incorporate #3651

Dockerfile

@@ -1,55 +1,56 @@
-# docker build . -t ckan && docker run -d -p 80:5000 --link db:db --link redis:redis --link solr:solr ckan
+# docker build . -t ckan --build-arg CKAN_SITE_URL=http://localhost:5000
+# docker run -d -p 80:5000 --link db:db --link redis:redis --link solr:solr ckan
 
 FROM debian:jessie
 MAINTAINER Open Knowledge
 
 # Install required packages
-RUN apt-get -q -y update && apt-get -q -y upgrade && DEBIAN_FRONTEND=noninteractive apt-get -q -y install \
+RUN apt-get -q -y update && apt-get -q -y upgrade && \
+        DEBIAN_FRONTEND=noninteractive apt-get -q -y install \
 		python-dev \
         python-pip \
         python-virtualenv \
         libpq-dev \
         git-core \
+        postgresql-client \
 	&& apt-get -q clean
 
 # Define environment variables
 ENV CKAN_HOME /usr/lib/ckan/default
+ENV CKAN_VENV $CKAN_HOME/default
 ENV CKAN_CONFIG /etc/ckan/default
 ENV CKAN_STORAGE_PATH /var/lib/ckan
 
 # Build-time variables specified by docker-compose.yml / .env or
-# docker build . -t chan --build-arg CKAN_SITE_URL=http://localhost:5000
+# docker build . -t ckan --build-arg CKAN_SITE_URL=http://localhost:5000
 ARG CKAN_SITE_URL
 
-# SetUp Virtual Environment CKAN
-RUN mkdir -p $CKAN_HOME $CKAN_CONFIG $CKAN_STORAGE_PATH
-RUN virtualenv $CKAN_HOME
-RUN ln -s $CKAN_HOME/bin/pip /usr/local/bin/ckan-pip
-RUN ln -s $CKAN_HOME/bin/paster /usr/local/bin/ckan-paster
-
-# SetUp Requirements
-ADD ./requirements.txt $CKAN_HOME/src/ckan/requirements.txt
-RUN ckan-pip install --upgrade -r $CKAN_HOME/src/ckan/requirements.txt
+# add ckan user which runs all the ckan related stuff
+RUN useradd -r -u 900 -m -c "ckan account" -d $CKAN_HOME -s /bin/false ckan
 
-# TMP-BUGFIX https://github.com/ckan/ckan/issues/3388
-ADD ./dev-requirements.txt $CKAN_HOME/src/ckan/dev-requirements.txt
-RUN ckan-pip install --upgrade -r $CKAN_HOME/src/ckan/dev-requirements.txt
-
-# TMP-BUGFIX https://github.com/ckan/ckan/issues/3594
-RUN ckan-pip install --upgrade urllib3
+# SetUp Virtual Environment CKAN
+RUN mkdir -p $CKAN_VENV $CKAN_CONFIG $CKAN_STORAGE_PATH && \
+    virtualenv $CKAN_VENV && \
+    ln -s $CKAN_VENV/bin/pip /usr/local/bin/ckan-pip &&\
+    ln -s $CKAN_VENV/bin/paster /usr/local/bin/ckan-paster
 
 # SetUp CKAN
-ADD . $CKAN_HOME/src/ckan/
-RUN ckan-pip install -e $CKAN_HOME/src/ckan/
-RUN ln -s $CKAN_HOME/src/ckan/ckan/config/who.ini $CKAN_CONFIG/who.ini
+ADD . $CKAN_VENV/src/ckan/
+RUN ckan-pip install --upgrade -r $CKAN_VENV/src/ckan/requirements.txt && \
+    ckan-pip install -e $CKAN_VENV/src/ckan/ && \
+    ln -s $CKAN_VENV/src/ckan/ckan/config/who.ini $CKAN_CONFIG/who.ini && \
+    cp -v $CKAN_VENV/src/ckan/contrib/docker/ckan-entrypoint.sh /ckan-entrypoint.sh && \
+    chmod +x /ckan-entrypoint.sh && \
+    chown -R ckan:ckan $CKAN_HOME $CKAN_VENV $CKAN_CONFIG $CKAN_STORAGE_PATH
 
-# SetUp EntryPoint
-COPY ./contrib/docker/ckan-entrypoint.sh /
-RUN chmod +x /ckan-entrypoint.sh
 ENTRYPOINT ["/ckan-entrypoint.sh"]
 
 # Volumes
 VOLUME ["/etc/ckan/default"]
 VOLUME ["/var/lib/ckan"]
+
+USER ckan
 EXPOSE 5000
+
 CMD ["ckan-paster","serve","/etc/ckan/default/ckan.ini"]
+

contrib/docker/apache.wsgi

@@ -1,5 +1,5 @@
 import os
-ckan_home = os.environ.get('CKAN_HOME', '/usr/lib/ckan/default')
+ckan_home = os.environ.get('CKAN_VENV', '/usr/lib/ckan/default')
 activate_this = os.path.join(ckan_home, 'bin/activate_this.py')
 execfile(activate_this, dict(__file__=activate_this))
 

contrib/docker/postgresql/Dockerfile

@@ -9,4 +9,5 @@ ENV POSTGRES_USER ckan
 ARG POSTGRES_PASSWORD
 ENV POSTGRES_DB ckan
 
+# Output variables when building for the first time, will not run if using cached image
 RUN echo "Building postgres:9.6 with user $POSTGRES_USER, pw $POSTGRES_PASSWORD, db $POSTGRES_DB"