Skip to content

Security enhancement: Run web server with unprivileged user #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DrMurx wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Security enhancement: Run web server with unprivileged user #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a40aaa9
Simplify archive extraction
DrMurx Dec 2, 2016
b05e283
Security improvements
DrMurx Dec 2, 2016
684d21b
Fix template cache dir permissions
DrMurx Dec 5, 2016
6ecae6d
Update README
DrMurx Jul 15, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,14 @@
FROM php:7-alpine
ENV VERSION=3.1
EXPOSE 80
RUN apk add --no-cache bash curl dovecot mysql-client c-client imap-dev \
EXPOSE 8000
RUN apk add --no-cache bash curl dovecot mysql-client c-client imap-dev su-exec \
&& docker-php-ext-install imap mysqli \
&& apk del imap-dev \
&& rm -rf /var/cache/apk/* \
&& curl --location https://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-${VERSION}/postfixadmin-${VERSION}.tar.gz | tar xzf - \
&& mv postfixadmin* /www \
&& curl --location https://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-${VERSION}/postfixadmin-${VERSION}.tar.gz \
| tar xzf - --no-same-owner --one-top-level=/www --strip=1 \
&& mkdir -p /www/templates_c \
&& chown nobody /www/templates_c \
&& mkdir /config
COPY config.php php.ini run.sh /
CMD /run.sh
CMD ["/run.sh"]
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# PostfixAdmin Docker image

[![](https://badge.imagelayers.io/konjak/postfixadmin:latest.svg)](https://imagelayers.io/?images=konjak/postfixadmin:latest)

Production ready Docker container for [PostfixAdmin](http://postfixadmin.sourceforge.net/) with MySQL usage.

This is a fork from [konstantinj/docker-postfixadmin](https://github.com/konstantinj/docker-postfixadmin) with a tiny security addition.

## Features - why using this image instead of several others?

- Uses [alpine](https://registry.hub.docker.com/_/alpine/) base image
Expand Down
2 changes: 2 additions & 0 deletions php.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
error_reporting=E_ALL & ~E_NOTICE & ~E_DEPRECATED
display_errors=Off
log_errors=Off
memory_limit=128M
upload_max_filesize=128M
post_max_size=128M
Expand Down
12 changes: 8 additions & 4 deletions run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
#!/bin/bash

cmd_php="php -S 0.0.0.0:80 -c php.ini -t /www"

wait_for_mysql() {
until mysql --host=$MYSQL_HOST --user=$MYSQL_USER --password=$MYSQL_PASSWORD --execute="USE $MYSQL_DATABASE;" &>/dev/null; do
echo "waiting for mysql to start..."
Expand Down Expand Up @@ -30,7 +28,7 @@ init_config() {
}

init_db() {
$cmd_php &
php -S 127.0.0.1:80 -c php.ini -t /www &
wait_for_php
pid_php=$!
setup_password="s3cr3t";
Expand All @@ -55,4 +53,10 @@ if [ ! -f .initialized ]; then
touch .initialized
fi

$cmd_php

trap 'kill -9 $(jobs -p)' EXIT
trap 'exit' INT TERM

su-exec nobody php -S 0.0.0.0:8000 -c /php.ini -t /www &

wait