Allow configuring effective user for subprocesses

appunite · Oct 8, 2018 · c6c2e92 · c6c2e92
1 parent 5116915
commit c6c2e92
Show file tree

Hide file tree

Showing 5 changed files with 46 additions and 48 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -1,18 +1,12 @@
 # Elixir CircleCI 2.0 configuration file
 #
 # Check https://circleci.com/docs/2.0/language-elixir/ for more details
-version: 2
-jobs:
-  test:
-    docker:
-      # specify the version here
-      - image: appunite/elixir-ci:1.7.1
+version: 2.1
 
-    working_directory: ~/repo
+commands:
+  fetch_deps:
+    description: "Fetch deps, build, and cache them"
     steps:
-      - run: apt-get update && apt-get install -y --no-install-recommends imagemagick ghostscript
-      - checkout
-
       - restore_cache:
           keys:
             - deps-v1-{{ .Branch }}-{{ .Revision }}
@@ -25,8 +19,23 @@ jobs:
             - "deps"
             - "_build"
 
+jobs:
+  test:
+    docker:
+      # specify the version here
+      - image: appunite/elixir-ci:1.7.1
+
+    working_directory: /var/repo
+    steps:
+      - run: apt-get update && apt-get install -y --no-install-recommends sudo imagemagick ghostscript
+      - checkout
+      - fetch_deps
+
       - run: mkdir -p reports/exunit
-      - run: mix coveralls.circle
+      - run:
+          command: mix coveralls.circle
+          environment:
+            IMAGER_USER: nobody
       - store_test_results:
           path: reports
   dialyzer:
@@ -35,18 +44,7 @@ jobs:
     working_directory: ~/repo
     steps:
       - checkout
-
-      - restore_cache:
-          keys:
-            - deps-v1-{{ .Branch }}-{{ .Revision }}
-            - deps-v1-{{ .Branch }}-
-            - deps-v1-
-      - run: mix do deps.get, deps.compile
-      - save_cache:
-          key: deps-v1-{{ .Branch }}-{{ .Revision }}
-          paths:
-            - "deps"
-            - "_build"
+      - fetch_deps
 
       - restore_cache:
           keys:
@@ -66,20 +64,9 @@ jobs:
     working_directory: ~/repo
     steps:
       - checkout
-
-      - restore_cache:
-          keys:
-            - deps-v1-{{ .Branch }}-{{ .Revision }}
-            - deps-v1-{{ .Branch }}-
-            - deps-v1-
-      - run: mix do deps.get, deps.compile
-      - save_cache:
-          key: deps-v1-{{ .Branch }}-{{ .Revision }}
-          paths:
-            - "deps"
-            - "_build"
-
+      - fetch_deps
       - run: mix format --check-formatted
+
 workflows:
   version: 2
   testing:

diff --git a/Dockerfile b/Dockerfile
@@ -1,22 +1,19 @@
-FROM alpine:latest AS goon
-RUN wget -O goon.tar.gz https://github.com/alco/goon/releases/download/v1.1.1/goon_linux_amd64.tar.gz \
-    && gzip -d goon.tar.gz \
-    && tar xf goon.tar
-
 FROM ubuntu:latest AS source
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    libssl1.1 imagemagick ghostscript \
+    libssl1.1 imagemagick ghostscript libcap \
     && rm -rf /var/lib/apt/lists/*
-COPY --from=goon /goon /usr/bin/goon
 ENV LANG C.UTF-8
 ENV PORT 80
 
 FROM appunite/elixir-ci:1.7.1 AS build
 ENV MIX_ENV prod
+ENV OPTIMIZE true
 COPY . /app
 WORKDIR /app
+RUN apt-get install libcap-dev
 RUN mix local.hex --force && mix local.rebar --force
-RUN mix deps.get && mix compile && mix release --env=prod
+RUN mix deps.get
+RUN mix compile && mix release --env=prod
 
 FROM source
 MAINTAINER Łukasz Jan Niemier <lukasz.niemier@appunite.com>

diff --git a/config/test.exs b/config/test.exs
@@ -6,6 +6,8 @@ config :imager, ImagerWeb.Endpoint,
   server: false,
   instrumenters: []
 
+config :imager, :user, System.get_env("IMAGER_USER")
+
 config :imager, :port, 4001
 
 config :logger, :console, format: "[$level] $message\n"

diff --git a/lib/imager/application.ex b/lib/imager/application.ex
@@ -5,8 +5,9 @@ defmodule Imager.Application do
 
   def start(_type, _args) do
     children = [
-      ImagerWeb.Endpoint,
-      {DynamicSupervisor, name: Imager.Workers, strategy: :one_for_one}
+      exec_app(),
+      {DynamicSupervisor, name: Imager.Workers, strategy: :one_for_one},
+      ImagerWeb.Endpoint
     ]
 
     Application.put_env(
@@ -27,4 +28,15 @@ defmodule Imager.Application do
 
     :ok
   end
+
+  defp exec_app do
+    opts =
+      with {:ok, name} when not is_nil(name) <- Application.fetch_env(:imager, :user) do
+        [user: String.to_charlist(name)]
+      else
+        _ -> []
+      end
+
+    %{id: :exec_app, start: {:exec, :start_link, [opts]}}
+  end
 end
diff --git a/mix.exs b/mix.exs
@@ -36,7 +36,7 @@ defmodule Imager.Mixfile do
     [
       mod: {Imager.Application, []},
       extra_applications: [:logger, :inets, :runtime_tools],
-      included_applications: [:vmstats]
+      included_applications: [:vmstats, :erlexec]
     ]
   end
 
@@ -62,7 +62,7 @@ defmodule Imager.Mixfile do
       {:vmstats, "~> 2.2", runtime: false},
       {:sentry, "~> 7.0"},
       {:porcelain, "~> 2.0.3"},
-      {:erlexec, "~> 1.9"},
+      {:erlexec, "~> 1.9", runtime: false},
       {:jose, "~> 1.8"},
       {:toml, "~> 0.3"},
       {:mockery, "~> 2.2.0"},