search

georchestra / mapstore2-georchestra

geOrchestra newest viewer
Other
6 stars 23 forks source link

Run tomcat as non-root user #612

Open jeanpommier opened 1 year ago

jeanpommier commented 1 year ago

update based on PR https://github.com/georchestra/mapstore2-georchestra/pull/442

jeanpommier commented 1 year ago

@pierrejego I believe we can merge this PR.

We will need to document in the migration notes that the mapstore writable datadir needs to be writable by UID/GID 999 (for the docker version)

jeanpommier commented 9 months ago

Hi @edevosc2c . Can you explain why for ?

The idea is to run the georchestra official docker image, right ? Since this applies at build time, it means that to get different settings one would still have a build a custom image. I don't see the added value

pmauduit commented 9 months ago

Can you explain why for ?

it looks like because of https://github.com/georchestra/georchestra/issues/4071

edevosc2c commented 9 months ago

Hi @edevosc2c . Can you explain why for ?

The idea is to run the georchestra official docker image, right ? Since this applies at build time, it means that to get different settings one would still have a build a custom image. I don't see the added value

It's a standard thing in docker images to allow anyone to set UID and GID at build time. It doesn't hurt to add it.

On top of that, you have just one line/one place to change the UID and GID in case it's needed.

edevosc2c commented 8 months ago

Note: Once https://github.com/georchestra/mapstore2-georchestra/pull/671 will be merged, there will be a need here to add after RUN mkdir -p /docker-entrypoint.d this line:

RUN chown tomcat:tomcat /docker-entrypoint.d

Otherwise, the copy in this script won't work: https://github.com/georchestra/mapstore2-georchestra/pull/671/files#diff-1b0bf6d59703af25ba177c67baa3686a4aa1846098b91e7ff32375e0f4eb43eaR10