Skip to content

Run container image as non-root user by default. #288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
r-xyz wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Run container image as non-root user by default. #288

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
145b9c7
Run container image as non-root user by default.
r-xyz Apr 15, 2025
4e06783
Simplified docker non-root startup script.
r-xyz Apr 19, 2025
f5a3b4f
Fix group change in docker non-root startup script.
r-xyz Apr 19, 2025
8e729a7
Docker non-root: only redefine primary group if not root.
r-xyz Apr 19, 2025
56b1813
Docker non-root: further simplified logic, following LinuxServer exam…
r-xyz Apr 19, 2025
be64c08
Docker non-root: fixed SIGKILL forwarding to child processes.
r-xyz Apr 19, 2025
9e8964a
Splash Pad: Fix signaling to child processes.
r-xyz Apr 19, 2025
addea4b
Splash Pad: run as non-root by default.
r-xyz Apr 19, 2025
9f16b1d
Rootless Docker: removed unnecessary permission change for gunicorn.
r-xyz May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,7 @@ EXPOSE 8000/tcp

COPY start_NEMO_in_Docker.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/start_NEMO_in_Docker.sh
# Add non-root user
RUN addgroup --system --gid 963 nemo && \
adduser --system --home /home/nemo --shell /usr/bin/bash --gid 963 --uid 963 --comment "NEMO user" nemo
Comment on lines +33 to +34
Copy link
Copy Markdown
Contributor

@rptmat57 rptmat57 Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a reason why we cannot define the PGID and PUID here as ENV and then use them with adduser and addgroup?

CMD ["start_NEMO_in_Docker.sh"]
21 changes: 20 additions & 1 deletion Dockerfile.splash_pad
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,5 +41,24 @@ WORKDIR /nemo
ENV REMOTE_USER="captain"
EXPOSE 8000/tcp

# Non-root user
RUN addgroup --system --gid 963 nemo && \
adduser --system --home /home/nemo --shell /usr/bin/bash --gid 963 --uid 963 --comment "NEMO user" nemo
RUN chown -R nemo:nemo /nemo
RUN chown -R nemo:nemo /var/run/
ENV PGID=963
ENV PUID=963

COPY --chmod=755 <<EOT /splash.sh
#!/bin/bash
set -e
# We have to start systemd jobs manually here unfortunately
CMD (cd /nemo/systemd && ls *.timer) | sed -e 's/\.timer$//' | xargs -t -I % systemctl start % ; exec django-admin runserver 0.0.0.0:8000
(cd /nemo/systemd && ls *.timer) | sed -e 's/\.timer$//' | xargs -t -I % systemctl start %
# Setting User and Group id
groupmod -o -g "$PGID" nemo
usermod -o -u "$PUID" -g "$PGID" nemo
# Starting NEMO
echo "Running NEMO as user '$(id nemo)'"
exec su nemo -c "django-admin runserver 0.0.0.0:8000"
EOT
CMD ["/splash.sh"]
19 changes: 15 additions & 4 deletions start_NEMO_in_Docker.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
#!/bin/bash

# Exit if any of following commands fails
set -e

Expand All @@ -10,11 +9,23 @@ else
echo "No additional Python packages to install."
fi

# Set the PUID and PGID environment variables
PUID=${PUID:-963}
PGID=${PGID:-963}
# Change the user and group IDs
groupmod -o -g "$PGID" nemo
usermod -o -u "$PUID" -g "$PGID" nemo
if [ -n "$PUID" ]; then
# Change the ownership of the application directory
chown -R nemo:nemo /nemo
fi
echo "Running NEMO as user '$(id nemo)'"

# Collect static files
django-admin collectstatic --no-input --clear
su nemo -c "django-admin collectstatic --no-input --clear"

# Run migrations to create or update the database
django-admin migrate
su nemo -c "django-admin migrate"

# Run NEMO
exec gunicorn --config=/etc/gunicorn_configuration.py NEMO.wsgi:application
exec su nemo -c "gunicorn --config=/etc/gunicorn_configuration.py NEMO.wsgi:application"