From 6f2b8d26f9239bfb4923c7a4762ab3b3b32c59cb Mon Sep 17 00:00:00 2001 From: Diogo F Medeiros Date: Wed, 21 Oct 2026 15:05:24 -0300 Subject: [PATCH 1/2] =?UTF-8?q?Atualiza=C3=A7=C3=A3o=20do=20Jwilder=20Dock?= =?UTF-8?q?erize=20para=20vers=C3=A3o=200.15.2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 8.2-prod/Dockerfile | 2 +- 8.2/Dockerfile | 2 +- 8.3-prod/Dockerfile | 2 +- 8.3/Dockerfile | 2 +- 8.4-debian-prod/Dockerfile | 2 +- 8.4-debian/Dockerfile | 2 +- 8.4-prod/Dockerfile | 2 +- 8.4/Dockerfile | 2 +- 8.5-debian-prod/Dockerfile | 2 +- 8.5-debian/Dockerfile | 2 +- 8.5-prod/Dockerfile | 2 +- 8.5/Dockerfile | 2 +- template/Dockerfile-debian.blade.php | 2 +- template/Dockerfile.blade.php | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) diff --git a/8.2-prod/Dockerfile b/8.2-prod/Dockerfile index 8572ca0..1ee64ec 100644 --- a/8.2-prod/Dockerfile +++ b/8.2-prod/Dockerfile @@ -21,7 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.2/Dockerfile b/8.2/Dockerfile index dc8136a..8453d89 100644 --- a/8.2/Dockerfile +++ b/8.2/Dockerfile @@ -22,7 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.3-prod/Dockerfile b/8.3-prod/Dockerfile index 6ba96cf..afe07a7 100644 --- a/8.3-prod/Dockerfile +++ b/8.3-prod/Dockerfile @@ -21,7 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.3/Dockerfile b/8.3/Dockerfile index 4d12e85..dc447a5 100644 --- a/8.3/Dockerfile +++ b/8.3/Dockerfile @@ -22,7 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.4-debian-prod/Dockerfile b/8.4-debian-prod/Dockerfile index aeb8927..97f12d1 100644 --- a/8.4-debian-prod/Dockerfile +++ b/8.4-debian-prod/Dockerfile @@ -21,7 +21,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ diff --git a/8.4-debian/Dockerfile b/8.4-debian/Dockerfile index 5dd3753..885f699 100644 --- a/8.4-debian/Dockerfile +++ b/8.4-debian/Dockerfile @@ -22,7 +22,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ diff --git a/8.4-prod/Dockerfile b/8.4-prod/Dockerfile index 6713397..e0b5739 100644 --- a/8.4-prod/Dockerfile +++ b/8.4-prod/Dockerfile @@ -21,7 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.4/Dockerfile b/8.4/Dockerfile index c6afb44..e71972c 100644 --- a/8.4/Dockerfile +++ b/8.4/Dockerfile @@ -22,7 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.5-debian-prod/Dockerfile b/8.5-debian-prod/Dockerfile index e2370ac..dbbab3c 100644 --- a/8.5-debian-prod/Dockerfile +++ b/8.5-debian-prod/Dockerfile @@ -21,7 +21,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ diff --git a/8.5-debian/Dockerfile b/8.5-debian/Dockerfile index 9f708b1..aef20f4 100644 --- a/8.5-debian/Dockerfile +++ b/8.5-debian/Dockerfile @@ -22,7 +22,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ diff --git a/8.5-prod/Dockerfile b/8.5-prod/Dockerfile index 5efe2f2..89dd9c1 100644 --- a/8.5-prod/Dockerfile +++ b/8.5-prod/Dockerfile @@ -21,7 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/8.5/Dockerfile b/8.5/Dockerfile index 1e55645..6be4ca9 100644 --- a/8.5/Dockerfile +++ b/8.5/Dockerfile @@ -22,7 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ diff --git a/template/Dockerfile-debian.blade.php b/template/Dockerfile-debian.blade.php index 8f1203b..baaf861 100644 --- a/template/Dockerfile-debian.blade.php +++ b/template/Dockerfile-debian.blade.php @@ -24,7 +24,7 @@ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ diff --git a/template/Dockerfile.blade.php b/template/Dockerfile.blade.php index 9875109..41ff188 100644 --- a/template/Dockerfile.blade.php +++ b/template/Dockerfile.blade.php @@ -24,7 +24,7 @@ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.9.3/dockerize-linux-${DOCKERIZE_ARCH}-v0.9.3.tar.gz" | tar xz \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ && mv dockerize /usr/local/bin/dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ From a9453487c79c47fe1bf83de4ac6e90b83bb67549 Mon Sep 17 00:00:00 2001 From: fabriciojs Date: Sun, 25 Oct 2026 08:38:15 -0300 Subject: [PATCH 2/2] extract only the dockerize binary, owned by root Since v0.10 the dockerize release tarball also ships LICENSE and README.md. We only moved the binary out, and WORKDIR /app is set before this step, so both files were left in /app of every image (and of every prod app that doesn't ship its own copies). tar also restored the archive's owner, so /usr/local/bin/dockerize was owned by uid 1001 (501 with v0.9.3). The entrypoint runs dockerize as root on every start, so when ASUSER matched that uid the kool user could replace it and get root on the next restart. Extract just the binary straight into /usr/local/bin, without restoring ownership, and assert both in test-image.sh. Co-Authored-By: Claude Opus 5.5 (1M context) --- 8.2-prod/Dockerfile | 3 +-- 8.2/Dockerfile | 3 +-- 8.3-prod/Dockerfile | 3 +-- 8.3/Dockerfile | 3 +-- 8.4-debian-prod/Dockerfile | 3 +-- 8.4-debian/Dockerfile | 3 +-- 8.4-prod/Dockerfile | 3 +-- 8.4/Dockerfile | 3 +-- 8.5-debian-prod/Dockerfile | 3 +-- 8.5-debian/Dockerfile | 3 +-- 8.5-prod/Dockerfile | 3 +-- 8.5/Dockerfile | 3 +-- scripts/test-image.sh | 4 ++++ template/Dockerfile-debian.blade.php | 3 +-- template/Dockerfile.blade.php | 3 +-- 15 files changed, 18 insertions(+), 28 deletions(-) diff --git a/8.2-prod/Dockerfile b/8.2-prod/Dockerfile index 1ee64ec..d049977 100644 --- a/8.2-prod/Dockerfile +++ b/8.2-prod/Dockerfile @@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.2/Dockerfile b/8.2/Dockerfile index 8453d89..3c4a94f 100644 --- a/8.2/Dockerfile +++ b/8.2/Dockerfile @@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.3-prod/Dockerfile b/8.3-prod/Dockerfile index afe07a7..77ffba5 100644 --- a/8.3-prod/Dockerfile +++ b/8.3-prod/Dockerfile @@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.3/Dockerfile b/8.3/Dockerfile index dc447a5..5d174b2 100644 --- a/8.3/Dockerfile +++ b/8.3/Dockerfile @@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.4-debian-prod/Dockerfile b/8.4-debian-prod/Dockerfile index 97f12d1..a7f7d4f 100644 --- a/8.4-debian-prod/Dockerfile +++ b/8.4-debian-prod/Dockerfile @@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \ diff --git a/8.4-debian/Dockerfile b/8.4-debian/Dockerfile index 885f699..a07626d 100644 --- a/8.4-debian/Dockerfile +++ b/8.4-debian/Dockerfile @@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \ diff --git a/8.4-prod/Dockerfile b/8.4-prod/Dockerfile index e0b5739..4ef85ee 100644 --- a/8.4-prod/Dockerfile +++ b/8.4-prod/Dockerfile @@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.4/Dockerfile b/8.4/Dockerfile index e71972c..1a0741e 100644 --- a/8.4/Dockerfile +++ b/8.4/Dockerfile @@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.5-debian-prod/Dockerfile b/8.5-debian-prod/Dockerfile index dbbab3c..48c51cf 100644 --- a/8.5-debian-prod/Dockerfile +++ b/8.5-debian-prod/Dockerfile @@ -21,8 +21,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \ diff --git a/8.5-debian/Dockerfile b/8.5-debian/Dockerfile index aef20f4..5dd60f2 100644 --- a/8.5-debian/Dockerfile +++ b/8.5-debian/Dockerfile @@ -22,8 +22,7 @@ RUN useradd -m -u 1337 kool \ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \ diff --git a/8.5-prod/Dockerfile b/8.5-prod/Dockerfile index 89dd9c1..d52ab45 100644 --- a/8.5-prod/Dockerfile +++ b/8.5-prod/Dockerfile @@ -21,8 +21,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/8.5/Dockerfile b/8.5/Dockerfile index 6be4ca9..7c69a3b 100644 --- a/8.5/Dockerfile +++ b/8.5/Dockerfile @@ -22,8 +22,7 @@ RUN adduser -D -u 1337 kool \ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \ diff --git a/scripts/test-image.sh b/scripts/test-image.sh index aca9c1e..3a71451 100644 --- a/scripts/test-image.sh +++ b/scripts/test-image.sh @@ -18,6 +18,10 @@ test "$(docker run --rm -e ASUSER=1000 "$image" id -u)" = 1000 run dockerize --version run sh -c 'echo "{{ .Env.TEST_VAR }}" > /tmp/test.tmpl; TEST_VAR=hello dockerize -template /tmp/test.tmpl:/tmp/test.out; test "$(cat /tmp/test.out)" = hello' +# The entrypoint runs dockerize as root, so only root may own it; and the +# release tarball's LICENSE/README.md must not be left behind in /app. +test "$(run stat -c %u:%g /usr/local/bin/dockerize)" = 0:0 +run sh -c 'test ! -e /app/LICENSE && test ! -e /app/README.md' # Read the module list once, and match whole names (e.g. zip, not gzip). modules=$(run php -m) diff --git a/template/Dockerfile-debian.blade.php b/template/Dockerfile-debian.blade.php index baaf861..fcd8275 100644 --- a/template/Dockerfile-debian.blade.php +++ b/template/Dockerfile-debian.blade.php @@ -24,8 +24,7 @@ && usermod -aG www-data kool \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # gosu && GOSU_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ && curl -L "https://github.com/tianon/gosu/releases/download/1.17/gosu-${GOSU_ARCH}" -o /usr/local/bin/gosu \ diff --git a/template/Dockerfile.blade.php b/template/Dockerfile.blade.php index 41ff188..7fb55de 100644 --- a/template/Dockerfile.blade.php +++ b/template/Dockerfile.blade.php @@ -24,8 +24,7 @@ && addgroup kool www-data \ # dockerize && DOCKERIZE_ARCH="$( [ "$(uname -m)" = "aarch64" ] && echo arm64 || echo amd64 )" \ - && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz \ - && mv dockerize /usr/local/bin/dockerize \ + && curl -L "https://github.com/jwilder/dockerize/releases/download/v0.15.2/dockerize-linux-${DOCKERIZE_ARCH}-v0.15.2.tar.gz" | tar xz -C /usr/local/bin --no-same-owner dockerize \ # deps && apk --no-cache add su-exec bash sed git openssh-client icu shadow procps \ freetype libpng libjpeg-turbo libzip-dev ghostscript imagemagick \