branderson/dotcom-arcade
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: use node user by default

Browse Source
This commit is contained in:
Darkraise
2026-02-02 16:54:05 +07:00
parent ee30b40a03
commit 77dc45700e
6 changed files with 69 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/Dockerfile
+2 -7
View File
@@ -62,17 +62,12 @@ COPY --from=builder /app/backend/src/migrations ./backend/dist/migrations
# Copy entrypoint script
COPY --from=builder /app/backend/docker-entrypoint.sh ./backend/docker-entrypoint.sh
# Create non-root user with default UID/GID 1000
# These can be overridden at runtime via PUID/PGID environment variables
RUN addgroup -g 1000 -S flashpoint && \
adduser -S flashpoint -u 1000 -G flashpoint
# Create data and logs directories
# Make entrypoint script executable
# Note: Ownership will be fixed at runtime if PUID/PGID are set
# Use existing 'node' user (UID 1000) from base image
RUN mkdir -p /app/data /app/logs && \
chmod +x /app/backend/docker-entrypoint.sh && \
chown -R flashpoint:flashpoint /app
chown -R node:node /app
# Set working directory to backend
WORKDIR /app/backend
backend/docker-entrypoint.sh
+16 -22
View File
@@ -21,13 +21,15 @@ echo "🚀 Flashpoint Web Backend - Starting..."
PUID=${PUID:-1000}
PGID=${PGID:-1000}
APP_USER="node"
APP_GROUP="node"
setup_user() {
local current_uid
local current_gid
current_uid=$(id -u flashpoint 2>/dev/null || echo "")
current_gid=$(id -g flashpoint 2>/dev/null || echo "")
current_uid=$(id -u $APP_USER 2>/dev/null || echo "")
current_gid=$(id -g $APP_USER 2>/dev/null || echo "")
# Check if we need to modify UID/GID
if [ "$current_uid" != "$PUID" ] || [ "$current_gid" != "$PGID" ]; then
@@ -37,35 +39,27 @@ setup_user() {
# Modify group GID if different
if [ "$current_gid" != "$PGID" ]; then
# Check if target GID is already in use
if getent group "$PGID" >/dev/null 2>&1; then
# Remove the conflicting group
local conflicting_group
conflicting_group=$(getent group "$PGID" | cut -d: -f1)
if [ "$conflicting_group" != "flashpoint" ]; then
groupdel "$conflicting_group" 2>/dev/null || true
fi
# Check if target GID is already in use by another group
existing_group=$(getent group "$PGID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_group" ] && [ "$existing_group" != "$APP_GROUP" ]; then
groupdel "$existing_group" 2>/dev/null || true
fi
groupmod -g "$PGID" flashpoint 2>/dev/null || true
groupmod -g "$PGID" $APP_GROUP 2>/dev/null || true
fi
# Modify user UID if different
if [ "$current_uid" != "$PUID" ]; then
# Check if target UID is already in use
if getent passwd "$PUID" >/dev/null 2>&1; then
# Remove the conflicting user
local conflicting_user
conflicting_user=$(getent passwd "$PUID" | cut -d: -f1)
if [ "$conflicting_user" != "flashpoint" ]; then
userdel "$conflicting_user" 2>/dev/null || true
fi
# Check if target UID is already in use by another user
existing_user=$(getent passwd "$PUID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_user" ] && [ "$existing_user" != "$APP_USER" ]; then
userdel "$existing_user" 2>/dev/null || true
fi
usermod -u "$PUID" flashpoint 2>/dev/null || true
usermod -u "$PUID" $APP_USER 2>/dev/null || true
fi
# Fix ownership of app directories
echo " Fixing ownership of /app directories..."
chown -R flashpoint:flashpoint /app/data /app/logs 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /app/data /app/logs 2>/dev/null || true
else
echo "✅ User permissions OK (UID=$PUID, GID=$PGID)"
fi
@@ -210,7 +204,7 @@ echo "🎮 Starting Flashpoint Web Backend..."
# If running as root, drop privileges using su-exec
if [ "$(id -u)" = "0" ]; then
exec su-exec flashpoint node dist/server.js
exec su-exec $APP_USER node dist/server.js
else
exec node dist/server.js
fi
frontend/Dockerfile
+11 -10
View File
@@ -43,8 +43,9 @@ LABEL org.opencontainers.image.source="https://github.com/darkraise/flashpoint-w
# - curl: health checks
# - tzdata: timezone support
# - su-exec: lightweight tool to drop privileges (like gosu)
# - shadow: provides usermod/groupmod for dynamic UID/GID
# - gettext: provides envsubst for nginx config templating
RUN apk add --no-cache curl tzdata su-exec gettext
RUN apk add --no-cache curl tzdata su-exec shadow gettext
# Copy built files from builder
COPY --from=builder /app/frontend/dist /usr/share/nginx/html
@@ -59,16 +60,16 @@ COPY frontend/docker-entrypoint.sh /docker-entrypoint.sh
ENV BACKEND_HOST=backend \
BACKEND_PORT=3100
# Create non-root user with default UID/GID 1000
# Create non-root user with default UID/GID 1000 (nginx:alpine doesn't have one)
# These can be overridden at runtime via PUID/PGID environment variables
RUN addgroup -g 1000 -S flashpoint && \
adduser -S flashpoint -u 1000 -G flashpoint && \
chown -R flashpoint:flashpoint /usr/share/nginx/html && \
chown -R flashpoint:flashpoint /var/cache/nginx && \
chown -R flashpoint:flashpoint /var/log/nginx && \
chown -R flashpoint:flashpoint /etc/nginx/conf.d && \
RUN addgroup -g 1000 -S appuser && \
adduser -S appuser -u 1000 -G appuser && \
chown -R appuser:appuser /usr/share/nginx/html && \
chown -R appuser:appuser /var/cache/nginx && \
chown -R appuser:appuser /var/log/nginx && \
chown -R appuser:appuser /etc/nginx/conf.d && \
touch /var/run/nginx.pid && \
chown -R flashpoint:flashpoint /var/run/nginx.pid && \
chown -R appuser:appuser /var/run/nginx.pid && \
chmod +x /docker-entrypoint.sh
# Create necessary directories
@@ -77,7 +78,7 @@ RUN mkdir -p /var/cache/nginx/client_temp \
/var/cache/nginx/fastcgi_temp \
/var/cache/nginx/uwsgi_temp \
/var/cache/nginx/scgi_temp && \
chown -R flashpoint:flashpoint /var/cache/nginx
chown -R appuser:appuser /var/cache/nginx
# Expose port (8080 for non-root user)
EXPOSE 8080
frontend/docker-entrypoint.sh
+22 -26
View File
@@ -19,13 +19,15 @@ echo "🌐 Flashpoint Web Frontend - Starting..."
PUID=${PUID:-1000}
PGID=${PGID:-1000}
APP_USER="appuser"
APP_GROUP="appuser"
setup_user() {
local current_uid
local current_gid
current_uid=$(id -u flashpoint 2>/dev/null || echo "")
current_gid=$(id -g flashpoint 2>/dev/null || echo "")
current_uid=$(id -u $APP_USER 2>/dev/null || echo "")
current_gid=$(id -g $APP_USER 2>/dev/null || echo "")
# Check if we need to modify UID/GID
if [ "$current_uid" != "$PUID" ] || [ "$current_gid" != "$PGID" ]; then
@@ -35,39 +37,33 @@ setup_user() {
# Modify group GID if different
if [ "$current_gid" != "$PGID" ]; then
# Check if target GID is already in use
if getent group "$PGID" >/dev/null 2>&1; then
local conflicting_group
conflicting_group=$(getent group "$PGID" | cut -d: -f1)
if [ "$conflicting_group" != "flashpoint" ]; then
delgroup "$conflicting_group" 2>/dev/null || true
fi
# Check if target GID is already in use by another group
existing_group=$(getent group "$PGID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_group" ] && [ "$existing_group" != "$APP_GROUP" ]; then
delgroup "$existing_group" 2>/dev/null || true
fi
# Alpine uses different syntax for groupmod
sed -i "s/^flashpoint:x:[0-9]*:/flashpoint:x:${PGID}:/" /etc/group 2>/dev/null || true
# Alpine uses different syntax
sed -i "s/^${APP_GROUP}:x:[0-9]*:/${APP_GROUP}:x:${PGID}:/" /etc/group 2>/dev/null || true
fi
# Modify user UID if different
if [ "$current_uid" != "$PUID" ]; then
# Check if target UID is already in use
if getent passwd "$PUID" >/dev/null 2>&1; then
local conflicting_user
conflicting_user=$(getent passwd "$PUID" | cut -d: -f1)
if [ "$conflicting_user" != "flashpoint" ]; then
deluser "$conflicting_user" 2>/dev/null || true
fi
# Check if target UID is already in use by another user
existing_user=$(getent passwd "$PUID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_user" ] && [ "$existing_user" != "$APP_USER" ]; then
deluser "$existing_user" 2>/dev/null || true
fi
# Alpine uses different syntax for usermod
sed -i "s/^flashpoint:x:[0-9]*:[0-9]*:/flashpoint:x:${PUID}:${PGID}:/" /etc/passwd 2>/dev/null || true
# Alpine uses different syntax
sed -i "s/^${APP_USER}:x:[0-9]*:[0-9]*:/${APP_USER}:x:${PUID}:${PGID}:/" /etc/passwd 2>/dev/null || true
fi
# Fix ownership of nginx directories
echo " Fixing ownership of nginx directories..."
chown -R flashpoint:flashpoint /usr/share/nginx/html 2>/dev/null || true
chown -R flashpoint:flashpoint /var/cache/nginx 2>/dev/null || true
chown -R flashpoint:flashpoint /var/log/nginx 2>/dev/null || true
chown -R flashpoint:flashpoint /etc/nginx/conf.d 2>/dev/null || true
chown flashpoint:flashpoint /var/run/nginx.pid 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /usr/share/nginx/html 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /var/cache/nginx 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /var/log/nginx 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /etc/nginx/conf.d 2>/dev/null || true
chown $APP_USER:$APP_GROUP /var/run/nginx.pid 2>/dev/null || true
else
echo "✅ User permissions OK (UID=$PUID, GID=$PGID)"
fi
@@ -98,7 +94,7 @@ echo "🚀 Starting Nginx..."
# If running as root, drop privileges using su-exec
if [ "$(id -u)" = "0" ]; then
exec su-exec flashpoint nginx -g "daemon off;"
exec su-exec $APP_USER nginx -g "daemon off;"
else
exec nginx -g "daemon off;"
fi
game-service/Dockerfile
+2 -7
View File
@@ -62,16 +62,11 @@ COPY --from=builder /app/game-service/dist ./game-service/dist
# Copy entrypoint script
COPY --from=builder /app/game-service/docker-entrypoint.sh ./game-service/docker-entrypoint.sh
# Create non-root user with default UID/GID 1000
# These can be overridden at runtime via PUID/PGID environment variables
RUN addgroup -g 1000 -S flashpoint && \
adduser -S flashpoint -u 1000 -G flashpoint
# Create logs directory and make entrypoint executable
# Note: Ownership will be fixed at runtime if PUID/PGID are set
# Use existing 'node' user (UID 1000) from base image
RUN mkdir -p /app/logs && \
chmod +x /app/game-service/docker-entrypoint.sh && \
chown -R flashpoint:flashpoint /app
chown -R node:node /app
# Set working directory to game-service
WORKDIR /app/game-service
game-service/docker-entrypoint.sh
+16 -22
View File
@@ -19,13 +19,15 @@ echo "🎮 Flashpoint Game Service - Starting..."
PUID=${PUID:-1000}
PGID=${PGID:-1000}
APP_USER="node"
APP_GROUP="node"
setup_user() {
local current_uid
local current_gid
current_uid=$(id -u flashpoint 2>/dev/null || echo "")
current_gid=$(id -g flashpoint 2>/dev/null || echo "")
current_uid=$(id -u $APP_USER 2>/dev/null || echo "")
current_gid=$(id -g $APP_USER 2>/dev/null || echo "")
# Check if we need to modify UID/GID
if [ "$current_uid" != "$PUID" ] || [ "$current_gid" != "$PGID" ]; then
@@ -35,35 +37,27 @@ setup_user() {
# Modify group GID if different
if [ "$current_gid" != "$PGID" ]; then
# Check if target GID is already in use
if getent group "$PGID" >/dev/null 2>&1; then
# Remove the conflicting group
local conflicting_group
conflicting_group=$(getent group "$PGID" | cut -d: -f1)
if [ "$conflicting_group" != "flashpoint" ]; then
groupdel "$conflicting_group" 2>/dev/null || true
fi
# Check if target GID is already in use by another group
existing_group=$(getent group "$PGID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_group" ] && [ "$existing_group" != "$APP_GROUP" ]; then
groupdel "$existing_group" 2>/dev/null || true
fi
groupmod -g "$PGID" flashpoint 2>/dev/null || true
groupmod -g "$PGID" $APP_GROUP 2>/dev/null || true
fi
# Modify user UID if different
if [ "$current_uid" != "$PUID" ]; then
# Check if target UID is already in use
if getent passwd "$PUID" >/dev/null 2>&1; then
# Remove the conflicting user
local conflicting_user
conflicting_user=$(getent passwd "$PUID" | cut -d: -f1)
if [ "$conflicting_user" != "flashpoint" ]; then
userdel "$conflicting_user" 2>/dev/null || true
fi
# Check if target UID is already in use by another user
existing_user=$(getent passwd "$PUID" 2>/dev/null | cut -d: -f1 || true)
if [ -n "$existing_user" ] && [ "$existing_user" != "$APP_USER" ]; then
userdel "$existing_user" 2>/dev/null || true
fi
usermod -u "$PUID" flashpoint 2>/dev/null || true
usermod -u "$PUID" $APP_USER 2>/dev/null || true
fi
# Fix ownership of app directories
echo " Fixing ownership of /app directories..."
chown -R flashpoint:flashpoint /app/logs 2>/dev/null || true
chown -R $APP_USER:$APP_GROUP /app/logs 2>/dev/null || true
else
echo "✅ User permissions OK (UID=$PUID, GID=$PGID)"
fi
@@ -89,7 +83,7 @@ echo "🚀 Starting Game Service..."
# If running as root, drop privileges using su-exec
if [ "$(id -u)" = "0" ]; then
exec su-exec flashpoint node dist/index.js
exec su-exec $APP_USER node dist/index.js
else
exec node dist/index.js
fi