(message):
-	if log_level >= LOG_LEVEL_ERROR:
-		sys.stderr.write("*** %s\n" % message)
-
-def warn(message):
-	if log_level >= LOG_LEVEL_WARN:
-		sys.stderr.write("*** %s\n" % message)
-
-def info(message):
-	if log_level >= LOG_LEVEL_INFO:
-		sys.stderr.write("*** %s\n" % message)
-
-def debug(message):
-	if log_level >= LOG_LEVEL_DEBUG:
-		sys.stderr.write("*** %s\n" % message)
-
-def ignore_signals_and_raise_keyboard_interrupt(signame):
-	signal.signal(signal.SIGTERM, signal.SIG_IGN)
-	signal.signal(signal.SIGINT, signal.SIG_IGN)
-	raise KeyboardInterrupt(signame)
-
-def raise_alarm_exception():
-	raise AlarmException('Alarm')
-
-def listdir(path):
-	try:
-		result = os.stat(path)
-	except OSError:
-		return []
-	if stat.S_ISDIR(result.st_mode):
-		return sorted(os.listdir(path))
-	else:
-		return []
-
-def is_exe(path):
-	try:
-		return os.path.isfile(path) and os.access(path, os.X_OK)
-	except OSError:
-		return False
-
-def import_envvars(clear_existing_environment = True, override_existing_environment = True):
-	if not os.path.exists("/etc/container_environment"):
-		return
-	new_env = {}
-	for envfile in listdir("/etc/container_environment"):
-		name = os.path.basename(envfile)
-		with open("/etc/container_environment/" + envfile, "r") as f:
-			# Text files often end with a trailing newline, which we
-			# don't want to include in the env variable value. See
-			# https://github.com/phusion/baseimage-docker/pull/49
-			value = re.sub('\n\Z', '', f.read())
-		new_env[name] = value
-	if clear_existing_environment:
-		os.environ.clear()
-	for name, value in new_env.items():
-		if override_existing_environment or not name in os.environ:
-			os.environ[name] = value
-
-def export_envvars(to_dir = True):
-	if not os.path.exists("/etc/container_environment"):
-		return
-	shell_dump = ""
-	for name, value in os.environ.items():
-		if name in ['HOME', 'USER', 'GROUP', 'UID', 'GID', 'SHELL']:
-			continue
-		if to_dir:
-			with open("/etc/container_environment/" + name, "w") as f:
-				f.write(value)
-		shell_dump += "export " + sanitize_shenvname(name) + "=" + shquote(value) + "\n"
-	with open("/etc/container_environment.sh", "w") as f:
-		f.write(shell_dump)
-	with open("/etc/container_environment.json", "w") as f:
-		f.write(json.dumps(dict(os.environ)))
-
 _find_unsafe = re.compile(r'[^\w@%+=:,./-]').search
 
-def shquote(s):
-	"""Return a shell-escaped version of the string *s*."""
-	if not s:
-		return "''"
-	if _find_unsafe(s) is None:
-		return s
 
-	# use single quotes, and put single quotes into double quotes
+class AlarmException(Exception):
-	# the string $'b is then quoted as '$'"'"'b'
+    pass
-	return "'" + s.replace("'", "'\"'\"'") + "'"
+
+
+def error(message):
+    if log_level >= LOG_LEVEL_ERROR:
+        sys.stderr.write("*** %s\n" % message)
+
+
+def warn(message):
+    if log_level >= LOG_LEVEL_WARN:
+        sys.stderr.write("*** %s\n" % message)
+
+
+def info(message):
+    if log_level >= LOG_LEVEL_INFO:
+        sys.stderr.write("*** %s\n" % message)
+
+
+def debug(message):
+    if log_level >= LOG_LEVEL_DEBUG:
+        sys.stderr.write("*** %s\n" % message)
+
+
+def ignore_signals_and_raise_keyboard_interrupt(signame):
+    signal.signal(signal.SIGTERM, signal.SIG_IGN)
+    signal.signal(signal.SIGINT, signal.SIG_IGN)
+    raise KeyboardInterrupt(signame)
+
+
+def raise_alarm_exception():
+    raise AlarmException('Alarm')
+
+
+def listdir(path):
+    try:
+        result = os.stat(path)
+    except OSError:
+        return []
+    if stat.S_ISDIR(result.st_mode):
+        return sorted(os.listdir(path))
+    else:
+        return []
+
+
+def is_exe(path):
+    try:
+        return os.path.isfile(path) and os.access(path, os.X_OK)
+    except OSError:
+        return False
+
+
+def import_envvars(clear_existing_environment=True, override_existing_environment=True):
+    if not os.path.exists("/etc/container_environment"):
+        return
+    new_env = {}
+    for envfile in listdir("/etc/container_environment"):
+        name = os.path.basename(envfile)
+        with open("/etc/container_environment/" + envfile, "r") as f:
+            # Text files often end with a trailing newline, which we
+            # don't want to include in the env variable value. See
+            # https://github.com/phusion/baseimage-docker/pull/49
+            value = re.sub('\n\Z', '', f.read())
+        new_env[name] = value
+    if clear_existing_environment:
+        os.environ.clear()
+    for name, value in new_env.items():
+        if override_existing_environment or name not in os.environ:
+            os.environ[name] = value
+
+
+def export_envvars(to_dir=True):
+    if not os.path.exists("/etc/container_environment"):
+        return
+    shell_dump = ""
+    for name, value in os.environ.items():
+        if name in ['HOME', 'USER', 'GROUP', 'UID', 'GID', 'SHELL']:
+            continue
+        if to_dir:
+            with open("/etc/container_environment/" + name, "w") as f:
+                f.write(value)
+        shell_dump += "export " + sanitize_shenvname(name) + "=" + shquote(value) + "\n"
+    with open("/etc/container_environment.sh", "w") as f:
+        f.write(shell_dump)
+    with open("/etc/container_environment.json", "w") as f:
+        f.write(json.dumps(dict(os.environ)))
+
+
+def shquote(s):
+    """Return a shell-escaped version of the string *s*."""
+    if not s:
+        return "''"
+    if _find_unsafe(s) is None:
+        return s
+
+    # use single quotes, and put single quotes into double quotes
+    # the string $'b is then quoted as '$'"'"'b'
+    return "'" + s.replace("'", "'\"'\"'") + "'"
+
 
 def sanitize_shenvname(s):
-	return re.sub(SHENV_NAME_WHITELIST_REGEX, "_", s)
+    """Return string with [0-9a-zA-Z_] characters"""
+    return re.sub(SHENV_NAME_WHITELIST_REGEX, "_", s)
+
 
 # Waits for the child process with the given PID, while at the same time
 # reaping any other child processes that have exited (e.g. adopted child
 # processes that have terminated).
+
 def waitpid_reap_other_children(pid):
-	global terminated_child_processes
+    global terminated_child_processes
 
-	status = terminated_child_processes.get(pid)
+    status = terminated_child_processes.get(pid)
-	if status:
+    if status:
-		# A previous call to waitpid_reap_other_children(),
+        # A previous call to waitpid_reap_other_children(),
-		# with an argument not equal to the current argument,
+        # with an argument not equal to the current argument,
-		# already waited for this process. Return the status
+        # already waited for this process. Return the status
-		# that was obtained back then.
+        # that was obtained back then.
-		del terminated_child_processes[pid]
+        del terminated_child_processes[pid]
-		return status
+        return status
 
-	done = False
+    done = False
-	status = None
+    status = None
-	while not done:
+    while not done:
-		try:
+        try:
-			# https://github.com/phusion/baseimage-docker/issues/151#issuecomment-92660569
+            # https://github.com/phusion/baseimage-docker/issues/151#issuecomment-92660569
-			this_pid, status = os.waitpid(pid, os.WNOHANG)
+            this_pid, status = os.waitpid(pid, os.WNOHANG)
-			if this_pid == 0:
+            if this_pid == 0:
-				this_pid, status = os.waitpid(-1, 0)
+                this_pid, status = os.waitpid(-1, 0)
-			if this_pid == pid:
+            if this_pid == pid:
-				done = True
+                done = True
-			else:
+            else:
-				# Save status for later.
+                # Save status for later.
-				terminated_child_processes[this_pid] = status
+                terminated_child_processes[this_pid] = status
-		except OSError as e:
+        except OSError as e:
-			if e.errno == errno.ECHILD or e.errno == errno.ESRCH:
+            if e.errno == errno.ECHILD or e.errno == errno.ESRCH:
-				return None
+                return None
-			else:
+            else:
-				raise
+                raise
-	return status
+    return status
+
+
+def stop_child_process(name, pid, signo=signal.SIGTERM, time_limit=KILL_PROCESS_TIMEOUT):
+    info("Shutting down %s (PID %d)..." % (name, pid))
+    try:
+        os.kill(pid, signo)
+    except OSError:
+        pass
+    signal.alarm(time_limit)
+    try:
+        try:
+            waitpid_reap_other_children(pid)
+        except OSError:
+            pass
+    except AlarmException:
+        warn("%s (PID %d) did not shut down in time. Forcing it to exit." % (name, pid))
+        try:
+            os.kill(pid, signal.SIGKILL)
+        except OSError:
+            pass
+        try:
+            waitpid_reap_other_children(pid)
+        except OSError:
+            pass
+    finally:
+        signal.alarm(0)
 
-def stop_child_process(name, pid, signo = signal.SIGTERM, time_limit = KILL_PROCESS_TIMEOUT):
-	info("Shutting down %s (PID %d)..." % (name, pid))
-	try:
-		os.kill(pid, signo)
-	except OSError:
-		pass
-	signal.alarm(time_limit)
-	try:
-		try:
-			waitpid_reap_other_children(pid)
-		except OSError:
-			pass
-	except AlarmException:
-		warn("%s (PID %d) did not shut down in time. Forcing it to exit." % (name, pid))
-		try:
-			os.kill(pid, signal.SIGKILL)
-		except OSError:
-			pass
-		try:
-			waitpid_reap_other_children(pid)
-		except OSError:
-			pass
-	finally:
-		signal.alarm(0)
 
 def run_command_killable(*argv):
-	filename = argv[0]
+    filename = argv[0]
-	status = None
+    status = None
-	pid = os.spawnvp(os.P_NOWAIT, filename, argv)
+    pid = os.spawnvp(os.P_NOWAIT, filename, argv)
-	try:
+    try:
-		status = waitpid_reap_other_children(pid)
+        status = waitpid_reap_other_children(pid)
-	except BaseException as s:
+    except BaseException:
-		warn("An error occurred. Aborting.")
+        warn("An error occurred. Aborting.")
-		stop_child_process(filename, pid)
+        stop_child_process(filename, pid)
-		raise
+        raise
-	if status != 0:
+    if status != 0:
-		if status is None:
+        if status is None:
-			error("%s exited with unknown status\n" % filename)
+            error("%s exited with unknown status\n" % filename)
-		else:
+        else:
-			error("%s failed with status %d\n" % (filename, os.WEXITSTATUS(status)))
+            error("%s failed with status %d\n" % (filename, os.WEXITSTATUS(status)))
-		sys.exit(1)
+        sys.exit(1)
+
 
 def run_command_killable_and_import_envvars(*argv):
-	run_command_killable(*argv)
+    run_command_killable(*argv)
-	import_envvars()
+    import_envvars()
-	export_envvars(False)
+    export_envvars(False)
+
 
 def kill_all_processes(time_limit):
-	info("Killing all processes...")
+    info("Killing all processes...")
-	try:
+    try:
-		os.kill(-1, signal.SIGTERM)
+        os.kill(-1, signal.SIGTERM)
-	except OSError:
+    except OSError:
-		pass
+        pass
-	signal.alarm(time_limit)
+    signal.alarm(time_limit)
-	try:
+    try:
-		# Wait until no more child processes exist.
+        # Wait until no more child processes exist.
-		done = False
+        done = False
-		while not done:
+        while not done:
-			try:
+            try:
-				os.waitpid(-1, 0)
+                os.waitpid(-1, 0)
-			except OSError as e:
+            except OSError as e:
-				if e.errno == errno.ECHILD:
+                if e.errno == errno.ECHILD:
-					done = True
+                    done = True
-				else:
+                else:
-					raise
+                    raise
-	except AlarmException:
+    except AlarmException:
-		warn("Not all processes have exited in time. Forcing them to exit.")
+        warn("Not all processes have exited in time. Forcing them to exit.")
-		try:
+        try:
-			os.kill(-1, signal.SIGKILL)
+            os.kill(-1, signal.SIGKILL)
-		except OSError:
+        except OSError:
-			pass
+            pass
-	finally:
+    finally:
-		signal.alarm(0)
+        signal.alarm(0)
+
 
 def run_startup_files():
-	# Run /etc/my_init.d/*
+    # Run ENV_INIT_DIRECTORY/*
-	for name in listdir("/etc/my_init.d"):
+    for name in listdir(ENV_INIT_DIRECTORY):
-		filename = "/etc/my_init.d/" + name
+        filename = os.path.join(ENV_INIT_DIRECTORY, name)
-		if is_exe(filename):
+        if is_exe(filename):
-			info("Running %s..." % filename)
+            info("Running %s..." % filename)
-			run_command_killable_and_import_envvars(filename)
+            run_command_killable_and_import_envvars(filename)
+
+    # Run /etc/rc.local.
+    if is_exe("/etc/rc.local"):
+        info("Running /etc/rc.local...")
+        run_command_killable_and_import_envvars("/etc/rc.local")
+
+
+def run_pre_shutdown_scripts():
+    debug("Running pre-shutdown scripts...")
+
+    # Run /etc/my_init.pre_shutdown.d/*
+    for name in listdir("/etc/my_init.pre_shutdown.d"):
+        filename = "/etc/my_init.pre_shutdown.d/" + name
+        if is_exe(filename):
+            info("Running %s..." % filename)
+            run_command_killable(filename)
+
+
+def run_post_shutdown_scripts():
+    debug("Running post-shutdown scripts...")
+
+    # Run /etc/my_init.post_shutdown.d/*
+    for name in listdir("/etc/my_init.post_shutdown.d"):
+        filename = "/etc/my_init.post_shutdown.d/" + name
+        if is_exe(filename):
+            info("Running %s..." % filename)
+            run_command_killable(filename)
 
-	# Run /etc/rc.local.
-	if is_exe("/etc/rc.local"):
-		info("Running /etc/rc.local...")
-		run_command_killable_and_import_envvars("/etc/rc.local")
 
 def start_runit():
-	info("Booting runit daemon...")
+    info("Booting runit daemon...")
-	pid = os.spawnl(os.P_NOWAIT, "/usr/bin/runsvdir", "/usr/bin/runsvdir",
+    pid = os.spawnl(os.P_NOWAIT, "/usr/bin/runsvdir", "/usr/bin/runsvdir",
-		"-P", "/etc/service")
+                    "-P", "/etc/service")
-	info("Runit started as PID %d" % pid)
+    info("Runit started as PID %d" % pid)
-	return pid
+    return pid
+
 
 def wait_for_runit_or_interrupt(pid):
-	try:
+	status = waitpid_reap_other_children(pid)
-		status = waitpid_reap_other_children(pid)
+	return (True, status)
-		return (True, status)
+
-	except KeyboardInterrupt:
+
-		return (False, None)
+def shutdown_runit_services(quiet=False):
+    if not quiet:
+        debug("Begin shutting down runit services...")
+    os.system("/usr/bin/sv -w %d down /etc/service/* > /dev/null" % KILL_PROCESS_TIMEOUT)
 
-def shutdown_runit_services(quiet = False):
-	if not quiet:
-		debug("Begin shutting down runit services...")
-	os.system("/usr/bin/sv -w %d down /etc/service/*", KILL_PROCESS_TIMEOUT)
 
 def wait_for_runit_services():
-	debug("Waiting for runit services to exit...")
+    debug("Waiting for runit services to exit...")
-	done = False
+    done = False
-	while not done:
+    while not done:
-		done = os.system("/usr/bin/sv status /etc/service/* | grep -q '^run:'") != 0
+        done = os.system("/usr/bin/sv status /etc/service/* | grep -q '^run:'") != 0
-		if not done:
+        if not done:
-			time.sleep(0.1)
+            time.sleep(0.1)
-			# According to https://github.com/phusion/baseimage-docker/issues/315
+            # According to https://github.com/phusion/baseimage-docker/issues/315
-			# there is a bug or race condition in Runit, causing it
+            # there is a bug or race condition in Runit, causing it
-			# not to shutdown services that are already being started.
+            # not to shutdown services that are already being started.
-			# So during shutdown we repeatedly instruct Runit to shutdown
+            # So during shutdown we repeatedly instruct Runit to shutdown
-			# services.
+            # services.
-			shutdown_runit_services(True)
+            shutdown_runit_services(True)
+
 
 def install_insecure_key():
-	info("Installing insecure SSH key for user root")
+    info("Installing insecure SSH key for user root")
-	run_command_killable("/usr/sbin/enable_insecure_key")
+    run_command_killable("/usr/sbin/enable_insecure_key")
+
 
 def main(args):
-	import_envvars(False, False)
+    import_envvars(False, False)
-	export_envvars()
+    export_envvars()
 
-	if args.enable_insecure_key:
+    if args.enable_insecure_key:
-		install_insecure_key()
+        install_insecure_key()
 
-	if not args.skip_startup_files:
+    if not args.skip_startup_files:
-		run_startup_files()
+        run_startup_files()
 
-	runit_exited = False
+    runit_exited = False
-	exit_code = None
+    exit_code = None
 
-	if not args.skip_runit:
+    if not args.skip_runit:
-		runit_pid = start_runit()
+        runit_pid = start_runit()
-	try:
+    try:
-		exit_status = None
+        exit_status = None
-		if len(args.main_command) == 0:
+        if len(args.main_command) == 0:
-			runit_exited, exit_code = wait_for_runit_or_interrupt(runit_pid)
+            runit_exited, exit_code = wait_for_runit_or_interrupt(runit_pid)
-			if runit_exited:
+            if runit_exited:
-				if exit_code is None:
+                if exit_code is None:
-					info("Runit exited with unknown status")
+                    info("Runit exited with unknown status")
-					exit_status = 1
+                    exit_status = 1
-				else:
+                else:
-					exit_status = os.WEXITSTATUS(exit_code)
+                    exit_status = os.WEXITSTATUS(exit_code)
-					info("Runit exited with status %d" % exit_status)
+                    info("Runit exited with status %d" % exit_status)
-		else:
+        else:
-			info("Running %s..." % " ".join(args.main_command))
+            info("Running %s..." % " ".join(args.main_command))
-			pid = os.spawnvp(os.P_NOWAIT, args.main_command[0], args.main_command)
+            pid = os.spawnvp(os.P_NOWAIT, args.main_command[0], args.main_command)
-			try:
+            try:
-				exit_code = waitpid_reap_other_children(pid)
+                exit_code = waitpid_reap_other_children(pid)
-				if exit_code is None:
+                if exit_code is None:
-					info("%s exited with unknown status." % args.main_command[0])
+                    info("%s exited with unknown status." % args.main_command[0])
-					exit_status = 1
+                    exit_status = 1
-				else:
+                else:
-					exit_status = os.WEXITSTATUS(exit_code)
+                    exit_status = os.WEXITSTATUS(exit_code)
-					info("%s exited with status %d." % (args.main_command[0], exit_status))
+                    info("%s exited with status %d." % (args.main_command[0], exit_status))
-			except KeyboardInterrupt:
+            except KeyboardInterrupt:
-				stop_child_process(args.main_command[0], pid)
+                stop_child_process(args.main_command[0], pid)
-				raise
+                raise
-			except BaseException as s:
+            except BaseException:
-				warn("An error occurred. Aborting.")
+                warn("An error occurred. Aborting.")
-				stop_child_process(args.main_command[0], pid)
+                stop_child_process(args.main_command[0], pid)
-				raise
+                raise
-		sys.exit(exit_status)
+        sys.exit(exit_status)
-	finally:
+    finally:
-		if not args.skip_runit:
+        if not args.skip_runit:
-			shutdown_runit_services()
+            run_pre_shutdown_scripts()
-			if not runit_exited:
+            shutdown_runit_services()
-				stop_child_process("runit daemon", runit_pid)
+            if not runit_exited:
-			wait_for_runit_services()
+                stop_child_process("runit daemon", runit_pid)
+            wait_for_runit_services()
+            run_post_shutdown_scripts()
 
 # Parse options.
-parser = argparse.ArgumentParser(description = 'Initialize the system.')
+parser = argparse.ArgumentParser(description='Initialize the system.')
-parser.add_argument('main_command', metavar = 'MAIN_COMMAND', type = str, nargs = '*',
+parser.add_argument('main_command', metavar='MAIN_COMMAND', type=str, nargs='*',
-	help = 'The main command to run. (default: runit)')
+                    help='The main command to run. (default: runit)')
-parser.add_argument('--enable-insecure-key', dest = 'enable_insecure_key',
+parser.add_argument('--enable-insecure-key', dest='enable_insecure_key',
-	action = 'store_const', const = True, default = False,
+                    action='store_const', const=True, default=False,
-	help = 'Install the insecure SSH key')
+                    help='Install the insecure SSH key')
-parser.add_argument('--skip-startup-files', dest = 'skip_startup_files',
+parser.add_argument('--skip-startup-files', dest='skip_startup_files',
-	action = 'store_const', const = True, default = False,
+                    action='store_const', const=True, default=False,
-	help = 'Skip running /etc/my_init.d/* and /etc/rc.local')
+                    help='Skip running /etc/my_init.d/* and /etc/rc.local')
-parser.add_argument('--skip-runit', dest = 'skip_runit',
+parser.add_argument('--skip-runit', dest='skip_runit',
-	action = 'store_const', const = True, default = False,
+                    action='store_const', const=True, default=False,
-	help = 'Do not run runit services')
+                    help='Do not run runit services')
-parser.add_argument('--no-kill-all-on-exit', dest = 'kill_all_on_exit',
+parser.add_argument('--no-kill-all-on-exit', dest='kill_all_on_exit',
-	action = 'store_const', const = False, default = True,
+                    action='store_const', const=False, default=True,
-	help = 'Don\'t kill all processes on the system upon exiting')
+                    help='Don\'t kill all processes on the system upon exiting')
-parser.add_argument('--quiet', dest = 'log_level',
+parser.add_argument('--quiet', dest='log_level',
-	action = 'store_const', const = LOG_LEVEL_WARN, default = LOG_LEVEL_INFO,
+                    action='store_const', const=LOG_LEVEL_WARN, default=LOG_LEVEL_INFO,
-	help = 'Only print warnings and errors')
+                    help='Only print warnings and errors')
 args = parser.parse_args()
 log_level = args.log_level
 
 if args.skip_runit and len(args.main_command) == 0:
-	error("When --skip-runit is given, you must also pass a main command.")
+    error("When --skip-runit is given, you must also pass a main command.")
-	sys.exit(1)
+    sys.exit(1)
 
 # Run main function.
 signal.signal(signal.SIGTERM, lambda signum, frame: ignore_signals_and_raise_keyboard_interrupt('SIGTERM'))
 signal.signal(signal.SIGINT, lambda signum, frame: ignore_signals_and_raise_keyboard_interrupt('SIGINT'))
 signal.signal(signal.SIGALRM, lambda signum, frame: raise_alarm_exception())
 try:
-	main(args)
+    main(args)
 except KeyboardInterrupt:
-	warn("Init system aborted.")
+    warn("Init system aborted.")
-	exit(2)
+    exit(2)
 finally:
-	if args.kill_all_on_exit:
+    if args.kill_all_on_exit:
-		kill_all_processes(KILL_ALL_PROCESSES_TIMEOUT)
+        kill_all_processes(KILL_ALL_PROCESSES_TIMEOUT)

image/bin/setuser

@@ -1,4 +1,5 @@
 #!/usr/bin/python3
+
 '''
 Copyright (c) 2013-2015 Phusion Holding B.V.
 

image/fix_pam_bug.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-set -e
-source /bd_build/buildconfig
-set -x
-
-# Fixes https://github.com/docker/docker/issues/6345
-# The Github is closed, but some apps such as pbuilder still triggers it.
-
-export CONFIGURE_OPTS=--disable-audit
-cd /tmp
-
-$minimal_apt_get_install gdebi-core
-apt-get build-dep -y --no-install-recommends pam
-apt-get source -y -b pam
-gdebi -n libpam-doc*.deb libpam-modules*.deb libpam-runtime*.deb libpam0g*.deb
-rm -rf *.deb *.gz *.dsc *.changes pam-*
-
-# Unfortunately there is no way to automatically remove build deps, so we do this manually.
-apt-get remove -y gdebi-core autoconf automake autopoint autotools-dev binutils bsdmainutils \
-	build-essential bzip2 cpp cpp-5 debhelper dh-autoreconf dh-strip-nondeterminism \
-	diffstat docbook-xml docbook-xsl dpkg-dev flex g++ g++-5 gcc gcc-5 gettext gettext-base \
-	groff-base intltool-debian libarchive-zip-perl libasan2 libasprintf0v5 libatomic1 \
-	libaudit-dev libc-dev-bin libc6-dev libcc1-0 libcilkrts5 libcrack2 libcrack2-dev libcroco3 \
-	libdb-dev libdb5.3-dev libdpkg-perl libfile-stripnondeterminism-perl libfl-dev libgc1c2 \
-	libgcc-5-dev libgdbm3 libgomp1 libgpm2 libicu55 libisl15 libitm1 liblsan0 libmpc3 \
-	libmpfr4 libmpx0 libpcre16-3 libpcre3-dev libpcre32-3 libpcrecpp0v5 libperl5.22 \
-	libpipeline1 libquadmath0 libselinux1-dev libsepol1-dev libsigsegv2 libstdc++-5-dev \
-	libtimedate-perl libtool libtsan0 libubsan0 libunistring0 libxml2 libxml2-utils \
-	libxslt1.1 linux-libc-dev m4 make man-db patch perl perl-modules-5.22 pkg-config \
-	po-debconf quilt sgml-base sgml-data w3m xml-core xsltproc xz-utils
-
-apt-get remove -y gdebi-core
-apt-get autoremove -y

image/prepare.sh

@@ -10,7 +10,8 @@ export INITRD=no
 mkdir -p /etc/container_environment
 echo -n no > /etc/container_environment/INITRD
 
-## Enable Ubuntu Universe and Multiverse.
+## Enable Ubuntu Universe, Multiverse, and deb-src for main.
+sed -i 's/^#\s*\(deb.*main restricted\)$/\1/g' /etc/apt/sources.list
 sed -i 's/^#\s*\(deb.*universe\)$/\1/g' /etc/apt/sources.list
 sed -i 's/^#\s*\(deb.*multiverse\)$/\1/g' /etc/apt/sources.list
 apt-get update
@@ -27,6 +28,9 @@ ln -sf /bin/true /sbin/initctl
 dpkg-divert --local --rename --add /usr/bin/ischroot
 ln -sf /bin/true /usr/bin/ischroot
 
+# apt-utils fix for Ubuntu 16.04
+$minimal_apt_get_install apt-utils
+
 ## Install HTTPS support for APT.
 $minimal_apt_get_install apt-transport-https ca-certificates
 
@@ -34,7 +38,7 @@ $minimal_apt_get_install apt-transport-https ca-certificates
 $minimal_apt_get_install software-properties-common
 
 ## Upgrade all packages.
-apt-get dist-upgrade -y --no-install-recommends
+apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::="--force-confold"
 
 ## Fix locale.
 $minimal_apt_get_install language-pack-en

image/services/syslog-ng/logrotate_syslogng

@@ -8,7 +8,6 @@
 	compress
 	postrotate
 		sv reload syslog-ng > /dev/null
-		sv restart syslog-forwarder > /dev/null
 	endscript
 }
 
@@ -34,6 +33,5 @@
 	sharedscripts
 	postrotate
 		sv reload syslog-ng > /dev/null
-		sv restart syslog-forwarder > /dev/null
 	endscript
 }

image/services/syslog-ng/syslog-forwarder.runit

@@ -1,2 +0,0 @@
-#!/bin/sh
-exec tail -F -n 0 /var/log/syslog

image/services/syslog-ng/syslog-ng.conf

@@ -74,6 +74,9 @@ destination d_xconsole { pipe("/dev/xconsole"); };
 # Debian only
 destination d_ppp { file("/var/log/ppp.log"); };
 
+# stdout for docker
+destination d_stdout { ##SYSLOG_OUTPUT_MODE_DEV_STDOUT##("/dev/stdout"); };
+
 ########################
 # Filters
 ########################
@@ -119,7 +122,7 @@ log { source(s_src); filter(f_cron); destination(d_cron); };
 log { source(s_src); filter(f_daemon); destination(d_daemon); };
 log { source(s_src); filter(f_kern); destination(d_kern); };
 log { source(s_src); filter(f_lpr); destination(d_lpr); };
-log { source(s_src); filter(f_syslog3); destination(d_syslog); };
+log { source(s_src); filter(f_syslog3); destination(d_syslog); destination(d_stdout); };
 log { source(s_src); filter(f_user); destination(d_user); };
 log { source(s_src); filter(f_uucp); destination(d_uucp); };
 

image/services/syslog-ng/syslog-ng.init

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -em
+
+# If /dev/log is either a named pipe or it was placed there accidentally,
+# e.g. because of the issue documented at https://github.com/phusion/baseimage-docker/pull/25,
+# then we remove it.
+if [ ! -S /dev/log ]; then rm -f /dev/log; fi
+if [ ! -S /var/lib/syslog-ng/syslog-ng.ctl ]; then rm -f /var/lib/syslog-ng/syslog-ng.ctl; fi
+
+# determine output mode on /dev/stdout because of the issue documented at https://github.com/phusion/baseimage-docker/issues/468
+if [ -p /dev/stdout ]; then
+  sed -i 's/##SYSLOG_OUTPUT_MODE_DEV_STDOUT##/pipe/' /etc/syslog-ng/syslog-ng.conf
+else
+  sed -i 's/##SYSLOG_OUTPUT_MODE_DEV_STDOUT##/file/' /etc/syslog-ng/syslog-ng.conf
+fi
+
+PIDFILE="/var/run/syslog-ng.pid"
+SYSLOGNG_OPTS=""
+
+[ -r /etc/default/syslog-ng ] && . /etc/default/syslog-ng
+
+syslogng_wait() {
+    if [ "$2" -ne 0 ]; then
+        return 1
+    fi
+
+    RET=1
+    for i in $(seq 1 30); do
+        status=0
+        syslog-ng-ctl stats >/dev/null 2>&1 || status=$?
+        if [ "$status" != "$1" ]; then
+            RET=0
+            break
+        fi
+        sleep 1s
+    done
+    return $RET
+}
+
+/usr/sbin/syslog-ng --pidfile "$PIDFILE" -F $SYSLOGNG_OPTS &
+syslogng_wait 1 $?

image/services/syslog-ng/syslog-ng.runit

@@ -1,32 +0,0 @@
-#!/bin/sh
-set -e
-
-# If /dev/log is either a named pipe or it was placed there accidentally,
-# e.g. because of the issue documented at https://github.com/phusion/baseimage-docker/pull/25,
-# then we remove it.
-if [ ! -S /dev/log ]; then rm -f /dev/log; fi
-if [ ! -S /var/lib/syslog-ng/syslog-ng.ctl ]; then rm -f /var/lib/syslog-ng/syslog-ng.ctl; fi
-
-SYSLOGNG_OPTS=""
-
-[ -r /etc/default/syslog-ng ] && . /etc/default/syslog-ng
-
-case "x$CONSOLE_LOG_LEVEL" in
-  x[1-8])
-    dmesg -n $CONSOLE_LOG_LEVEL
-    ;;
-  x)
-    ;;
-  *)
-    echo "CONSOLE_LOG_LEVEL is of unaccepted value."
-    ;;
-esac
-
-if [ ! -e /dev/xconsole ]
-then
-  mknod -m 640 /dev/xconsole p
-  chown root:adm /dev/xconsole
-  [ -x /sbin/restorecon ] && /sbin/restorecon $XCONSOLE
-fi
-
-exec syslog-ng -F -p /var/run/syslog-ng.pid $SYSLOGNG_OPTS

image/services/syslog-ng/syslog-ng.sh

@@ -7,18 +7,14 @@ SYSLOG_NG_BUILD_PATH=/bd_build/services/syslog-ng
 
 ## Install a syslog daemon.
 $minimal_apt_get_install syslog-ng-core
-mkdir /etc/service/syslog-ng
+cp $SYSLOG_NG_BUILD_PATH/syslog-ng.init /etc/my_init.d/10_syslog-ng.init
-cp $SYSLOG_NG_BUILD_PATH/syslog-ng.runit /etc/service/syslog-ng/run
+cp $SYSLOG_NG_BUILD_PATH/syslog-ng.shutdown /etc/my_init.post_shutdown.d/10_syslog-ng.shutdown
 mkdir -p /var/lib/syslog-ng
 cp $SYSLOG_NG_BUILD_PATH/syslog_ng_default /etc/default/syslog-ng
 touch /var/log/syslog
 chmod u=rw,g=r,o= /var/log/syslog
 cp $SYSLOG_NG_BUILD_PATH/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
 
-## Install syslog to "docker logs" forwarder.
-mkdir /etc/service/syslog-forwarder
-cp $SYSLOG_NG_BUILD_PATH/syslog-forwarder.runit /etc/service/syslog-forwarder/run
-
 ## Install logrotate.
 $minimal_apt_get_install logrotate
 cp $SYSLOG_NG_BUILD_PATH/logrotate.conf /etc/logrotate.conf

image/services/syslog-ng/syslog-ng.shutdown

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+PIDFILE="/var/run/syslog-ng.pid"
+
+syslogng_wait() {
+    if [ "$2" -ne 0 ]; then
+        return 1
+    fi
+
+    RET=1
+    for i in $(seq 1 30); do
+        status=0
+        syslog-ng-ctl stats >/dev/null 2>&1 || status=$?
+        if [ "$status" != "$1" ]; then
+            RET=0
+            break
+        fi
+        sleep 1s
+    done
+    return $RET
+}
+
+if [ -f "$PIDFILE" ]; then
+    kill $(cat "$PIDFILE")
+fi
+
+syslogng_wait 0 $?

image/system_services.sh

@@ -6,6 +6,8 @@ set -x
 ## Install init process.
 cp /bd_build/bin/my_init /sbin/
 mkdir -p /etc/my_init.d
+mkdir -p /etc/my_init.pre_shutdown.d
+mkdir -p /etc/my_init.post_shutdown.d
 mkdir -p /etc/container_environment
 touch /etc/container_environment.sh
 touch /etc/container_environment.json

image/utilities.sh

@@ -9,3 +9,6 @@ ln -s /usr/bin/vim.tiny /usr/bin/vim
 
 ## This tool runs a command as another user and sets $HOME.
 cp /bd_build/bin/setuser /sbin/setuser
+
+## This tool allows installation of apt packages with automatic cache cleanup.
+cp /bd_build/bin/install_clean /sbin/install_clean