Skip to content

Dockerfile: changing to non-privileged port #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 16, 2016
Merged

Dockerfile: changing to non-privileged port #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM ubuntu:16.04
FROM ubuntu:14.04
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rolling back, wasn't helpful downstream

MAINTAINER Bryan Latten <latten@adobe.com>

# Use in multi-phase builds, when an init process requests for the container to gracefully exit, so that it may be committed
Expand Down Expand Up @@ -48,7 +48,8 @@ COPY ./container/root /
RUN tar xzf /tmp/s6-overlay-amd64.tar.gz -C / && \
rm /tmp/s6-overlay-amd64.tar.gz

EXPOSE 80
# Using a non-privileged port to prevent having to use setcap internally
EXPOSE 8080
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to modify this in Flight Director to make sure it matches this new port? across whichever apps are running from this parent container?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes - when we roll it out. I will make this a major change (5.0)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent. Just checking.


# NOTE: intentionally NOT using s6 init as the entrypoint
# This would prevent container debugging if any of those service crash
Expand Down
2 changes: 1 addition & 1 deletion container/root/etc/nginx/sites-available/default
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
server {
listen 80;
listen 8080;

# Doesn't broadcast version level of server software
server_tokens off;
Expand Down
3 changes: 0 additions & 3 deletions container/root/run.d/99-nginx.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,6 @@ if [ $CONTAINER_ROLE == 'web' ]
then
echo '[run] enabling web server'

# Unfortunately, until Dockerhub supports this operation...it has to be done here
setcap cap_net_bind_service=+ep /usr/sbin/nginx

# Enable nginx as a supervised service
if [ -d /etc/services.d/nginx ]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dockerhub couldn't run this command, neither can docker 1.11 by default

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this just an option that needs to run via root ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its something that allows you to run on privileged port without root on nginx

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it, cool

then
Expand Down