From 45c57234d7737bea6d6447503dd29869d8bffa11 Mon Sep 17 00:00:00 2001 From: Paul Becotte Date: Thu, 2 Apr 2015 11:36:39 -0400 Subject: [PATCH 01/26] Add instructions for enabling sshd on the fly without permanently enabling it in the dockerfile to the README --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index 2c838fb..2293801 100644 --- a/README.md +++ b/README.md @@ -386,6 +386,19 @@ Baseimage-docker disables the SSH server by default. Add the following to your D # init system will auto-generate one during boot. RUN /etc/my_init.d/00_regen_ssh_host_keys.sh +Alternatively, to enable sshd only for a single instance of your container, create a folder with a [startup script](#running_startup_scripts). The contents of that should be + + ### In myfolder/enable_ssh.sh (make sure this file is chmod +x): + #!/bin/sh + rm -f /etc/service/sshd/down + ssh-keygen -P "" -t dsa -f /etc/ssh/ssh_host_dsa_key + +Then, you can start your container with + + docker run -d -v `pwd`/myfolder:/etc/my_init.d my/dockerimage + +This will initialize sshd on container boot. You can then access it with the insecure key as below, or using the methods to add a secure key. Further, you can publish the port to your machine with -p 22:2222 allowing you to ssh to localhost:2222 instead of looking up the ip address. + #### About SSH keys From 17eadef537f609ecab292ea133eb0a1235db567f Mon Sep 17 00:00:00 2001 From: Alexander Buddenbrock Date: Tue, 17 Mar 2015 20:35:16 +0100 Subject: [PATCH 02/26] Use COPY instead of ADD MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While COPY and ADD are essentially interchangeable here, it is still considered good practice to use COPY whenever possible. From the docker docks on best practices: "Although ADD and COPY are functionally similar, generally speaking, COPY is preferred. That’s because it’s more transparent than ADD. [...] For other items (files, directories) that do not require ADD’s tar auto-extraction capability, you should always use COPY." Additionally, ADD commands were not cached prior to 0.7.3 (which was released on 2013-01-02). --- README.md | 6 +++--- README_ZH_cn_.md | 6 +++--- README_zh_tw.md | 6 +++--- image/Dockerfile | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 8b376a2..9f70f82 100644 --- a/README.md +++ b/README.md @@ -167,7 +167,7 @@ In `memcached.sh` (make sure this file is chmod +x): In `Dockerfile`: RUN mkdir /etc/service/memcached - ADD memcached.sh /etc/service/memcached/run + COPY memcached.sh /etc/service/memcached/run Note that the shell script must run the daemon **without letting it daemonize/fork it**. Usually, daemons provide a command line flag or a config file option for that. @@ -191,7 +191,7 @@ In `logtime.sh` (make sure this file is chmod +x): In `Dockerfile`: RUN mkdir -p /etc/my_init.d - ADD logtime.sh /etc/my_init.d/logtime.sh + COPY logtime.sh /etc/my_init.d/logtime.sh ### Environment variables @@ -456,7 +456,7 @@ Instructions for logging in the container is the same as in section [Using the i Edit your Dockerfile to install an SSH public key: ## Install an SSH of your choice. - ADD your_key.pub /tmp/your_key.pub + COPY your_key.pub /tmp/your_key.pub RUN cat /tmp/your_key.pub >> /root/.ssh/authorized_keys && rm -f /tmp/your_key.pub Then rebuild your image. Once you have that, start a container based on that image: diff --git a/README_ZH_cn_.md b/README_ZH_cn_.md index cca0dbe..736775f 100644 --- a/README_ZH_cn_.md +++ b/README_ZH_cn_.md @@ -156,7 +156,7 @@ The image is called `phusion/baseimage`, and is available on the Docker registry ### 在Dockerfile中: RUN mkdir /etc/service/memcached - ADD memcached.sh /etc/service/memcached/run + COPY memcached.sh /etc/service/memcached/run 注意脚本必须运行在后台的,**不能让他们进程进行daemonize/fork**.通常,后台进程会提供一个标志位或者配置文件. @@ -178,7 +178,7 @@ baseimage-docker的初始化脚本 `/sbin/my_init`,在启动的时候进程运 ### 在 Dockerfile中: RUN mkdir -p /etc/my_init.d - ADD logtime.sh /etc/my_init.d/logtime.sh + COPY logtime.sh /etc/my_init.d/logtime.sh @@ -487,7 +487,7 @@ Baseimage-docker提供了一个灵活的方式运行只要一闪而过的命令, 编辑你的dockerfile,来安装ssh public key: ## 安装你自己的public key. - ADD your_key.pub /tmp/your_key.pub + COPY your_key.pub /tmp/your_key.pub RUN cat /tmp/your_key.pub >> /root/.ssh/authorized_keys && rm -f /tmp/your_key.pub 重新创建你的镜像.一旦你创建成功,启动基于这个镜像的容器. diff --git a/README_zh_tw.md b/README_zh_tw.md index 1a8da2f..56690db 100644 --- a/README_zh_tw.md +++ b/README_zh_tw.md @@ -156,7 +156,7 @@ The image is called `phusion/baseimage`, and is available on the Docker registry ### 在Dockerfile中: RUN mkdir /etc/service/memcached - ADD memcached.sh /etc/service/memcached/run + COPY memcached.sh /etc/service/memcached/run 注意腳本必須運行在後臺的,**不能讓他們行程進行daemonize/fork**.通常,後臺行程會提供一個標誌位或者配置文件. @@ -178,7 +178,7 @@ baseimage-docker的初始化腳本 `/sbin/my_init`,在啓動的時候行程運 ### 在 Dockerfile中: RUN mkdir -p /etc/my_init.d - ADD logtime.sh /etc/my_init.d/logtime.sh + COPY logtime.sh /etc/my_init.d/logtime.sh @@ -487,7 +487,7 @@ Baseimage-docker提供了一個靈活的方式運行只要一閃而過的命令, 編輯你的dockerfile,來安裝ssh public key: ## 安裝你自己的public key. - ADD your_key.pub /tmp/your_key.pub + COPY your_key.pub /tmp/your_key.pub RUN cat /tmp/your_key.pub >> /root/.ssh/authorized_keys && rm -f /tmp/your_key.pub 重新創建你的鏡像.一旦你創建成功,啓動基於這個鏡像的容器. diff --git a/image/Dockerfile b/image/Dockerfile index 0de204c..4815943 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -1,7 +1,7 @@ FROM ubuntu:14.04 MAINTAINER Phusion -ADD . /bd_build +COPY . /bd_build RUN /bd_build/prepare.sh && \ /bd_build/system_services.sh && \ From ea6b0ace79ca455c141e58cde48800eec86b4af7 Mon Sep 17 00:00:00 2001 From: pavlobaron Date: Fri, 22 Jan 2016 09:49:48 +0100 Subject: [PATCH 03/26] configure process kill timeouts through environment with fallbacks --- image/bin/my_init | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/image/bin/my_init b/image/bin/my_init index a023b2a..fb34656 100755 --- a/image/bin/my_init +++ b/image/bin/my_init @@ -1,8 +1,8 @@ #!/usr/bin/python3 -u import os, os.path, sys, stat, signal, errno, argparse, time, json, re -KILL_PROCESS_TIMEOUT = 5 -KILL_ALL_PROCESSES_TIMEOUT = 5 +KILL_PROCESS_TIMEOUT = 5 if not os.environ.get('KILL_PROCESS_TIMEOUT') else os.environ.get('KILL_PROCESS_TIMEOUT') +KILL_ALL_PROCESSES_TIMEOUT = 5 if not os.environ.get('KILL_ALL_PROCESSES_TIMEOUT') else os.environ.get('KILL_ALL_PROCESSES_TIMEOUT') LOG_LEVEL_ERROR = 1 LOG_LEVEL_WARN = 1 From ecdbe62eca161dd3c33b8886f36161729734f20e Mon Sep 17 00:00:00 2001 From: Andreas Elvers Date: Wed, 24 Aug 2016 15:44:16 +0200 Subject: [PATCH 04/26] Removing -f option of `docker tag` since this option is gone in docker 1.12.0. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 4a07334..65b6528 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ test: env NAME=$(NAME) VERSION=$(VERSION) ./test/runner.sh tag_latest: - docker tag -f $(NAME):$(VERSION) $(NAME):latest + docker tag $(NAME):$(VERSION) $(NAME):latest release: test tag_latest @if ! docker images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi From d3eceae5ef4312115620daba2aa47b93e07e626a Mon Sep 17 00:00:00 2001 From: zhouhaibing089 Date: Mon, 12 Sep 2016 10:47:34 +0800 Subject: [PATCH 05/26] override the logrotate.conf without `su root syslog` --- image/services/syslog-ng/logrotate.conf | 36 +++++++++++++++++++++++++ image/services/syslog-ng/syslog-ng.sh | 1 + 2 files changed, 37 insertions(+) create mode 100644 image/services/syslog-ng/logrotate.conf diff --git a/image/services/syslog-ng/logrotate.conf b/image/services/syslog-ng/logrotate.conf new file mode 100644 index 0000000..cb2e78c --- /dev/null +++ b/image/services/syslog-ng/logrotate.conf @@ -0,0 +1,36 @@ +# see "man logrotate" for details +# rotate log files weekly +weekly + +# use the syslog group by default, since this is the owning group +# of /var/log/syslog. +# su root syslog + +# keep 4 weeks worth of backlogs +rotate 4 + +# create new (empty) log files after rotating old ones +create + +# uncomment this if you want your log files compressed +#compress + +# packages drop log rotation information into this directory +include /etc/logrotate.d + +# no packages own wtmp, or btmp -- we'll rotate them here +/var/log/wtmp { + missingok + monthly + create 0664 root utmp + rotate 1 +} + +/var/log/btmp { + missingok + monthly + create 0660 root utmp + rotate 1 +} + +# system-specific logs may be configured here diff --git a/image/services/syslog-ng/syslog-ng.sh b/image/services/syslog-ng/syslog-ng.sh index f655756..2b0be4a 100755 --- a/image/services/syslog-ng/syslog-ng.sh +++ b/image/services/syslog-ng/syslog-ng.sh @@ -21,4 +21,5 @@ cp $SYSLOG_NG_BUILD_PATH/syslog-forwarder.runit /etc/service/syslog-forwarder/ru ## Install logrotate. $minimal_apt_get_install logrotate +cp $SYSLOG_NG_BUILD_PATH/logrotate.conf /etc/logrotate.conf cp $SYSLOG_NG_BUILD_PATH/logrotate_syslogng /etc/logrotate.d/syslog-ng From bb3fef5377e3a4a99215eeef0f74c0156faed00d Mon Sep 17 00:00:00 2001 From: Achilleas Pipinellis Date: Tue, 6 Sep 2016 13:04:03 +0200 Subject: [PATCH 06/26] Expose the locales in Dockerfile While the locales are generated with locale-gen, this does not enforce the en_US.UTF-8 locale inside the container. See the following links for more information: - https://github.com/docker/docker/issues/2424 - http://jaredmarkell.com/docker-and-locales/ --- image/Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/image/Dockerfile b/image/Dockerfile index d543b36..e1a1fa4 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -9,4 +9,8 @@ RUN /bd_build/prepare.sh && \ /bd_build/fix_pam_bug.sh && \ /bd_build/cleanup.sh +ENV LANG en_US.UTF-8 +ENV LANGUAGE en_US:en +ENV LC_ALL en_US.UTF-8 + CMD ["/sbin/my_init"] From ac1211b0ed74ccffc76c934fc2403838acd42dae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Tue, 15 Nov 2016 16:41:47 +0100 Subject: [PATCH 07/26] Provided a fix for cron not working out of the box. --- image/services/cron/cron.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/image/services/cron/cron.sh b/image/services/cron/cron.sh index 7d884b9..bc1935e 100755 --- a/image/services/cron/cron.sh +++ b/image/services/cron/cron.sh @@ -7,6 +7,8 @@ $minimal_apt_get_install cron mkdir /etc/service/cron chmod 600 /etc/crontab cp /bd_build/services/cron/cron.runit /etc/service/cron/run +# Fix cron issues in 0.9.19, see also #345: https://github.com/phusion/baseimage-docker/issues/345 +sed -i 's/^\s*session\s\+required\s\+pam_loginuid.so/# &/' /etc/pam.d/cron ## Remove useless cron entries. # Checks for lost+found and scans for mtab. From 9920d9d834bb7ccfcf38faec68665a5f3a01a403 Mon Sep 17 00:00:00 2001 From: Jens Diemer Date: Tue, 29 Nov 2016 12:05:34 +0100 Subject: [PATCH 08/26] RUN chmod +x /etc/service/memcached/run is needed. otherwise i get the error: ``` fatal: unable to start ./run: access denied ``` --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 09a6fab..cc49d3f 100644 --- a/README.md +++ b/README.md @@ -170,6 +170,7 @@ In `Dockerfile`: RUN mkdir /etc/service/memcached ADD memcached.sh /etc/service/memcached/run + RUN chmod +x /etc/service/memcached/run Note that the shell script must run the daemon **without letting it daemonize/fork it**. Usually, daemons provide a command line flag or a config file option for that. From 4e80b8540aa1af1c2100c05c9ce0ef0a6f447632 Mon Sep 17 00:00:00 2001 From: Jens Diemer Date: Tue, 29 Nov 2016 12:18:43 +0100 Subject: [PATCH 09/26] RUN chmod +x --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 09a6fab..3402ef1 100644 --- a/README.md +++ b/README.md @@ -185,7 +185,7 @@ All scripts must exit correctly, e.g. with exit code 0. If any script exits with The following example shows how you can add a startup script. This script simply logs the time of boot to the file /tmp/boottime.txt. -In `logtime.sh` (make sure this file is chmod +x): +In `logtime.sh`: #!/bin/sh date > /tmp/boottime.txt @@ -194,6 +194,7 @@ In `Dockerfile`: RUN mkdir -p /etc/my_init.d ADD logtime.sh /etc/my_init.d/logtime.sh + RUN chmod +x /etc/my_init.d/logtime.sh ### Environment variables From 7400c0b3b874bf8928c203d551fb6a61bc41ef2c Mon Sep 17 00:00:00 2001 From: wangyuehong Date: Fri, 2 Dec 2016 23:30:13 +0900 Subject: [PATCH 10/26] typo fix for README_ZH_cn_.md and README_ZH_tw_.md --- README_ZH_cn_.md | 8 ++++---- README_zh_tw.md | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/README_ZH_cn_.md b/README_ZH_cn_.md index df018c1..5b7ff46 100644 --- a/README_ZH_cn_.md +++ b/README_ZH_cn_.md @@ -142,7 +142,7 @@ Baseimage-docker *鼓励* 通过runit来运行多进程. ### 增加后台进程 -你可以通过runit工具向你的镜像中添加后台进程(例如:你自己的某些应用).你需要编写一个运行你需要的后台进程的脚步就可以了,runit工具会保证它的正常运行,如果进程死掉,runit也会重启它的. +你可以通过runit工具向你的镜像中添加后台进程(例如:你自己的某些应用).你需要编写一个运行你需要的后台进程的脚本就可以了,runit工具会保证它的正常运行,如果进程死掉,runit也会重启它的. 脚本的名称必须是`run`,必须是可以运行的,它需要放到`/etc/service/`. @@ -434,10 +434,10 @@ Baseimage-docker提供了一个灵活的方式运行只要一闪而过的命令, * 不想使用`nsenter`,运行的进程和正在的进程会不一样. * 不需要docker主机提供root权限. * 运行你让用户登录到容器,而不需要登录到docker主机.然而,默认这是不启用的,因为baseimage-docker默认不是开放ssh服务的. - *　缺点 - * 需要设置ssh key.然而,baseimage-docker会提供一中办法,会让key的生成会很容器.阅读更多信息. + * 缺点 + * 需要设置ssh key.然而,baseimage-docker会提供一中办法,会让key的生成会很容易.阅读更多信息. -第一件事情,就是你需要确定你在容器中已经安装设置了ssh key. 默认,没有任何安装key的,所有你无法登录.为了方便的原因,我们提供了一个[已经生成的key](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key) [(PuTTY format)](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key.ppk),为了让你使用方便.然后,请注意这个key仅仅是为方便.他没有任何安全行,因为它的key是在网络上提供的.**在生产环境,你必须使用你自己的key.** +第一件事情,就是你需要确定你在容器中已经安装设置了ssh key. 默认是不安装任何key的,所以任何人都无法登录.为了方便的原因,我们提供了一个[已经生成的key](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key) [(PuTTY format)](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key.ppk),为了让你使用方便.然后,请注意这个key仅仅是为方便.他没有任何安全性,因为它的key是在网络上提供的.**在生产环境,你必须使用你自己的key.** diff --git a/README_zh_tw.md b/README_zh_tw.md index a2a2f7f..f334de3 100644 --- a/README_zh_tw.md +++ b/README_zh_tw.md @@ -143,7 +143,7 @@ The image is called `phusion/baseimage`, and is available on the Docker registry ### 增加後臺行程 -你可以通過runit工具向你的鏡像中添加後臺行程(例如:你自己的某些應用).你需要編寫一個運行你需要的後臺行程的腳步就可以了,runit工具會保證它的正常運行,如果行程死掉,runit也會重啓它的. +你可以通過runit工具向你的鏡像中添加後臺行程(例如:你自己的某些應用).你需要編寫一個運行你需要的後臺行程的腳本就可以了,runit工具會保證它的正常運行,如果行程死掉,runit也會重啓它的. 腳本的名稱必須是`run`,必須是可以運行的,它需要放到`/etc/service/`. @@ -435,10 +435,10 @@ Baseimage-docker提供了一個靈活的方式運行只要一閃而過的命令, * 不想使用`nsenter`,運行的行程和正在的行程會不一樣. * 不需要docker主機提供root權限. * 運行你讓用戶登錄到容器,而不需要登錄到docker主機.然而,默認這是不啓用的,因爲baseimage-docker默認不是開放ssh服務的. - *　缺點 - * 需要設置ssh key.然而,baseimage-docker會提供一中辦法,會讓key的生成會很容器.閱讀更多信息. + * 缺點 + * 需要設置ssh key.然而,baseimage-docker會提供一中辦法,會讓key的生成會很容易.閱讀更多信息. -第一件事情,就是你需要確定你在容器中已經安裝設置了ssh key. 默認,沒有任何安裝key的,所有你無法登錄.爲了方便的原因,我們提供了一個[已經生成的key](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key) [(PuTTY format)](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key.ppk),爲了讓你使用方便.然後,請注意這個key僅僅是爲方便.他沒有任何安全行,因爲它的key是在網絡上提供的.**在生產環境,你必須使用你自己的key.** +第一件事情,就是你需要確定你在容器中已經安裝設置了ssh key. 默認是不安裝任何key的,所以任何人都無法登錄.爲了方便的原因,我們提供了一個[已經生成的key](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key) [(PuTTY format)](https://github.com/phusion/baseimage-docker/blob/master/image/services/sshd/keys/insecure_key.ppk),爲了讓你使用方便.然後,請注意這個key僅僅是爲方便.他沒有任何安全性,因爲它的key是在網絡上提供的.**在生產環境,你必須使用你自己的key.** From ffb22ecf605f53f13fd864801fd7652652f2a012 Mon Sep 17 00:00:00 2001 From: Luke Campbell Date: Fri, 24 Feb 2017 12:03:53 -0500 Subject: [PATCH 11/26] Cleanup and improves readability of setuser --- image/bin/setuser | 80 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 59 insertions(+), 21 deletions(-) diff --git a/image/bin/setuser b/image/bin/setuser index 73ec53f..d95edc9 100755 --- a/image/bin/setuser +++ b/image/bin/setuser @@ -1,26 +1,64 @@ #!/usr/bin/python3 -import sys, os, pwd +''' +Copyright (c) 2013-2015 Phusion Holding B.V. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. +''' + +import sys +import os +import pwd -if len(sys.argv) < 3: - sys.stderr.write("Usage: /sbin/setuser USERNAME COMMAND [args..]\n") - sys.exit(1) def abort(message): - sys.stderr.write("setuser: %s\n" % message) - sys.exit(1) + sys.stderr.write("setuser: %s\n" % message) + sys.exit(1) + + +def main(): + ''' + A simple alternative to sudo that executes a command as a user by setting + the user ID and user parameters to those described by the system and then + using execvp(3) to execute the command without the necessity of a TTY + ''' + + username = sys.argv[1] + try: + user = pwd.getpwnam(username) + except KeyError: + abort("user %s not found" % username) + os.initgroups(username, user.pw_gid) + os.setgid(user.pw_gid) + os.setuid(user.pw_uid) + os.environ['USER'] = username + os.environ['HOME'] = user.pw_dir + os.environ['UID'] = str(user.pw_uid) + try: + os.execvp(sys.argv[2], sys.argv[2:]) + except OSError as e: + abort("cannot execute %s: %s" % (sys.argv[2], str(e))) + +if __name__ == '__main__': + + if len(sys.argv) < 3: + sys.stderr.write("Usage: /sbin/setuser USERNAME COMMAND [args..]\n") + sys.exit(1) + + main() -username = sys.argv[1] -try: - user = pwd.getpwnam(username) -except KeyError: - abort("user %s not found" % username) -os.initgroups(username, user.pw_gid) -os.setgid(user.pw_gid) -os.setuid(user.pw_uid) -os.environ['USER'] = username -os.environ['HOME'] = user.pw_dir -os.environ['UID'] = str(user.pw_uid) -try: - os.execvp(sys.argv[2], sys.argv[2:]) -except OSError as e: - abort("cannot execute %s: %s" % (sys.argv[2], str(e))) From 5cc60221e67001f5d8126791a98574101a56582a Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Sun, 19 Mar 2017 01:57:18 -0700 Subject: [PATCH 12/26] Document selection of syslog-ng over rsyslog Fixes #114 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e0ebd37..1b79962 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why | Ubuntu 16.04 LTS | The base system. | | A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._

According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly, and as a result their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time.

Furthermore, `docker stop` sends SIGTERM to the init process, which is then supposed to stop all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption.

Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. | | Fixes APT incompatibilities with Docker | See https://github.com/dotcloud/docker/issues/1024. | -| syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed.

Only listens locally. All syslog messages are forwarded to "docker logs". | +| syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed.

Only listens locally. All syslog messages are forwarded to "docker logs".

Why syslog-ng?
I've had bad experience with rsyslog. I regularly run into bugs with rsyslog, and once in a while it takes my log host down by entering a 100% CPU loop in which it can't do anything. Syslog-ng seems to be much more stable. | | logrotate | Rotates and compresses logs on a regular basis. | | SSH server | Allows you to easily login to your container to [inspect or administer](#login_ssh) things.

_SSH is **disabled by default** and is only one of the methods provided by baseimage-docker for this purpose. The other method is through [docker exec](#login_docker_exec). SSH is also provided as an alternative because `docker exec` comes with several caveats._

Password and challenge-response authentication are disabled by default. Only key authentication is allowed. | | cron | The cron daemon must be running for cron jobs to work. | From d9e762730a1c065cf3eac10d3435664edff44b61 Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Sun, 19 Mar 2017 16:17:52 -0700 Subject: [PATCH 13/26] cleaning up getter/setter for KILL_PROCESS_TIMEOUT/KILL_ALL_PROCESSES_TIMEOUT --- image/bin/my_init | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/image/bin/my_init b/image/bin/my_init index 54cf26a..354b362 100755 --- a/image/bin/my_init +++ b/image/bin/my_init @@ -1,8 +1,8 @@ #!/usr/bin/python3 -u import os, os.path, sys, stat, signal, errno, argparse, time, json, re -KILL_PROCESS_TIMEOUT = 5 if not os.environ.get('KILL_PROCESS_TIMEOUT') else os.environ.get('KILL_PROCESS_TIMEOUT') -KILL_ALL_PROCESSES_TIMEOUT = 5 if not os.environ.get('KILL_ALL_PROCESSES_TIMEOUT') else os.environ.get('KILL_ALL_PROCESSES_TIMEOUT') +KILL_PROCESS_TIMEOUT = os.environ.get('KILL_PROCESS_TIMEOUT', 5) +KILL_ALL_PROCESSES_TIMEOUT = os.environ.get('KILL_ALL_PROCESSES_TIMEOUT', 5) LOG_LEVEL_ERROR = 1 LOG_LEVEL_WARN = 1 @@ -276,7 +276,7 @@ def main(args): if not args.skip_startup_files: run_startup_files() - + runit_exited = False exit_code = None From e019d5fa115d39193f4414fd45b546ba695eb0f7 Mon Sep 17 00:00:00 2001 From: Enderson Maia Date: Wed, 28 Jan 2015 11:48:35 -0300 Subject: [PATCH 14/26] Preserve /build/{cleanup.sh,buildconfig} files. These files are useful for those who create Docker images based on this baseimage, and need to make a final cleanup and/or use some configurations that are inside buildconfig file. --- image/cleanup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/cleanup.sh b/image/cleanup.sh index d954a47..72ef0ce 100755 --- a/image/cleanup.sh +++ b/image/cleanup.sh @@ -4,7 +4,7 @@ source /bd_build/buildconfig set -x apt-get clean -rm -rf /bd_build +ls -d -1 /bd_build/**/* | grep -v "cleanup.sh" | grep -v "buildconfig" | xargs rm -f rm -rf /tmp/* /var/tmp/* rm -rf /var/lib/apt/lists/* From a09aae6dbacd443519a4d693f4a4e84bbd587042 Mon Sep 17 00:00:00 2001 From: Kingdon Barrett Date: Tue, 21 Mar 2017 02:40:54 +0000 Subject: [PATCH 15/26] fix libgc bug for i386 baseimage-docker --- image/Dockerfile | 3 ++- image/fix_libgc_bug.sh | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100755 image/fix_libgc_bug.sh diff --git a/image/Dockerfile b/image/Dockerfile index 0eea9b2..03a8e46 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:16.04 +FROM i386/ubuntu:16.04 MAINTAINER Phusion COPY . /bd_build @@ -6,6 +6,7 @@ COPY . /bd_build RUN /bd_build/prepare.sh && \ /bd_build/system_services.sh && \ /bd_build/utilities.sh && \ + /bd_build/fix_libgc_bug.sh && \ /bd_build/fix_pam_bug.sh && \ /bd_build/cleanup.sh diff --git a/image/fix_libgc_bug.sh b/image/fix_libgc_bug.sh new file mode 100755 index 0000000..375c409 --- /dev/null +++ b/image/fix_libgc_bug.sh @@ -0,0 +1,41 @@ +#!/bin/bash +set -e +source /bd_build/buildconfig +set -x + +# Fixes https://github.com/docker/docker/issues/6345 +# The Github is closed, but some apps such as pbuilder still triggers it. + +export CONFIGURE_OPTS=--disable-audit +cd /tmp + +$minimal_apt_get_install gdebi-core +apt-get build-dep -y --no-install-recommends libgc +apt-get source -y libgc +echo "#define NO_GETCONTEXT" >> libgc-7.4.2/include/private/gcconfig.h +pushd libgc-7.4.2 +dpkg-buildpackage -b +popd +gdebi -n libgc1c2_7.4.2-7.3ubuntu0.1_i386.deb +rm -rf *.deb *.gz *.dsc *.changes libgc-* + +# Unfortunately there is no way to automatically remove build deps, so we do this manually. +apt-get remove -y gdebi-core autoconf automake autopoint autotools-dev binutils bsdmainutils \ + build-essential bzip2 cpp cpp-5 debhelper dh-autoreconf dh-strip-nondeterminism \ + diffstat dpkg-dev g++ g++-5 gcc gcc-5 gettext gettext-base groff-base hardening-includes \ + intltool-debian libapt-pkg-perl libarchive-zip-perl libasan2 libasprintf0v5 libatomic-ops-dev \ + libatomic1 libc-dev-bin libc6-dev libcc1-0 libcgi-pm-perl libcilkrts5 libclass-accessor-perl \ + libclone-perl libcroco3 libdata-alias-perl libdigest-hmac-perl libdpkg-perl libemail-valid-perl \ + libexporter-tiny-perl libfile-basedir-perl libfile-stripnondeterminism-perl libgcc-5-dev libgdbm3 \ + libgomp1 libhtml-parser-perl libhtml-tagset-perl libicu55 libio-pty-perl libio-socket-inet6-perl \ + libio-socket-ssl-perl libio-string-perl libipc-run-perl libipc-system-simple-perl libisl15 \ + libitm1 liblist-moreutils-perl liblocale-gettext-perl libmailtools-perl libmpc3 libmpfr4 libmpx0 \ + libnet-dns-perl libnet-domain-tld-perl libnet-ip-perl libnet-smtp-ssl-perl libnet-ssleay-perl \ + libparse-debianchangelog-perl libperl5.22 libpipeline1 libquadmath0 libsigsegv2 libsocket6-perl \ + libstdc++-5-dev libsub-name-perl libtext-levenshtein-perl libtimedate-perl libtool libubsan0 \ + libunistring0 liburi-perl libxml2 libyaml-libyaml-perl lintian linux-libc-dev m4 make man-db \ + netbase patch patchutils perl perl-modules-5.22 pkg-config pkg-kde-tools po-debconf t1utils \ + xz-utils + +apt-get remove -y gdebi-core +apt-get autoremove -y From 2a9860b12006d9ba0ed28397050457f21ecb2bf4 Mon Sep 17 00:00:00 2001 From: Kingdon Barrett Date: Tue, 21 Mar 2017 03:07:34 +0000 Subject: [PATCH 16/26] packages don't exist and aren't build deps on i386 --- image/fix_pam_bug.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/image/fix_pam_bug.sh b/image/fix_pam_bug.sh index ca4be4e..e145ef6 100755 --- a/image/fix_pam_bug.sh +++ b/image/fix_pam_bug.sh @@ -22,10 +22,10 @@ apt-get remove -y gdebi-core autoconf automake autopoint autotools-dev binutils groff-base intltool-debian libarchive-zip-perl libasan2 libasprintf0v5 libatomic1 \ libaudit-dev libc-dev-bin libc6-dev libcc1-0 libcilkrts5 libcrack2 libcrack2-dev libcroco3 \ libdb-dev libdb5.3-dev libdpkg-perl libfile-stripnondeterminism-perl libfl-dev libgc1c2 \ - libgcc-5-dev libgdbm3 libgomp1 libgpm2 libicu55 libisl15 libitm1 liblsan0 libmpc3 \ + libgcc-5-dev libgdbm3 libgomp1 libgpm2 libicu55 libisl15 libitm1 libmpc3 \ libmpfr4 libmpx0 libpcre16-3 libpcre3-dev libpcre32-3 libpcrecpp0v5 libperl5.22 \ libpipeline1 libquadmath0 libselinux1-dev libsepol1-dev libsigsegv2 libstdc++-5-dev \ - libtimedate-perl libtool libtsan0 libubsan0 libunistring0 libxml2 libxml2-utils \ + libtimedate-perl libtool libubsan0 libunistring0 libxml2 libxml2-utils \ libxslt1.1 linux-libc-dev m4 make man-db patch perl perl-modules-5.22 pkg-config \ po-debconf quilt sgml-base sgml-data w3m xml-core xsltproc xz-utils From 9fed983d8072c3b597a810f39580232879cb487a Mon Sep 17 00:00:00 2001 From: Kingdon Barrett Date: Tue, 21 Mar 2017 03:17:24 +0000 Subject: [PATCH 17/26] services/cron sshd syslog-ng are all directories rm -f balks at wiping them out --- image/cleanup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/cleanup.sh b/image/cleanup.sh index 72ef0ce..1dd3ad0 100755 --- a/image/cleanup.sh +++ b/image/cleanup.sh @@ -4,7 +4,7 @@ source /bd_build/buildconfig set -x apt-get clean -ls -d -1 /bd_build/**/* | grep -v "cleanup.sh" | grep -v "buildconfig" | xargs rm -f +ls -d -1 /bd_build/**/* | grep -v "cleanup.sh" | grep -v "buildconfig" | grep -v "services/" | xargs rm -f rm -rf /tmp/* /var/tmp/* rm -rf /var/lib/apt/lists/* From 5205fa04f7e16dff058d561b20785775d604b885 Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Mon, 20 Mar 2017 20:48:24 -0700 Subject: [PATCH 18/26] Updating README.md Fixes #228 --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 1b79962..202cd6b 100644 --- a/README.md +++ b/README.md @@ -184,6 +184,8 @@ The baseimage-docker init system, `/sbin/my_init`, runs the following scripts du All scripts must exit correctly, e.g. with exit code 0. If any script exits with a non-zero exit code, the booting will fail. +**Important note:** If you are executing the container in interactive mode (i.e. when you run a container with `-it`), rather than daemon mode, you are sending stdout directly to the terminal (`-i` interactive `-t` terminal). If you are not calling `/sbin/my_init` in your run declaration, `/sbin/my_init` will not be executed, therefore your scripts will not be called during container startup. + The following example shows how you can add a startup script. This script simply logs the time of boot to the file /tmp/boottime.txt. In `logtime.sh`: From 7e02e426e5913b6f7d8363ed7c65ac578410a47e Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Mon, 20 Mar 2017 20:59:39 -0700 Subject: [PATCH 19/26] Update README.md regarding ignored env vars. Closes #119 --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 202cd6b..2ba6f12 100644 --- a/README.md +++ b/README.md @@ -207,6 +207,7 @@ If you use `/sbin/my_init` as the main container command, then any environment v * Environment variables on Unix are inherited on a per-process basis. This means that it is generally not possible for a child process to change the environment variables of other processes. * Because of the aforementioned point, there is no good central place for defining environment variables for all applications and services. Debian has the `/etc/environment` file but it only works in some situations. * Some services change environment variables for child processes. Nginx is one such example: it removes all environment variables unless you explicitly instruct it to retain them through the `env` configuration option. If you host any applications on Nginx (e.g. using the [passenger-docker](https://github.com/phusion/passenger-docker) image, or using Phusion Passenger in your own image) then they will not see the environment variables that were originally passed by Docker. + * We ignore HOME, SHELL, USER and a bunch of other environment variables on purpose, because _not_ ignoring them will break multi-user containers. See https://github.com/phusion/baseimage-docker/pull/86 -- A workaround for setting the `HOME` environment variable looks like this: `RUN echo /root > /etc/container_environment/HOME`. See https://github.com/phusion/baseimage-docker/issues/119 `my_init` provides a solution for all these caveats. From 8f33bcf3d2af37307b477616125ba0f31d95603e Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 01:26:07 -0700 Subject: [PATCH 20/26] Create .travis.yml Adding Travis-CI --- .travis.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .travis.yml diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..4f9cf73 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,7 @@ +sudo: required + +services: + - docker + +script: + - make build From c1d2b4bad8a711a3eabe0043151e2da91e1a2f85 Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 01:49:54 -0700 Subject: [PATCH 21/26] Update README.md Adding travis-ci badge to README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 2ba6f12..5ebb22d 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ # A minimal Ubuntu base image modified for Docker-friendliness [![](https://badge.imagelayers.io/phusion/baseimage:0.9.17.svg)](https://imagelayers.io/?images=phusion/baseimage:latest 'Get your own badge on imagelayers.io') +[![Travis](https://img.shields.io/travis/phusion/baseimage-docker.svg)](https://travis-ci.org/phusion/baseimage-docker) _Baseimage-docker only consumes 6 MB RAM and is much powerful than Busybox or Alpine. See why below._ From ce5038b2a7711394265768bf14fa77eb8b632f8a Mon Sep 17 00:00:00 2001 From: romantic668 Date: Tue, 21 Mar 2017 02:20:17 -0700 Subject: [PATCH 22/26] Update README.md Hi, I am doing a technical writing project. It is good practice to keep the writing concise. For example, I removed ...supposed to... Though it may lead to loss in meaning, readers will benefit from this concision. Hope it helps --- README.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 5ebb22d..9b2de46 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Baseimage-docker is available for pulling from [the Docker registry](https://reg ### What are the problems with the stock Ubuntu base image? -Ubuntu is not designed to be run inside Docker. Its init system, Upstart, assumes that it's running on either real hardware or virtualized hardware, but not inside a Docker container. But inside a container you don't want a full system anyway, you want a minimal system. But configuring that minimal system for use within a container has many strange corner cases that are hard to get right if you are not intimately familiar with the Unix system model. This can cause a lot of strange problems. +Ubuntu is not designed to be run inside Docker. Its init system, Upstart, assumes that it's running on either real hardware or virtualized hardware, but not inside a Docker container. But inside a container you don't want a full system; you want a minimal system. Configuring that minimal system for use within a container has many strange corner cases that are hard to get right if you are not intimately familiar with the Unix system model. This can cause a lot of strange problems. Baseimage-docker gets everything right. The "Contents" section describes all the things that it modifies. @@ -27,7 +27,7 @@ Baseimage-docker gets everything right. The "Contents" section describes all the You can configure the stock `ubuntu` image yourself from your Dockerfile, so why bother using baseimage-docker? * Configuring the base system for Docker-friendliness is no easy task. As stated before, there are many corner cases. By the time that you've gotten all that right, you've reinvented baseimage-docker. Using baseimage-docker will save you from this effort. - * It reduces the time needed to write a correct Dockerfile. You won't have to worry about the base system and can focus on your stack and your app. + * It reduces the time needed to write a correct Dockerfile. You won't have to worry about the base system and focusing you on the stack and the app. * It reduces the time needed to run `docker build`, allowing you to iterate your Dockerfile more quickly. * It reduces download time during redeploys. Docker only needs to download the base image once: during the first deploy. On every subsequent deploys, only the changes you make on top of the base image are downloaded. @@ -87,7 +87,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why | Component | Why is it included? / Remarks | | ---------------- | ------------------- | | Ubuntu 16.04 LTS | The base system. | -| A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._

According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly, and as a result their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time.

Furthermore, `docker stop` sends SIGTERM to the init process, which is then supposed to stop all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption.

Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. | +| A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._

According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly. As a result, their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time.

Furthermore, `docker stop` sends SIGTERM to the init process, which stops all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption.

Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. | | Fixes APT incompatibilities with Docker | See https://github.com/dotcloud/docker/issues/1024. | | syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed.

Only listens locally. All syslog messages are forwarded to "docker logs".

Why syslog-ng?
I've had bad experience with rsyslog. I regularly run into bugs with rsyslog, and once in a while it takes my log host down by entering a 100% CPU loop in which it can't do anything. Syslog-ng seems to be much more stable. | | logrotate | Rotates and compresses logs on a regular basis. | @@ -112,11 +112,11 @@ Do we advocate running multiple *logical services* in a single container? Not ne ### Does Baseimage-docker advocate "fat containers" or "treating containers as VMs"? -There are people who are under the impression that Baseimage-docker advocates treating containers as VMs, because of the fact that Baseimage-docker advocates the use of multiple processes. Therefore they are also under the impression that Baseimage-docker does not follow the Docker philosophy. Neither of these impressions are true. +There are people who think that Baseimage-docker advocates treating containers as VMs because Baseimage-docker advocates the use of multiple processes. Therefore, they also think that Baseimage-docker does not follow the Docker philosophy. Neither of these impressions are true. The Docker developers advocate running a single *logical service* inside a single container. But we are not disputing that. Baseimage-docker advocates running multiple *OS processes* inside a single container, and a single logical service can consist of multiple OS processes. -It follows from this that Baseimage-docker also does not deny the Docker philosophy. In fact, many of the modifications we introduce are explicitly in line with the Docker philosophy. For example, using environment variables to pass parameters to containers is very much the "Docker way", and provide [a mechanism to easily work with environment variables](#environment_variables) in the presence of multiple processes that may run as different users. +It follows that Baseimage-docker also does not deny the Docker philosophy. In fact, many of the modifications we introduce are explicitly in line with the Docker philosophy. For example, using environment variables to pass parameters to containers is very much the "Docker way", and providing [a mechanism to easily work with environment variables](#environment_variables) in the presence of multiple processes that may run as different users. ## Inspecting baseimage-docker @@ -215,7 +215,7 @@ If you use `/sbin/my_init` as the main container command, then any environment v #### Centrally defining your own environment variables -During startup, before running any [startup scripts](#running_startup_scripts), `my_init` imports environment variables from the directory `/etc/container_environment`. This directory contains files who are named after the environment variable names. The file contents contain the environment variable values. This directory is therefore a good place to centrally define your own environment variables, which will be inherited by all startup scripts and Runit services. +During startup, before running any [startup scripts](#running_startup_scripts), `my_init` imports environment variables from the directory `/etc/container_environment`. This directory contains files named after the environment variable names. The file contents contain the environment variable values. This directory is therefore a good place to centrally define your own environment variables, which will be inherited by all startup scripts and Runit services. For example, here's how you can define an environment variable from your Dockerfile: @@ -231,14 +231,14 @@ You can verify that it works, as follows: **Handling newlines** -If you've looked carefully, you'll notice that the 'echo' command actually prints a newline. Why does $MY_NAME not contain a newline then? It's because `my_init` strips the trailing newline, if any. If you intended on the value having a newline, you should add *another* newline, like this: +If you've looked carefully, you'll notice that the 'echo' command actually prints a newline. Why does $MY_NAME not contain a newline then? It's because `my_init` strips the trailing newline. If you intended on the value having a newline, you should add *another* newline, like this: RUN echo -e "Apachai Hopachai\n" > /etc/container_environment/MY_NAME #### Environment variable dumps -While the previously mentioned mechanism is good for centrally defining environment variables, it by itself does not prevent services (e.g. Nginx) from changing and resetting environment variables from child processes. However, the `my_init` mechanism does make it easy for you to query what the original environment variables are. +While the previously mentioned mechanism is good for centrally defining environment variables, itself does not prevent services (e.g. Nginx) from changing and resetting environment variables from child processes. However, the `my_init` mechanism does make it easy for you to query what the original environment variables are. During startup, right after importing environment variables from `/etc/container_environment`, `my_init` will dump all its environment variables (that is, all variables imported from `container_environment`, as well as all variables it picked up from `docker run --env`) to the following locations, in the following formats: @@ -246,7 +246,7 @@ During startup, right after importing environment variables from `/etc/container * `/etc/container_environment.sh` - a dump of the environment variables in Bash format. You can source the file directly from a Bash shell script. * `/etc/container_environment.json` - a dump of the environment variables in JSON format. -The multiple formats makes it easy for you to query the original environment variables no matter which language your scripts/apps are written in. +The multiple formats make it easy for you to query the original environment variables no matter which language your scripts/apps are written in. Here is an example shell session showing you how the dumps look like: @@ -279,7 +279,7 @@ But note that: #### Security -Because environment variables can potentially contain sensitive information, `/etc/container_environment` and its Bash and JSON dumps are by default owned by root, and accessible only by the `docker_env` group (so that any user added this group will have these variables automatically loaded). +Because environment variables can potentially contain sensitive information, `/etc/container_environment` and its Bash and JSON dumps are by default owned by root, and accessible only to the `docker_env` group (so that any user added this group will have these variables automatically loaded). If you are sure that your environment variables don't contain sensitive data, then you can also relax the permissions on that directory and those files by making them world-readable: @@ -291,7 +291,7 @@ If you are sure that your environment variables don't contain sensitive data, th Baseimage-docker images contain an Ubuntu 16.04 operating system. You may want to update this OS from time to time, for example to pull in the latest security updates. OpenSSL is a notorious example. Vulnerabilities are discovered in OpenSSL on a regular basis, so you should keep OpenSSL up-to-date as much as you can. -While we release Baseimage-docker images with the latest OS updates from time to time, you do not have to rely on us. You can update the OS inside Baseimage-docker images yourself, and it is recommend that you do this instead of waiting for us. +While we release Baseimage-docker images with the latest OS updates from time to time, you do not have to rely on us. You can update the OS inside Baseimage-docker images yourself, and it is recommended that you do this instead of waiting for us. To upgrade the OS in the image, run this in your Dockerfile: From f9838ccce0285428e9fa326533cee50226f475c2 Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 02:41:20 -0700 Subject: [PATCH 23/26] Revert "Preserve /build/{cleanup.sh,buildconfig} files." --- image/cleanup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/cleanup.sh b/image/cleanup.sh index 72ef0ce..d954a47 100755 --- a/image/cleanup.sh +++ b/image/cleanup.sh @@ -4,7 +4,7 @@ source /bd_build/buildconfig set -x apt-get clean -ls -d -1 /bd_build/**/* | grep -v "cleanup.sh" | grep -v "buildconfig" | xargs rm -f +rm -rf /bd_build rm -rf /tmp/* /var/tmp/* rm -rf /var/lib/apt/lists/* From 6216f70411fec4b50f6e91f37b46bde7a73e65bc Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 03:15:25 -0700 Subject: [PATCH 24/26] Revert "Merge branch 'i386' into next" This reverts commit 34408d8013f1ce0e2bb5edf36eb6b51fd604b352, reversing changes made to 5d80f284b01c6f1626540ecbd0be97019b17f9f7. --- image/Dockerfile | 3 +-- image/cleanup.sh | 1 - image/fix_libgc_bug.sh | 41 ----------------------------------------- image/fix_pam_bug.sh | 4 ++-- 4 files changed, 3 insertions(+), 46 deletions(-) delete mode 100755 image/fix_libgc_bug.sh diff --git a/image/Dockerfile b/image/Dockerfile index 03a8e46..0eea9b2 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -1,4 +1,4 @@ -FROM i386/ubuntu:16.04 +FROM ubuntu:16.04 MAINTAINER Phusion COPY . /bd_build @@ -6,7 +6,6 @@ COPY . /bd_build RUN /bd_build/prepare.sh && \ /bd_build/system_services.sh && \ /bd_build/utilities.sh && \ - /bd_build/fix_libgc_bug.sh && \ /bd_build/fix_pam_bug.sh && \ /bd_build/cleanup.sh diff --git a/image/cleanup.sh b/image/cleanup.sh index 4f59509..d954a47 100755 --- a/image/cleanup.sh +++ b/image/cleanup.sh @@ -4,7 +4,6 @@ source /bd_build/buildconfig set -x apt-get clean - rm -rf /bd_build rm -rf /tmp/* /var/tmp/* rm -rf /var/lib/apt/lists/* diff --git a/image/fix_libgc_bug.sh b/image/fix_libgc_bug.sh deleted file mode 100755 index 375c409..0000000 --- a/image/fix_libgc_bug.sh +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/bash -set -e -source /bd_build/buildconfig -set -x - -# Fixes https://github.com/docker/docker/issues/6345 -# The Github is closed, but some apps such as pbuilder still triggers it. - -export CONFIGURE_OPTS=--disable-audit -cd /tmp - -$minimal_apt_get_install gdebi-core -apt-get build-dep -y --no-install-recommends libgc -apt-get source -y libgc -echo "#define NO_GETCONTEXT" >> libgc-7.4.2/include/private/gcconfig.h -pushd libgc-7.4.2 -dpkg-buildpackage -b -popd -gdebi -n libgc1c2_7.4.2-7.3ubuntu0.1_i386.deb -rm -rf *.deb *.gz *.dsc *.changes libgc-* - -# Unfortunately there is no way to automatically remove build deps, so we do this manually. -apt-get remove -y gdebi-core autoconf automake autopoint autotools-dev binutils bsdmainutils \ - build-essential bzip2 cpp cpp-5 debhelper dh-autoreconf dh-strip-nondeterminism \ - diffstat dpkg-dev g++ g++-5 gcc gcc-5 gettext gettext-base groff-base hardening-includes \ - intltool-debian libapt-pkg-perl libarchive-zip-perl libasan2 libasprintf0v5 libatomic-ops-dev \ - libatomic1 libc-dev-bin libc6-dev libcc1-0 libcgi-pm-perl libcilkrts5 libclass-accessor-perl \ - libclone-perl libcroco3 libdata-alias-perl libdigest-hmac-perl libdpkg-perl libemail-valid-perl \ - libexporter-tiny-perl libfile-basedir-perl libfile-stripnondeterminism-perl libgcc-5-dev libgdbm3 \ - libgomp1 libhtml-parser-perl libhtml-tagset-perl libicu55 libio-pty-perl libio-socket-inet6-perl \ - libio-socket-ssl-perl libio-string-perl libipc-run-perl libipc-system-simple-perl libisl15 \ - libitm1 liblist-moreutils-perl liblocale-gettext-perl libmailtools-perl libmpc3 libmpfr4 libmpx0 \ - libnet-dns-perl libnet-domain-tld-perl libnet-ip-perl libnet-smtp-ssl-perl libnet-ssleay-perl \ - libparse-debianchangelog-perl libperl5.22 libpipeline1 libquadmath0 libsigsegv2 libsocket6-perl \ - libstdc++-5-dev libsub-name-perl libtext-levenshtein-perl libtimedate-perl libtool libubsan0 \ - libunistring0 liburi-perl libxml2 libyaml-libyaml-perl lintian linux-libc-dev m4 make man-db \ - netbase patch patchutils perl perl-modules-5.22 pkg-config pkg-kde-tools po-debconf t1utils \ - xz-utils - -apt-get remove -y gdebi-core -apt-get autoremove -y diff --git a/image/fix_pam_bug.sh b/image/fix_pam_bug.sh index e145ef6..ca4be4e 100755 --- a/image/fix_pam_bug.sh +++ b/image/fix_pam_bug.sh @@ -22,10 +22,10 @@ apt-get remove -y gdebi-core autoconf automake autopoint autotools-dev binutils groff-base intltool-debian libarchive-zip-perl libasan2 libasprintf0v5 libatomic1 \ libaudit-dev libc-dev-bin libc6-dev libcc1-0 libcilkrts5 libcrack2 libcrack2-dev libcroco3 \ libdb-dev libdb5.3-dev libdpkg-perl libfile-stripnondeterminism-perl libfl-dev libgc1c2 \ - libgcc-5-dev libgdbm3 libgomp1 libgpm2 libicu55 libisl15 libitm1 libmpc3 \ + libgcc-5-dev libgdbm3 libgomp1 libgpm2 libicu55 libisl15 libitm1 liblsan0 libmpc3 \ libmpfr4 libmpx0 libpcre16-3 libpcre3-dev libpcre32-3 libpcrecpp0v5 libperl5.22 \ libpipeline1 libquadmath0 libselinux1-dev libsepol1-dev libsigsegv2 libstdc++-5-dev \ - libtimedate-perl libtool libubsan0 libunistring0 libxml2 libxml2-utils \ + libtimedate-perl libtool libtsan0 libubsan0 libunistring0 libxml2 libxml2-utils \ libxslt1.1 linux-libc-dev m4 make man-db patch perl perl-modules-5.22 pkg-config \ po-debconf quilt sgml-base sgml-data w3m xml-core xsltproc xz-utils From f7bba93be3f9aa5465310cca5f2665b99d5f784e Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 03:37:00 -0700 Subject: [PATCH 25/26] Preserve /build/{cleanup.sh,buildconfig} files. See #188 --- image/cleanup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/cleanup.sh b/image/cleanup.sh index d954a47..1dd3ad0 100755 --- a/image/cleanup.sh +++ b/image/cleanup.sh @@ -4,7 +4,7 @@ source /bd_build/buildconfig set -x apt-get clean -rm -rf /bd_build +ls -d -1 /bd_build/**/* | grep -v "cleanup.sh" | grep -v "buildconfig" | grep -v "services/" | xargs rm -f rm -rf /tmp/* /var/tmp/* rm -rf /var/lib/apt/lists/* From 17a5cede8c8fb2a0d6ee98088ee557e2cb7b05db Mon Sep 17 00:00:00 2001 From: Travis Rowland Date: Tue, 21 Mar 2017 03:37:18 -0700 Subject: [PATCH 26/26] Incrementing version --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 65b6528..9ddfe1a 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ NAME = phusion/baseimage -VERSION = 0.9.19 +VERSION = 0.9.20 .PHONY: all build test tag_latest release ssh @@ -18,7 +18,7 @@ release: test tag_latest @if ! docker images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi @if ! head -n 1 Changelog.md | grep -q 'release date'; then echo 'Please note the release date in Changelog.md.' && false; fi docker push $(NAME) - @echo "*** Don't forget to create a tag. git tag rel-$(VERSION) && git push origin rel-$(VERSION)" + @echo "*** Don't forget to create a tag. git tag $(VERSION) && git push origin $(VERSION)" ssh: chmod 600 image/services/sshd/keys/insecure_key