bitdeals
68eb019e59
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 2m21s
The chown at startup was the only thing that ever needed root here, and it served a case this project does not have: keys.dat arriving from a bind mount owned by somebody else. Every deployment uses a named volume, which takes its ownership from the image. So the chown goes, and everything that existed to survive it goes with it. USER bitmessage in the Dockerfile, from PID 1 onwards. drop_privs.py is deleted, the supervisor no longer re-executes itself with a trimmed bounding set, run.sh has no privileged prologue and no wrapper around the eight commands that used to run through one. What is left of run.sh differs from the version before any of this by eleven lines: two chowns gone, seven `gosu bitmessage` prefixes gone, one comment reworded. keys.dat gets its mode 600 at build time instead of on every start, because on every start there is now no root to set it. Its mode and ownership reach a fresh volume from the image, and every volume in service already carries them -- checked on all four live nodes: nothing under /home/bitmessage is owned by anyone but 2000. The setuid strip stays. It is two lines and it closes the one way a taken-over daemon could still have climbed. What the caller sets changes too, and in the right direction: `cap_drop: ALL` with nothing added back, where the previous commit needed seven capabilities handed in. Confinement that used to be split between the image and the caller now sits in one place. The image gives up defending itself when run with no options at all, which is the trade named in the README along with the bind mount it costs.
44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
services:
|
|
bitmessage:
|
|
build:
|
|
context: ./docker
|
|
dockerfile: Dockerfile
|
|
image: registry.bitdeals.org/bitmessage
|
|
environment:
|
|
- BITMESSAGE_API_USER=bitmessage_api_user
|
|
- BITMESSAGE_API_PASSWORD=bitmessage_api_password
|
|
- BITMESSAGE_SEED_PHRASE=
|
|
- BITMESSAGE_SEED_ADDRESSES=1
|
|
- BITMESSAGE_TTL=172800
|
|
- BITMESSAGE_STOPRESENDINGAFTERXDAYS=60
|
|
- BITMESSAGE_MAXTOTALCONNECTIONS=40
|
|
ports:
|
|
# The API controls the daemon completely and has no TLS, so it never
|
|
# leaves loopback -- the README has said so all along, this file did not.
|
|
- 127.0.0.1:8442:8442
|
|
# P2P. Only 8444:8444 works — the daemon announces its own configured
|
|
# port to peers, not the one you mapped it to. Drop this line to run
|
|
# outbound-only.
|
|
- 8444:8444
|
|
volumes:
|
|
- bitmessage:/home/bitmessage
|
|
# A clean shutdown does not fit in Docker's default ten seconds; the last
|
|
# notes in the README explain this line and the five below it. The image
|
|
# runs as its own unprivileged user and needs no capability at all, so the
|
|
# drop is unconditional -- but what the root filesystem and the process
|
|
# count allow is the caller's to set, and nobody else's.
|
|
stop_grace_period: 90s
|
|
cap_drop: [ALL]
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,nodev,size=64m
|
|
- /run:rw,noexec,nosuid,nodev,size=8m
|
|
pids_limit: 200
|
|
mem_limit: 1g
|
|
cpus: 2
|
|
volumes:
|
|
bitmessage:
|
|
|