bitdeals
45eb85fae8
The loop lived in a shell-form ENTRYPOINT one-liner: unlintable, uncommentable,
and expanded by docker into two nested shells. It is a file now, and the loop
is CMD with the base image's `certbot` entrypoint reset — CMD is appended to
ENTRYPOINT rather than replacing it, so without the reset the loop would have
arrived as arguments to certbot. In exchange a one-off run replaces the loop
outright and needs no --entrypoint:
docker run --rm -v letsencrypt:/etc/letsencrypt <image> certbot certificates
`wait $(jobs -p)` became a bare `wait`: the command substitution runs in a
subshell that reports the parent's jobs in bash but not in dash, and bare
`wait` waits for every background job in either. A failed pass is now reported
rather than passing silently, and the trap covers INT as well so Ctrl-C in an
interactive run works.
What this does not fix: a signal arriving while certbot is talking to Let's
Encrypt is held until that call returns, because a POSIX shell runs a trap only
after the foreground command finishes. That can outlast docker's ten-second
stop grace. Set stop_grace_period on the service if a clean stop matters.
24 lines
738 B
Docker
24 lines
738 B
Docker
FROM certbot/certbot:latest
|
|
|
|
#SHELL ["/bin/ash", "-ex", "-c"]
|
|
|
|
# Install socat
|
|
RUN apk --no-cache add socat
|
|
|
|
# Copy scripts
|
|
COPY ./docker/scripts/ /opt/scripts/
|
|
RUN chmod 755 /opt/scripts/*.sh
|
|
|
|
# Expose port 380
|
|
EXPOSE 380
|
|
|
|
# The base image runs certbot itself (ENTRYPOINT ["certbot"]). Reset it, or the
|
|
# CMD below is appended as arguments to certbot instead of replacing it. Both
|
|
# directives are in exec form: a shell-form ENTRYPOINT makes docker drop CMD
|
|
# altogether, and a shell-form CMD would expand into a nested /bin/sh -c.
|
|
# Keeping the loop in CMD is what lets a one-off run replace it outright:
|
|
# docker run --rm -v letsencrypt:/etc/letsencrypt <image> certbot certificates
|
|
ENTRYPOINT []
|
|
CMD ["/opt/scripts/entrypoint.sh"]
|
|
|