mirror of
https://git.vectorsigma.ru/public/atlantis.git
synced 2026-07-29 05:48:21 +00:00
e9c0d72578
* feat: use Atlantis user by default and get rid of gosu * chore: set `DOCKER_CONTENT_TRUST=1` * chore: fix chmod and chown * feat: add a healthcheck to the debian and alpine images * feat: removing setuid and setgid permissions prevents container privilege escalation and improve comments * chore: remove setgid/setuid as we chown an entire directory * chore: keep deps comment generic * chore: grammar * chore: remove redundant comment * chore: rm DOCKER_CONTENT_TRUST * chore: set uid and gid and remove passwd entry * chore: revert gid and uid set as it's conflicting --------- Co-authored-by: PePe Amengual <jose.amengual@gmail.com>
33 lines
1.3 KiB
Bash
Executable File
33 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/dumb-init /bin/sh
|
|
set -e
|
|
|
|
# Modified: https://github.com/hashicorp/docker-consul/blob/2c2873f9d619220d1eef0bc46ec78443f55a10b5/0.X/docker-entrypoint.sh
|
|
|
|
# If the user is trying to run atlantis directly with some arguments, then
|
|
# pass them to atlantis.
|
|
if [ "$(echo "${1}" | cut -c1)" = "-" ]; then
|
|
set -- atlantis "$@"
|
|
fi
|
|
|
|
# If the user is running an atlantis subcommand (ex. server) then we want to prepend
|
|
# atlantis as the first arg to exec. To detect if they're running a subcommand
|
|
# we take the potential subcommand and run it through atlantis help {subcommand}.
|
|
# If the output contains "atlantis subcommand" then we know it's a subcommand
|
|
# since the help output contains that string. For anything else (ex. sh)
|
|
# it won't contain that string.
|
|
# NOTE: We use grep instead of the exit code since help always returns 0.
|
|
if atlantis help "$1" 2>&1 | grep -q "atlantis $1"; then
|
|
# We can't use the return code to check for the existence of a subcommand, so
|
|
# we have to use grep to look for a pattern in the help output.
|
|
set -- atlantis "$@"
|
|
fi
|
|
|
|
# If the current uid running does not have a user create one in /etc/passwd
|
|
if ! whoami > /dev/null 2>&1; then
|
|
if [ -w /etc/passwd ]; then
|
|
echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:/home/atlantis:/sbin/nologin" >> /etc/passwd
|
|
fi
|
|
fi
|
|
|
|
exec "$@"
|