Add gosu and run agent under dedicated user

JetBrains · May 3, 2018 · 05f389b · 05f389b
1 parent c920b9c
commit 05f389b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/run-agent.sh b/run-agent.sh
@@ -66,7 +66,7 @@ else
    prepare_conf
 fi
 
-${AGENT_DIST}/bin/agent.sh start
+gosu buildagent ${AGENT_DIST}/bin/agent.sh start
 
 while [ ! -f ${LOG_DIR}/teamcity-agent.log ];
 do

diff --git a/ubuntu/Dockerfile b/ubuntu/Dockerfile
@@ -14,6 +14,19 @@ COPY dist/buildagent /opt/buildagent
 RUN useradd -m buildagent && \
     chmod +x /run-agent.sh /run-services.sh && sync
 
+ENV GOSU_VERSION 1.10
+RUN set -x \
+    && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
+    && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
+    && export GNUPGHOME="$(mktemp -d)" \
+    && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
+    && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
+    && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
+    && chmod +x /usr/local/bin/gosu \
+    && gosu nobody true
+
+RUN chown -R buildagent:buildagent /opt/buildagent
+
 CMD ["/run-services.sh"]
 
 EXPOSE 9090