Commit Graph

16 Commits (4f53b35bcb9af1a2978d9524b4da6f8c0b88d804)

Author SHA1 Message Date
Pierre Prinetti 801d519165 docker: Fix the comments about settings.json copy
The "conditional copy trick" was removed in #3644, but I failed to
update the corresponding comment.
2019-10-25 19:26:10 +02:00
Pierre Prinetti eea99fe507 docker: Run as unprivileged user
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes https://github.com/ether/etherpad-lite/issues/3629
2019-10-24 11:29:19 +02:00
muxator bf7c7241fc docker: base our image on 10-buster-slim instead of buster-slim
A Docker base image without version is a bit of a moving target. Buster-slim,
for example, is currently based on nodejs 12.

For now, let's base our official Docker image on nodejs 10 (an LTS, non at End
of Life, which we explicitly mention in the documentation).

Amends a9a3bf9bd2 and the corresponding PR #3646.
2019-10-22 22:47:40 +02:00
Pierre Prinetti 6d9264cf3c docker: enable environment variables settings by default
By leveraging the templating mechanism in `settings.json`, this change allows a
Docker client to run a prebuilt image and change some basic configuration
settings, like the instance name or, more importantly, the database
coordinates.

By default, the image runs witho no administrative user enabled. If a value is
given to ADMIN_PASSWORD, the `admin` user will be activated.

Also closes https://github.com/ether/etherpad-lite/issues/3623

---
Modified by muxator to support conditional user activation at runtime.
2019-10-19 02:39:20 +02:00
Stefan Schwarz 070a5fd74f remove npm cache from image 2019-10-08 19:51:11 +02:00
Stefan Schwarz a9a3bf9bd2 use buster slim 2019-10-08 19:51:11 +02:00
Lars Olafsen 1789129b35 NODE_ENV controls run-time behaviour, thus needs to be set by ENV 2019-08-08 21:53:47 +02:00
muxator 4582f9daeb docker: support including plugins in custom builds.
This commit introduces the support for the ETHERPAD_PLUGINS build parameter,
which contains a list of plugins to be installed while building the container.

EXAMPLE:
  docker build --build-arg ETHERPAD_PLUGINS="ep_codepad ep_author_neat" --tag <YOUR_USERNAME>/etherpad .

Resolves #3618.
2019-07-16 14:14:34 +02:00
muxator b5ac653cbc docker: reorganized the README, same infos
This is in preparation for the next commit, which will introduce support for
custom builds with plugins.
2019-07-16 14:14:34 +02:00
muxator e8e2284884 docker: move WORKDIR as on top as possible.
WORKDIR is also valid at build time, thus it makes sense to move it as towards
the top as possible.
This will come in hand in the next commits, when we will introduce support for
installing plugins while building the container.

Source: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#workdir

    [...] you should use WORKDIR instead of proliferating instructions like
         RUN cd … && do-something,
    which are hard to read, troubleshoot, and maintain.
2019-07-16 14:14:34 +02:00
Samuel Lelièvre aca1640fdf Fix typos in docker/Dockerfile
Fix "one" -> "done", and add missing closing parenthesis.
2019-04-01 12:28:14 +02:00
Adrien le Maire c1321f5b14 remove devdeps from prod builds 2019-03-29 17:52:06 +01:00
Eddie Barraco 7433d749f0 docker: remove supervisord from the Docker image
Supervision/management should not be done from inside the container, but
externally, by container managers.
The container now simply runs node on server.js.

The logs are now readable from docker logs <container_name>.
2019-03-21 23:52:35 +01:00
muxator 2955740a6e Settings.js: support syntax for default values
+---------------------------+---------------+------------------+
| Configuration string in   | Value of      | Resulting confi- |
| settings.json             | ENV_VAR       | guration value   |
|---------------------------|---------------|------------------|
| "${ENV_VAR}"              | "some_string" | "some_string"    |
| "${ENV_VAR}"              | "9001"        | 9001             |
| "${ENV_VAR}"              | undefined     | null             |
| "${ENV_VAR:some_default}" | "some_string" | "some_string"    |
| "${ENV_VAR:some_default}" | undefined     | "some_default"   |
+---------------------------+---------------+------------------+

Mention this briefly in the main README.md, also.

Closes #3578.
2019-03-21 23:32:08 +01:00
muxator 6d400050a3 Settings.js: support configuration via environment variables.
All the configuration values can be read from environment variables using the
syntax "${ENV_VAR_NAME}".
This is useful, for example, when running in a Docker container.

EXAMPLE:
   "port":     "${PORT}"
   "minify":   "${MINIFY}"
   "skinName": "${SKIN_NAME}"

Would read the configuration values for those items from the environment
variables PORT, MINIFY and SKIN_NAME.

REMARKS:
Please note that a variable substitution always needs to be quoted.
   "port":   9001,          <-- Literal values. When not using substitution,
   "minify": false              only strings must be quoted: booleans and
   "skin":   "colibris"         numbers must not.

   "port":   ${PORT}        <-- ERROR: this is not valid json
   "minify": ${MINIFY}
   "skin":   ${SKIN_NAME}

   "port":   "${PORT}"      <-- CORRECT: if you want to use a variable
   "minify": "${MINIFY}"        substitution, put quotes around its name,
   "skin":   "${SKIN_NAME}"     even if the required value is a number or a
                                boolean.
                                Etherpad will take care of rewriting it to
                                the proper type if necessary.

Resolves #3543
2019-03-11 08:11:30 +01:00
muxator bf68666ae1 docker: move the docker image creation inside the main repository
This is a super simple start.
At minimum, configuration via environment variables (see #3543) needs to be
integrated in Etherpad to make this user-friendly.

Resolves #3524.
2019-03-08 01:38:36 +01:00