Optimize dockerfile, and improve nexus starting steps

[wjeanneau]

Hi,

Please consider the following improvements:

• Make user/group/uid/gid configurable with docker --build-arg
• Set uid/gid
• Use tini cmd instead of su-exec to run nexus
• Implement USER instruction to run nexus as non-root at the dockerfile level
• Remove run service script

For your information, I use this docker image with the sonotype-nexus helm package in my k8s cluster (https://github.com/helm/charts/tree/master/stable/sonatype-nexus). I had to do that in order to be sure the uid/gid will never change and remove the change owner instruction in the run service script. Using that image, I can restart nexus under two minutes, and I minimize the interruption of service during the upgrade path.

[pires]

What is the added value of making uid/gid configurable during build time?

Also, this breaks the restore functionality by making it impossible to stop Nexus without killing the container (as required by this step).

[wjeanneau]

No added value, I just like the fact to have this option. It could be interesting if we already have a Nexus structure from a VM setup with a different owner (but I agree we can easily update it)

If you're speaking about that (https://help.sonatype.com/repomanager3/backup-and-restore/restore-exported-databases), I wasn't aware of that mechanism! However, I'm not sure if it's a good practice to do that in a Kubernetes setup. Correct me if i'm wrong, but if you kill the nexus process, the livenessprobe and the readinessprobe will failed, and the pod will be automatically restarted (during the restore process). Are you using this image in Kubernetes or a docker farm ?

[pires]

This image is being used in Kubernetes. Hope this helps guiding you :)