Running applications as non-root user.

Author: LucaCinquini

cog/Dockerfile

@@ -6,7 +6,7 @@ FROM esgfhub/centos67_python27:latest
 MAINTAINER Luca Cinquini <luca.cinquini@jpl.nasa.gov>
 
 # choose CoG version
-ENV COG_TAG=v3.6.0
+ENV COG_TAG=v3.6.1
 
 # setup CoG environment
 ENV COG_DIR=/usr/local/cog
@@ -48,3 +48,21 @@ RUN cd $COG_DIR && \
     cd mkproxy && \
     make  && \
     cp mkproxy $COG_DIR/venv/lib/python2.7/site-packages/globusonline_transfer_api_client-0.10.16-py2.7.egg/globusonline/transfer/api_client/x509_proxy/.
+
+# expose default django port
+EXPOSE 8000
+
+# create non-privileged user to run django
+RUN groupadd -r cogadmin && \
+    useradd -r -g cogadmin cogadmin && \
+    mkdir -p ~cogadmin && \
+    chown cogadmin:cogadmin ~cogadmin
+
+# change user prompt
+RUN echo 'export PS1="[\u@\h]\$ "' >> ~cogadmin/.bashrc
+
+# change ownership of application directories
+RUN chown -R cogadmin:cogadmin $COG_DIR
+
+# expose application data (must do this AFTER chown)
+VOLUME $COG_DIR

cog_postgres/Dockerfile

@@ -1,5 +1,5 @@
 # CoG image configured for ESGF node
-FROM esgfhub/cog
+FROM esgfhub/cog:v3.6.1
 
 MAINTAINER Luca Cinquini <luca.cinquini@jpl.nasa.gov>
 
@@ -47,6 +47,9 @@ RUN echo 'db.host=localhost' >> /esg/config/esgf.properties
 RUN echo 'db.port=5432' >> /esg/config/esgf.properties
 RUN echo 'changeit' >> /esg/config/.esgf_pass
 
+# default working directory
+WORKDIR $COG_INSTALL_DIR
+
 # start up django+CoG with correct host IP
 COPY ./docker-entrypoint.sh /
 ENTRYPOINT ["/docker-entrypoint.sh"]

cog_postgres/docker-entrypoint.sh

@@ -4,6 +4,7 @@
 source $COG_DIR/venv/bin/activate
 
 # start postgres
+# must issue this command as user 'root' becoming user 'postgres'
 su -c 'pg_ctl start -D /var/lib/pgsql/data' postgres
 
 # upgrade CoG
@@ -18,6 +19,9 @@ sed -i 's/ALLOWED_HOSTS = .*/ALLOWED_HOSTS = '"${DOCKER_IP}"'/g' $COG_CONFIG_DIR
 # PRODUCTION_SERVER = True would require use of SSL to transmit any cookie
 sed -i 's/PRODUCTION_SERVER = True/PRODUCTION_SERVER = False/g' $COG_CONFIG_DIR/cog_settings.cfg
 
+# change ownerksip of directory
+chown -R cogadmin:cogadmin $COG_DIR
+
 # Start CoG in virtual environment
 cd $COG_INSTALL_DIR
-python ./manage.py runserver 0.0.0.0:8000
+su -c 'python ./manage.py runserver 0.0.0.0:8000' cogadmin

cog_sqllite/Dockerfile

@@ -2,10 +2,16 @@
 # All setup and configuration is executed by the docker entrypoint
 # when the container starts up.
 
-FROM esgfhub/cog
+FROM esgfhub/cog:v3.6.1
 
 MAINTAINER Luca Cinquini <luca.cinquini@jpl.nasa.gov>
 
+# default user
+USER cogadmin
+
+# default working directory
+WORKDIR $COG_INSTALL_DIR
+
 # start up django+CoG with correct host IP
 COPY ./docker-entrypoint.sh /
 ENTRYPOINT ["/docker-entrypoint.sh"]