From 161238433cdd10e6608554d78bfd56ea46400522 Mon Sep 17 00:00:00 2001
From: Andrey Arapov <andrey.arapov@nixaid.com>
Date: Tue, 29 Nov 2016 10:44:12 +0100
Subject: [PATCH] trusty to xenial and a little refactor

---
 Dockerfile         | 18 +++++-------------
 docker-compose.yml |  3 +--
 launch             |  6 ++++++
 3 files changed, 12 insertions(+), 15 deletions(-)
 create mode 100755 launch

diff --git a/Dockerfile b/Dockerfile
index 8619e64..6a63f7c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,11 @@
-FROM ubuntu:trusty
+FROM ubuntu:xenial
 MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
 
 # To avoid problems with Dialog and curses wizards
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN apt-get update \
-    && apt-get install -yq apt-transport-https wget paxctl \
+    && apt-get install -yq apt-transport-https wget attr lsb-release \
     && wget -O - https://atlassian.artifactoryonline.com/atlassian/api/gpg/key/public | apt-key add - \
     && echo "deb https://atlassian.artifactoryonline.com/atlassian/hipchat-apt-client $(lsb_release -c -s) main" > /etc/apt/sources.list.d/atlassian-hipchat4.list \
     && apt-get update \
@@ -20,15 +20,6 @@ RUN apt-get update \
 # kernel.grsecurity.chroot_deny_chmod = 0
 # kernel.grsecurity.chroot_deny_mknod = 0
 # kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
-#
-# (runtime only, since xattrs are not preserved in Docker's final image)
-# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
-# RUN setfattr -n user.pax.flags -v "m" /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
-#
-# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
-# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
-RUN paxctl -c -v -m /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
-
 
 ENV USER user
 ENV UID 1000
@@ -36,7 +27,8 @@ ENV GROUPS video
 ENV HOME /home/$USER
 RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -g $GROUPS $USER
 
+COPY launch /launch
+
 WORKDIR $HOME
-USER user
 VOLUME [ "/tmp" ]
-ENTRYPOINT [ "/usr/local/bin/hipchat4" ]
+ENTRYPOINT [ "sh", "/launch" ]
diff --git a/docker-compose.yml b/docker-compose.yml
index 6900752..3fe1b51 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,5 @@ services:
       - DISPLAY=unix$DISPLAY
       - TZ=Europe/Amsterdam
       # for the HiDPI screens you can try uncommenting these variables
-      # - QT_AUTO_SCREEN_SCALE_FACTOR=1
+      - QT_AUTO_SCREEN_SCALE_FACTOR=1
       # - QT_DEVICE_PIXEL_RATIO=2
-    read_only: true
diff --git a/launch b/launch
new file mode 100755
index 0000000..0e8932b
--- /dev/null
+++ b/launch
@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+
+# Make HipChat grsec friendly
+setfattr -n user.pax.flags -v m /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
+
+su -s /bin/sh -c /usr/local/bin/hipchat4 user