Skip to content

New Redis versions 8.0.2, 7.4.4, 7.2.9 #19129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 30, 2025
Merged

New Redis versions 8.0.2, 7.4.4, 7.2.9 #19129

merged 1 commit into from
May 30, 2025

Conversation

adobrzhansky
Copy link
Contributor

Also documentation PR to reflect changes in the upcoming Redis image version 8.0.2 docker-library/docs#2579

@adobrzhansky adobrzhansky requested review from LaurentGoderre and a team as code owners May 29, 2025 16:09
@github-actions GitHub Actions
Copy link

Diff for d1c8a9c: 
diff --git a/_bashbrew-cat b/_bashbrew-cat
index c54c276..9c9ae61 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -11,34 +11,34 @@ Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, riscv64, s390x
 GitCommit: 27cd071c3e9d903a19c79577ddb82fb322ef5ed6
 Directory: 6.2/alpine
 
-Tags: 7.2.8, 7.2, 7.2.8-bookworm, 7.2-bookworm
+Tags: 7.2.9, 7.2, 7.2.9-bookworm, 7.2-bookworm
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
-GitCommit: 27cd071c3e9d903a19c79577ddb82fb322ef5ed6
+GitCommit: 7eaf5cd7042aee7a3f9049d91e48c647e2422de5
 Directory: 7.2/debian
 
-Tags: 7.2.8-alpine, 7.2-alpine, 7.2.8-alpine3.21, 7.2-alpine3.21
+Tags: 7.2.9-alpine, 7.2-alpine, 7.2.9-alpine3.21, 7.2-alpine3.21
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, riscv64, s390x
-GitCommit: 27cd071c3e9d903a19c79577ddb82fb322ef5ed6
+GitCommit: 7eaf5cd7042aee7a3f9049d91e48c647e2422de5
 Directory: 7.2/alpine
 
-Tags: 7.4.3, 7.4, 7, 7.4.3-bookworm, 7.4-bookworm, 7-bookworm
+Tags: 7.4.4, 7.4, 7, 7.4.4-bookworm, 7.4-bookworm, 7-bookworm
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
-GitCommit: 27cd071c3e9d903a19c79577ddb82fb322ef5ed6
+GitCommit: 7eaf5cd7042aee7a3f9049d91e48c647e2422de5
 Directory: 7.4/debian
 
-Tags: 7.4.3-alpine, 7.4-alpine, 7-alpine, 7.4.3-alpine3.21, 7.4-alpine3.21, 7-alpine3.21
+Tags: 7.4.4-alpine, 7.4-alpine, 7-alpine, 7.4.4-alpine3.21, 7.4-alpine3.21, 7-alpine3.21
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, riscv64, s390x
-GitCommit: 27cd071c3e9d903a19c79577ddb82fb322ef5ed6
+GitCommit: 7eaf5cd7042aee7a3f9049d91e48c647e2422de5
 Directory: 7.4/alpine
 
-Tags: 8.0.1, 8.0, 8, 8.0.1-bookworm, 8.0-bookworm, 8-bookworm, latest, bookworm
+Tags: 8.0.2, 8.0, 8, 8.0.2-bookworm, 8.0-bookworm, 8-bookworm, latest, bookworm
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
 GitFetch: refs/heads/release/8.0
-GitCommit: fe864e383ae7c5c891a694f9e0c16f8459a62234
+GitCommit: 5151eacdaf46f588f330c2e45fbed7fa0a7c192e
 Directory: debian
 
-Tags: 8.0.1-alpine, 8.0-alpine, 8-alpine, 8.0.1-alpine3.21, 8.0-alpine3.21, 8-alpine3.21, alpine, alpine3.21
+Tags: 8.0.2-alpine, 8.0-alpine, 8-alpine, 8.0.2-alpine3.21, 8.0-alpine3.21, 8-alpine3.21, alpine, alpine3.21
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, riscv64, s390x
 GitFetch: refs/heads/release/8.0
-GitCommit: fe864e383ae7c5c891a694f9e0c16f8459a62234
+GitCommit: 5151eacdaf46f588f330c2e45fbed7fa0a7c192e
 Directory: alpine
diff --git a/_bashbrew-list b/_bashbrew-list
index 9fea0ce..938c289 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -18,18 +18,18 @@ redis:7.2
 redis:7.2-alpine
 redis:7.2-alpine3.21
 redis:7.2-bookworm
-redis:7.2.8
-redis:7.2.8-alpine
-redis:7.2.8-alpine3.21
-redis:7.2.8-bookworm
+redis:7.2.9
+redis:7.2.9-alpine
+redis:7.2.9-alpine3.21
+redis:7.2.9-bookworm
 redis:7.4
 redis:7.4-alpine
 redis:7.4-alpine3.21
 redis:7.4-bookworm
-redis:7.4.3
-redis:7.4.3-alpine
-redis:7.4.3-alpine3.21
-redis:7.4.3-bookworm
+redis:7.4.4
+redis:7.4.4-alpine
+redis:7.4.4-alpine3.21
+redis:7.4.4-bookworm
 redis:8
 redis:8-alpine
 redis:8-alpine3.21
@@ -38,10 +38,10 @@ redis:8.0
 redis:8.0-alpine
 redis:8.0-alpine3.21
 redis:8.0-bookworm
-redis:8.0.1
-redis:8.0.1-alpine
-redis:8.0.1-alpine3.21
-redis:8.0.1-bookworm
+redis:8.0.2
+redis:8.0.2-alpine
+redis:8.0.2-alpine3.21
+redis:8.0.2-bookworm
 redis:alpine
 redis:alpine3.21
 redis:bookworm
diff --git a/redis_7-alpine3.21/Dockerfile b/redis_7-alpine3.21/Dockerfile
index 5d620e1..b5b0d0b 100644
--- a/redis_7-alpine3.21/Dockerfile
+++ b/redis_7-alpine3.21/Dockerfile
@@ -49,9 +49,9 @@ RUN set -eux; \
 	gosu --version; \
 	gosu nobody true
 
-ENV REDIS_VERSION 7.4.3
-ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.3.tar.gz
-ENV REDIS_DOWNLOAD_SHA e1807d7c0f824f4c5450244ef50c1e596b8d09b35d03a83f4e018fb7316acf45
+ENV REDIS_VERSION 7.4.4
+ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.4.tar.gz
+ENV REDIS_DOWNLOAD_SHA 985c465146453f4d79912e70b2dc516577a1667cbf9b0420a0c87878fcc6f32f
 
 RUN set -eux; \
 	\
diff --git a/redis_7-bookworm/Dockerfile b/redis_7-bookworm/Dockerfile
index 8cbac35..0141ba5 100644
--- a/redis_7-bookworm/Dockerfile
+++ b/redis_7-bookworm/Dockerfile
@@ -56,9 +56,9 @@ RUN set -eux; \
 	gosu --version; \
 	gosu nobody true
 
-ENV REDIS_VERSION 7.4.3
-ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.3.tar.gz
-ENV REDIS_DOWNLOAD_SHA e1807d7c0f824f4c5450244ef50c1e596b8d09b35d03a83f4e018fb7316acf45
+ENV REDIS_VERSION 7.4.4
+ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.4.4.tar.gz
+ENV REDIS_DOWNLOAD_SHA 985c465146453f4d79912e70b2dc516577a1667cbf9b0420a0c87878fcc6f32f
 
 RUN set -eux; \
 	\
diff --git a/redis_7.2-alpine3.21/Dockerfile b/redis_7.2-alpine3.21/Dockerfile
index ecc983c..7439886 100644
--- a/redis_7.2-alpine3.21/Dockerfile
+++ b/redis_7.2-alpine3.21/Dockerfile
@@ -49,9 +49,9 @@ RUN set -eux; \
 	gosu --version; \
 	gosu nobody true
 
-ENV REDIS_VERSION 7.2.8
-ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.8.tar.gz
-ENV REDIS_DOWNLOAD_SHA 6be4fdfcdb2e5ac91454438246d00842d2671f792673390e742dfcaf1bf01574
+ENV REDIS_VERSION 7.2.9
+ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.9.tar.gz
+ENV REDIS_DOWNLOAD_SHA 2343cc49db3beb9d2925a44e13032805a608821a58f25bd874c84881115a20b7
 
 RUN set -eux; \
 	\
diff --git a/redis_7.2-bookworm/Dockerfile b/redis_7.2-bookworm/Dockerfile
index e5d24b1..cb9ebc2 100644
--- a/redis_7.2-bookworm/Dockerfile
+++ b/redis_7.2-bookworm/Dockerfile
@@ -56,9 +56,9 @@ RUN set -eux; \
 	gosu --version; \
 	gosu nobody true
 
-ENV REDIS_VERSION 7.2.8
-ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.8.tar.gz
-ENV REDIS_DOWNLOAD_SHA 6be4fdfcdb2e5ac91454438246d00842d2671f792673390e742dfcaf1bf01574
+ENV REDIS_VERSION 7.2.9
+ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-7.2.9.tar.gz
+ENV REDIS_DOWNLOAD_SHA 2343cc49db3beb9d2925a44e13032805a608821a58f25bd874c84881115a20b7
 
 RUN set -eux; \
 	\
diff --git a/redis_alpine3.21/Dockerfile b/redis_alpine3.21/Dockerfile
index d6d1315..92649b7 100644
--- a/redis_alpine3.21/Dockerfile
+++ b/redis_alpine3.21/Dockerfile
@@ -14,8 +14,8 @@ RUN set -eux; \
 # we need setpriv package as busybox provides very limited functionality
 		setpriv \
 	;
-ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.1.tar.gz
-ENV REDIS_DOWNLOAD_SHA=5e347d3532ff15bb888a78d851e87cf5cc1956edd32b5d4a0cac3220da0a5a0b
+ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.2.tar.gz
+ENV REDIS_DOWNLOAD_SHA=caf3c0069f06fc84c5153bd2a348b204c578de80490c73857bee01d9b5d7401f
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
diff --git a/redis_alpine3.21/docker-entrypoint.sh b/redis_alpine3.21/docker-entrypoint.sh
index ab5befb..476913d 100755
--- a/redis_alpine3.21/docker-entrypoint.sh
+++ b/redis_alpine3.21/docker-entrypoint.sh
@@ -1,8 +1,93 @@
 #!/bin/sh
 set -e
 
+SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups"
+IS_REDIS_SENTINEL=""
+IS_REDIS_SERVER=""
+CONFIG=""
+
+SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes."
+
+# functions
 has_cap() {
-	/usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'$1'\b'
+	/usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b'
+}
+
+check_for_sentinel() {
+	CMD="$1"
+	shift
+	if [ "$CMD" = '/usr/local/bin/redis-server' ]; then
+		for arg in "$@"; do
+			if [ "$arg" = "--sentinel" ]; then
+				return 0
+			fi
+		done
+	fi
+
+	if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then
+		return 0
+	fi
+
+	return 1
+}
+
+# Note: Change permissions only in simple, default cases to avoid affecting
+# unexpected or user-specific files.
+
+fix_data_dir_perms() {
+	# Expecting only *.rdb files and default appendonlydir; skip if others are found.
+	unknown_file="$(find . -mindepth 1 -maxdepth 1 \
+		-not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \
+		-print -quit)"
+	if [ -z "$unknown_file" ]; then
+		find . -print0 | fix_perms_and_owner rw
+	else
+		echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
+	fi
+}
+
+fix_config_perms() {
+	config="$1"
+	mode="$2"
+
+	if [ ! -f "$config" ]; then
+		return 0
+	fi
+
+	confdir="$(dirname "$config")"
+	if [ ! -d "$confdir" ]; then
+		return 0
+	fi
+
+	# Expecting only the config file; skip if others are found.
+	pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g')
+	unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit)
+
+	if [ -z "$unknown_file" ]; then
+		printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode"
+	else
+		echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
+
+	fi
+}
+
+fix_perms_and_owner() {
+	mode="$1"
+
+	# shellcheck disable=SC3045
+	while IFS= read -r -d '' file; do
+		if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then
+			continue
+		elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then
+			continue
+		fi
+		new_mode=$mode
+		if [ -d "$file" ]; then
+			new_mode=${mode}x
+		fi
+		err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
+		err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
+	done
 }
 
 # first arg is `-f` or `--some-option`
@@ -10,23 +95,43 @@ has_cap() {
 if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then
 	set -- redis-server "$@"
 fi
+CMD=$(command -v "$1" 2>/dev/null || :)
 
-CMD=$(realpath $(command -v "$1") 2>/dev/null || :)
-# drop privileges only if our uid is 0 (container started without explicit --user)
+if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then
+	IS_REDIS_SERVER=1
+fi
+
+if check_for_sentinel "$CMD" "$@"; then
+	IS_REDIS_SENTINEL=1
+fi
+
+# if is server and its first arg is not an option then it's a config
+if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then
+	CONFIG="$2"
+fi
+
+# drop privileges only if
+# we are starting either server or sentinel
+# our uid is 0 (container started without explicit --user)
 # and we have capabilities required to drop privs
-if has_cap setuid && has_cap setgid && \
-	[ \( "$CMD" = '/usr/local/bin/redis-server' -o "$CMD" = '/usr/local/bin/redis-sentinel' \) -a "$(id -u)" = '0' ]; then
-	find . \! -user redis -exec chown redis '{}' +
+if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then
+	if [ -z "$SKIP_FIX_PERMS" ]; then
+		# fix permissions
+		if [ "$IS_REDIS_SENTINEL" ]; then
+			fix_config_perms "$CONFIG" rw
+		else
+			fix_data_dir_perms
+			fix_config_perms "$CONFIG" r
+		fi
+	fi
+
 	CAPS_TO_KEEP=""
 	if has_cap sys_resource; then
 		# we have sys_resource capability, keep it available for redis
 		# as redis may use it to increase open files limit
 		CAPS_TO_KEEP=",+sys_resource"
 	fi
-	exec /usr/bin/setpriv \
-		--reuid redis \
-		--regid redis \
-		--clear-groups \
+	exec $SETPRIV \
 		--nnp \
 		--inh-caps=-all$CAPS_TO_KEEP \
 		--ambient-caps=-all$CAPS_TO_KEEP \
@@ -42,7 +147,7 @@ if [ "$um" = '0022' ]; then
 	umask 0077
 fi
 
-if [ "$1" = 'redis-server' ]; then
+if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then
 	echo "Starting Redis Server"
 	modules_dir="/usr/local/lib/redis/modules/"
 	
diff --git a/redis_bookworm/Dockerfile b/redis_bookworm/Dockerfile
index fc46b64..1c081b9 100644
--- a/redis_bookworm/Dockerfile
+++ b/redis_bookworm/Dockerfile
@@ -14,8 +14,8 @@ RUN set -eux; \
 	; \
 	rm -rf /var/lib/apt/lists/*
 
-ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.1.tar.gz
-ENV REDIS_DOWNLOAD_SHA=5e347d3532ff15bb888a78d851e87cf5cc1956edd32b5d4a0cac3220da0a5a0b
+ENV REDIS_DOWNLOAD_URL=https://github.com/redis/redis/archive/refs/tags/8.0.2.tar.gz
+ENV REDIS_DOWNLOAD_SHA=caf3c0069f06fc84c5153bd2a348b204c578de80490c73857bee01d9b5d7401f
 RUN set -eux; \
 	\
 	savedAptMark="$(apt-mark showmanual)"; \
diff --git a/redis_bookworm/docker-entrypoint.sh b/redis_bookworm/docker-entrypoint.sh
index ab5befb..d0a21fe 100755
--- a/redis_bookworm/docker-entrypoint.sh
+++ b/redis_bookworm/docker-entrypoint.sh
@@ -1,8 +1,93 @@
-#!/bin/sh
+#!/bin/bash
 set -e
 
+SETPRIV="/usr/bin/setpriv --reuid redis --regid redis --clear-groups"
+IS_REDIS_SENTINEL=""
+IS_REDIS_SERVER=""
+CONFIG=""
+
+SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes."
+
+# functions
 has_cap() {
-	/usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'$1'\b'
+	/usr/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b'
+}
+
+check_for_sentinel() {
+	CMD="$1"
+	shift
+	if [ "$CMD" = '/usr/local/bin/redis-server' ]; then
+		for arg in "$@"; do
+			if [ "$arg" = "--sentinel" ]; then
+				return 0
+			fi
+		done
+	fi
+
+	if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then
+		return 0
+	fi
+
+	return 1
+}
+
+# Note: Change permissions only in simple, default cases to avoid affecting
+# unexpected or user-specific files.
+
+fix_data_dir_perms() {
+	# Expecting only *.rdb files and default appendonlydir; skip if others are found.
+	unknown_file="$(find . -mindepth 1 -maxdepth 1 \
+		-not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \
+		-print -quit)"
+	if [ -z "$unknown_file" ]; then
+		find . -print0 | fix_perms_and_owner rw
+	else
+		echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
+	fi
+}
+
+fix_config_perms() {
+	config="$1"
+	mode="$2"
+
+	if [ ! -f "$config" ]; then
+		return 0
+	fi
+
+	confdir="$(dirname "$config")"
+	if [ ! -d "$confdir" ]; then
+		return 0
+	fi
+
+	# Expecting only the config file; skip if others are found.
+	pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g')
+	unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit)
+
+	if [ -z "$unknown_file" ]; then
+		printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode"
+	else
+		echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
+
+	fi
+}
+
+fix_perms_and_owner() {
+	mode="$1"
+
+	# shellcheck disable=SC3045
+	while IFS= read -r -d '' file; do
+		if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then
+			continue
+		elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then
+			continue
+		fi
+		new_mode=$mode
+		if [ -d "$file" ]; then
+			new_mode=${mode}x
+		fi
+		err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
+		err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
+	done
 }
 
 # first arg is `-f` or `--some-option`
@@ -10,23 +95,43 @@ has_cap() {
 if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then
 	set -- redis-server "$@"
 fi
+CMD=$(command -v "$1" 2>/dev/null || :)
 
-CMD=$(realpath $(command -v "$1") 2>/dev/null || :)
-# drop privileges only if our uid is 0 (container started without explicit --user)
+if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then
+	IS_REDIS_SERVER=1
+fi
+
+if check_for_sentinel "$CMD" "$@"; then
+	IS_REDIS_SENTINEL=1
+fi
+
+# if is server and its first arg is not an option then it's a config
+if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then
+	CONFIG="$2"
+fi
+
+# drop privileges only if
+# we are starting either server or sentinel
+# our uid is 0 (container started without explicit --user)
 # and we have capabilities required to drop privs
-if has_cap setuid && has_cap setgid && \
-	[ \( "$CMD" = '/usr/local/bin/redis-server' -o "$CMD" = '/usr/local/bin/redis-sentinel' \) -a "$(id -u)" = '0' ]; then
-	find . \! -user redis -exec chown redis '{}' +
+if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then
+	if [ -z "$SKIP_FIX_PERMS" ]; then
+		# fix permissions
+		if [ "$IS_REDIS_SENTINEL" ]; then
+			fix_config_perms "$CONFIG" rw
+		else
+			fix_data_dir_perms
+			fix_config_perms "$CONFIG" r
+		fi
+	fi
+
 	CAPS_TO_KEEP=""
 	if has_cap sys_resource; then
 		# we have sys_resource capability, keep it available for redis
 		# as redis may use it to increase open files limit
 		CAPS_TO_KEEP=",+sys_resource"
 	fi
-	exec /usr/bin/setpriv \
-		--reuid redis \
-		--regid redis \
-		--clear-groups \
+	exec $SETPRIV \
 		--nnp \
 		--inh-caps=-all$CAPS_TO_KEEP \
 		--ambient-caps=-all$CAPS_TO_KEEP \
@@ -42,7 +147,7 @@ if [ "$um" = '0022' ]; then
 	umask 0077
 fi
 
-if [ "$1" = 'redis-server' ]; then
+if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then
 	echo "Starting Redis Server"
 	modules_dir="/usr/local/lib/redis/modules/"

Relevant Maintainers:

@adobrzhansky adobrzhansky mentioned this pull request May 29, 2025
Merged
yosifkit
yosifkit approved these changes May 30, 2025
View reviewed changes
Copy link
Member

@yosifkit yosifkit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's quite a lot of additions to the 8.0 entrypoint scripts. It seems ok to me. 🤷

@yosifkit yosifkit merged commit 52affa1 into docker-library:master May 30, 2025
13 checks passed
This was referenced Jun 2, 2025
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yosifkit yosifkit

@LaurentGoderre LaurentGoderre

Assignees
No one assigned
Labels
library/redis
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@adobrzhansky @yosifkit