arno/hipchat
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

trusty to xenial and a little refactor

Browse Source
This commit is contained in:
Andy 2016-11-29 10:44:12 +01:00
parent 84e93272b0
commit 161238433c
Signed by: arno
GPG Key ID: 368DDA2E9A471EAC
3 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Dockerfile
View File

@ -1,11 +1,11 @@
FROM ubuntu:trusty FROM ubuntu:xenial
MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com> MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
# To avoid problems with Dialog and curses wizards # To avoid problems with Dialog and curses wizards
ENV DEBIAN_FRONTEND noninteractive ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update \ RUN apt-get update \
&& apt-get install -yq apt-transport-https wget paxctl \ && apt-get install -yq apt-transport-https wget attr lsb-release \
&& wget -O - https://atlassian.artifactoryonline.com/atlassian/api/gpg/key/public | apt-key add - \ && wget -O - https://atlassian.artifactoryonline.com/atlassian/api/gpg/key/public | apt-key add - \
&& echo "deb https://atlassian.artifactoryonline.com/atlassian/hipchat-apt-client $(lsb_release -c -s) main" > /etc/apt/sources.list.d/atlassian-hipchat4.list \ && echo "deb https://atlassian.artifactoryonline.com/atlassian/hipchat-apt-client $(lsb_release -c -s) main" > /etc/apt/sources.list.d/atlassian-hipchat4.list \
&& apt-get update \ && apt-get update \
@ -20,15 +20,6 @@ RUN apt-get update \
# kernel.grsecurity.chroot_deny_chmod = 0 # kernel.grsecurity.chroot_deny_chmod = 0
# kernel.grsecurity.chroot_deny_mknod = 0 # kernel.grsecurity.chroot_deny_mknod = 0
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package) # kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
#
# (runtime only, since xattrs are not preserved in Docker's final image)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# RUN setfattr -n user.pax.flags -v "m" /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
#
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
RUN paxctl -c -v -m /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
ENV USER user ENV USER user
ENV UID 1000 ENV UID 1000
@ -36,7 +27,8 @@ ENV GROUPS video
ENV HOME /home/$USER ENV HOME /home/$USER
RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -g $GROUPS $USER RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -g $GROUPS $USER
COPY launch /launch
WORKDIR $HOME WORKDIR $HOME
USER user
VOLUME [ "/tmp" ] VOLUME [ "/tmp" ]
ENTRYPOINT [ "/usr/local/bin/hipchat4" ] ENTRYPOINT [ "sh", "/launch" ]

3
docker-compose.yml
View File

@ -18,6 +18,5 @@ services:
- DISPLAY=unix$DISPLAY - DISPLAY=unix$DISPLAY
- TZ=Europe/Amsterdam - TZ=Europe/Amsterdam
# for the HiDPI screens you can try uncommenting these variables # for the HiDPI screens you can try uncommenting these variables
# - QT_AUTO_SCREEN_SCALE_FACTOR=1 - QT_AUTO_SCREEN_SCALE_FACTOR=1
# - QT_DEVICE_PIXEL_RATIO=2 # - QT_DEVICE_PIXEL_RATIO=2
read_only: true

6
launch Executable file
View File

@ -0,0 +1,6 @@
#!/usr/bin/env sh
# Make HipChat grsec friendly
setfattr -n user.pax.flags -v m /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
su -s /bin/sh -c /usr/local/bin/hipchat4 user