37 lines
1.1 KiB
Docker
37 lines
1.1 KiB
Docker
FROM ubuntu
|
|
MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
|
|
|
|
# To avoid problems with Dialog and curses wizards
|
|
ENV DEBIAN_FRONTEND noninteractive
|
|
|
|
RUN apt-get update
|
|
RUN apt-get install -yq keepass2 xdotool paxctl \
|
|
&& rm -rf /var/lib/apt/lists
|
|
|
|
# make KeePass2 grsec friendly
|
|
#
|
|
# To build the Docker image, I currently had to disable the following grsec protections:
|
|
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
|
|
# kernel.grsecurity.chroot_deny_chmod = 0
|
|
# kernel.grsecurity.chroot_deny_mknod = 0
|
|
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
|
|
#
|
|
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
|
|
# (runtime only, since xattrs are not preserved in Docker's final image)
|
|
# RUN setfattr -n user.pax.flags -v "m" /usr/bin/mono-sgen
|
|
#
|
|
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
|
|
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
|
|
RUN paxctl -c -v -m /usr/bin/mono-sgen
|
|
|
|
|
|
ENV USER user
|
|
ENV UID 1000
|
|
ENV HOME /home/$USER
|
|
RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin $USER
|
|
|
|
WORKDIR $HOME
|
|
USER $USER
|
|
|
|
ENTRYPOINT keepass2
|