safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 05:07:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

GUACAMOLE-890: Security: Allow image to run as non-root user

Browse Source
This commit is contained in:
benrubson
2021-02-21 09:27:29 +01:00
parent 8e77864e63
commit c25df90555
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Dockerfile
View File

@@ -56,6 +56,15 @@ WORKDIR /opt/guacamole
# Copy artifacts from builder image into this image
COPY --from=builder /opt/guacamole/ .
# Create a new user guacamole
ARG UID=1001
ARG GID=1001
RUN groupadd --gid $GID guacamole
RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $GID guacamole
# Run with user guacamole
USER guacamole
# Start Guacamole under Tomcat, listening on 0.0.0.0:8080
EXPOSE 8080
CMD ["/opt/guacamole/bin/start.sh" ]

10
guacamole-docker/bin/start.sh
View File

@@ -659,9 +659,15 @@ associate_header() {
##
start_guacamole() {
# User-only writable CATALINA_BASE
export CATALINA_BASE=$HOME/tomcat
for dir in logs temp webapps work; do
mkdir -p $CATALINA_BASE/$dir
done
cp -R /usr/local/tomcat/conf $CATALINA_BASE
# Install webapp
rm -Rf /usr/local/tomcat/webapps/${WEBAPP_CONTEXT:-guacamole}
ln -sf /opt/guacamole/guacamole.war /usr/local/tomcat/webapps/${WEBAPP_CONTEXT:-guacamole}.war
ln -sf /opt/guacamole/guacamole.war $CATALINA_BASE/webapps/${WEBAPP_CONTEXT:-guacamole}.war
# Start tomcat
cd /usr/local/tomcat