|
@@ -154,12 +154,11 @@ RUN [ "$(/hello.sh)" = "hello world" ]
|
|
FROM {IMAGE}
|
|
FROM {IMAGE}
|
|
|
|
|
|
# Make sure our defaults work
|
|
# Make sure our defaults work
|
|
-RUN [ "$(id -u):$(id -g)" = '0:0' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)" = '0:0/root:root' ]
|
|
|
|
|
|
# TODO decide if "args.user = strconv.Itoa(syscall.Getuid())" is acceptable behavior for changeUser in sysvinit instead of "return nil" when "USER" isn't specified (so that we get the proper group list even if that is the empty list, even in the default case of not supplying an explicit USER to run as, which implies USER 0)
|
|
# TODO decide if "args.user = strconv.Itoa(syscall.Getuid())" is acceptable behavior for changeUser in sysvinit instead of "return nil" when "USER" isn't specified (so that we get the proper group list even if that is the empty list, even in the default case of not supplying an explicit USER to run as, which implies USER 0)
|
|
USER root
|
|
USER root
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
|
|
|
|
|
|
+RUN [ "$(id -G):$(id -Gn)" = '0:root' ]
|
|
|
|
|
|
# Setup dockerio user and group
|
|
# Setup dockerio user and group
|
|
RUN echo 'dockerio:x:1000:1000::/bin:/bin/false' >> /etc/passwd
|
|
RUN echo 'dockerio:x:1000:1000::/bin:/bin/false' >> /etc/passwd
|
|
@@ -167,62 +166,42 @@ RUN echo 'dockerio:x:1000:' >> /etc/group
|
|
|
|
|
|
# Make sure we can switch to our user and all the information is exactly as we expect it to be
|
|
# Make sure we can switch to our user and all the information is exactly as we expect it to be
|
|
USER dockerio
|
|
USER dockerio
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
|
|
|
|
|
|
# Switch back to root and double check that worked exactly as we might expect it to
|
|
# Switch back to root and double check that worked exactly as we might expect it to
|
|
USER root
|
|
USER root
|
|
-RUN [ "$(id -u):$(id -g)" = '0:0' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'root:root' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '0 -- root' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '0:0/root:root/0:root' ]
|
|
|
|
|
|
# Add a "supplementary" group for our dockerio user
|
|
# Add a "supplementary" group for our dockerio user
|
|
RUN echo 'supplementary:x:1001:dockerio' >> /etc/group
|
|
RUN echo 'supplementary:x:1001:dockerio' >> /etc/group
|
|
|
|
|
|
# ... and then go verify that we get it like we expect
|
|
# ... and then go verify that we get it like we expect
|
|
USER dockerio
|
|
USER dockerio
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000 1001:dockerio supplementary' ]
|
|
USER 1000
|
|
USER 1000
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 1001 -- dockerio supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000 1001:dockerio supplementary' ]
|
|
|
|
|
|
-# and finally, super test the new "user:group" syntax
|
|
|
|
|
|
+# super test the new "user:group" syntax
|
|
USER dockerio:dockerio
|
|
USER dockerio:dockerio
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
|
|
USER 1000:dockerio
|
|
USER 1000:dockerio
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
|
|
USER dockerio:1000
|
|
USER dockerio:1000
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
|
|
USER 1000:1000
|
|
USER 1000:1000
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1000' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:dockerio' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1000 -- dockerio' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1000/dockerio:dockerio/1000:dockerio' ]
|
|
USER dockerio:supplementary
|
|
USER dockerio:supplementary
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
|
|
USER dockerio:1001
|
|
USER dockerio:1001
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
|
|
USER 1000:supplementary
|
|
USER 1000:supplementary
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
|
|
USER 1000:1001
|
|
USER 1000:1001
|
|
-RUN [ "$(id -u):$(id -g)" = '1000:1001' ]
|
|
|
|
-RUN [ "$(id -un):$(id -gn)" = 'dockerio:supplementary' ]
|
|
|
|
-RUN [ "$(id -G) -- $(id -Gn)" = '1001 -- supplementary' ]
|
|
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1000:1001/dockerio:supplementary/1001:supplementary' ]
|
|
|
|
+
|
|
|
|
+# make sure unknown uid/gid still works properly
|
|
|
|
+USER 1042:1043
|
|
|
|
+RUN [ "$(id -u):$(id -g)/$(id -un):$(id -gn)/$(id -G):$(id -Gn)" = '1042:1043/1042:1043/1043:1043' ]
|
|
`,
|
|
`,
|
|
nil,
|
|
nil,
|
|
nil,
|
|
nil,
|