|
| 1 | +#!/usr/bin/dumb-init /bin/sh |
| 2 | +# shellcheck shell=dash |
| 3 | +# Script created following Hashicorp's model for Consul: |
| 4 | +# https://github.com/hashicorp/docker-consul/blob/master/0.X/docker-entrypoint.sh |
| 5 | +# Comments in this file originate from the project above, simply replacing 'Consul' with 'Nomad'. |
| 6 | +set -e |
| 7 | + |
| 8 | +# Note above that we run dumb-init as PID 1 in order to reap zombie processes |
| 9 | +# as well as forward signals to all processes in its session. Normally, sh |
| 10 | +# wouldn't do either of these functions so we'd leak zombies as well as do |
| 11 | +# unclean termination of all our sub-processes. |
| 12 | +# As of docker 1.13, using docker run --init achieves the same outcome. |
| 13 | + |
| 14 | +# NOMAD_DATA_DIR is exposed as a volume for possible persistent storage. The |
| 15 | +# NOMAD_CONFIG_DIR isn't exposed as a volume but you can compose additional |
| 16 | +# config files in there if you use this image as a base, or use NOMAD_LOCAL_CONFIG |
| 17 | +# below. |
| 18 | +NOMAD_DATA_DIR=${NOMAD_DATA_DIR:-"/nomad/data"} |
| 19 | +NOMAD_CONFIG_DIR=${NOMAD_CONFIG_DIR:-"/etc/nomad"} |
| 20 | + |
| 21 | +# You can also set the NOMAD_LOCAL_CONFIG environemnt variable to pass some |
| 22 | +# Nomad configuration JSON without having to bind any volumes. |
| 23 | +if [ -n "$NOMAD_LOCAL_CONFIG" ]; then |
| 24 | + echo "$NOMAD_LOCAL_CONFIG" > "$NOMAD_CONFIG_DIR/local.json" |
| 25 | +fi |
| 26 | + |
| 27 | +# If the user is trying to run Nomad directly with some arguments, then |
| 28 | +# pass them to Nomad. |
| 29 | +if [ "$(printf "%s" "$1" | cut -c 1)" = '-' ]; then |
| 30 | + set -- nomad "$@" |
| 31 | +fi |
| 32 | + |
| 33 | +# Look for Nomad subcommands. |
| 34 | +if [ "$1" = 'agent' ]; then |
| 35 | + shift |
| 36 | + set -- nomad agent \ |
| 37 | + -data-dir="$NOMAD_DATA_DIR" \ |
| 38 | + -config="$NOMAD_CONFIG_DIR" \ |
| 39 | + "$@" |
| 40 | +elif [ "$1" = 'version' ]; then |
| 41 | + # This needs a special case because there's no help output. |
| 42 | + set -- nomad "$@" |
| 43 | +elif nomad --help "$1" 2>&1 | grep -q "nomad $1"; then |
| 44 | + # We can't use the return code to check for the existence of a subcommand, so |
| 45 | + # we have to use grep to look for a pattern in the help output. |
| 46 | + set -- nomad "$@" |
| 47 | +fi |
| 48 | + |
| 49 | +# If we are running Nomad, make sure it executes as the proper user. |
| 50 | +if [ "$1" = 'nomad' ] && [ -z "${NOMAD_DISABLE_PERM_MGMT+x}" ]; then |
| 51 | + # If the data or config dirs are bind mounted then chown them. |
| 52 | + # Note: This checks for root ownership as that's the most common case. |
| 53 | + if [ "$(stat -c %u "$NOMAD_DATA_DIR")" != "$(id -u root)" ]; then |
| 54 | + chown root:root "$NOMAD_DATA_DIR" |
| 55 | + fi |
| 56 | + |
| 57 | + # If requested, set the capability to bind to privileged ports before |
| 58 | + # we drop to the non-root user. Note that this doesn't work with all |
| 59 | + # storage drivers (it won't work with AUFS). |
| 60 | + if [ -n "${NOMAD+x}" ]; then |
| 61 | + setcap "cap_net_bind_service=+ep" /bin/nomad |
| 62 | + fi |
| 63 | + |
| 64 | + exec runuser -u root -- "$@" |
| 65 | +fi |
| 66 | + |
| 67 | +exec "$@" |
0 commit comments