From b5d6db4ad2575b22e94aa5508abe56717c7f4ca0 Mon Sep 17 00:00:00 2001 From: Kieran Eglin Date: Tue, 2 Apr 2024 09:22:41 -0700 Subject: [PATCH] Updated dockerfile --- selfhosted.Dockerfile | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/selfhosted.Dockerfile b/selfhosted.Dockerfile index d861cd0..57a329f 100644 --- a/selfhosted.Dockerfile +++ b/selfhosted.Dockerfile @@ -95,11 +95,9 @@ ENV LANGUAGE en_US:en ENV LC_ALL en_US.UTF-8 WORKDIR "/app" -RUN chown nobody /app # Set up data volumes RUN mkdir /config /downloads -RUN chown nobody /config /downloads # set runner ENV ENV MIX_ENV="prod" @@ -108,20 +106,7 @@ ENV RUN_CONTEXT="selfhosted" EXPOSE ${PORT} # Only copy the final release from the build stage -COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/pinchflat ./ - -# NEVER do this if you're running in an environment where you don't trust the user -# (ie: most environments). This is only acceptable in a self-hosted environment. -# The user could just run the whole container as root and bypass this anyway so -# it's not a huge deal. -# This removes the root password to allow users to assume root if needed. This is -# preferrable to running the whole container as root so that the files/directories -# created by the app aren't owned by root and are therefore easier for other users -# and processes to interact with. If you want to just run the whole container as -# root, use --user 0:0 or something. -RUN passwd -d root - -USER nobody +COPY --from=builder /app/_build/${MIX_ENV}/rel/pinchflat ./ # If using an environment that doesn't automatically reap zombie processes, it is # advised to add an init process such as tini via `apt-get install`