mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-08-14 00:52:29 +02:00
94f59489f0
Reported: on upgrade from an existing 7.17.9 install, the add-on failed to start with "mv: cannot move '/data/config' to '/data/config.bak-7.17.9': Permission denied". Root cause: a previous fix in this same release restored `USER 1000:0` at the end of the Dockerfile to match the upstream base image's own final USER directive. But the upstream 8.19 entrypoint no longer drops privileges itself (confirmed: it execs elasticsearch directly, no gosu/chroot dance), and existing installs have /data owned by root (7.17.9's default image variant runs fully as root). A non-root container can never chown or move that data. Revert to root at runtime, matching how this add-on always ran and matching its own AppArmor profile (chown, setuid, setgid, sys_chroot, mount capabilities — all meaningless for a non-root process anyway). Root stays required for the build-time entrypoint patch too, unchanged from the prior fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
150 lines
5.1 KiB
Docker
150 lines
5.1 KiB
Docker
#============================#
|
|
# ALEXBELGIUM'S DOCKERFILE #
|
|
#============================#
|
|
# _.------.
|
|
# _.-` ('>.-`"""-.
|
|
# '.--'` _'` _ .--.)
|
|
# -' '-.-';` `
|
|
# ' - _.' ``'--.
|
|
# '---` .-'""`
|
|
# /`
|
|
#=== Home Assistant Addon ===#
|
|
|
|
#################
|
|
# 1 Build Image #
|
|
#################
|
|
|
|
ARG BUILD_UPSTREAM="8.19.18"
|
|
FROM elasticsearch:$BUILD_UPSTREAM
|
|
|
|
# The base image ends as USER 1000:0 with a root-owned, read-only (0555)
|
|
# entrypoint; switch back to root for the remaining build steps (entrypoint
|
|
# patch, package install, chmod), then restore the Elasticsearch user below
|
|
USER root
|
|
|
|
##################
|
|
# 2 Modify Image #
|
|
##################
|
|
|
|
# Set S6 wait time
|
|
ENV S6_CMD_WAIT_FOR_SERVICES=1 \
|
|
S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
|
|
S6_SERVICES_GRACETIME=0
|
|
|
|
# Expose the upstream version to the add-on init script (migration guard)
|
|
ARG BUILD_UPSTREAM
|
|
ENV UPSTREAM_VERSION="$BUILD_UPSTREAM"
|
|
|
|
# Data persistence & migration: source the add-on init script at the top of
|
|
# the official entrypoint (pattern-anchored; ingest-attachment is bundled
|
|
# since ES 8.0 so no plugin install is needed anymore)
|
|
RUN sed -i '/^set -e$/a . /usr/local/bin/addon-init.sh' /usr/local/bin/docker-entrypoint.sh \
|
|
&& grep -q "addon-init.sh" /usr/local/bin/docker-entrypoint.sh
|
|
|
|
##################
|
|
# 3 Install apps #
|
|
##################
|
|
|
|
# Copy local files
|
|
COPY rootfs/ /
|
|
RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
|
|
|
|
# Uses /bin for compatibility purposes
|
|
# hadolint ignore=DL4005
|
|
RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
|
|
if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
|
|
|
|
# Modules
|
|
ARG MODULES="00-banner.sh 01-custom_script.sh"
|
|
|
|
# Automatic modules download
|
|
COPY ha_automodules.sh /ha_automodules.sh
|
|
RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
|
|
|
|
# Manual apps
|
|
ENV PACKAGES="jq"
|
|
|
|
# Automatic apps & bashio
|
|
COPY ha_autoapps.sh /ha_autoapps.sh
|
|
RUN chmod 744 /ha_autoapps.sh && /ha_autoapps.sh "$PACKAGES" && rm /ha_autoapps.sh
|
|
|
|
################
|
|
# 4 Entrypoint #
|
|
################
|
|
|
|
# Add entrypoint
|
|
ENV S6_STAGE2_HOOK=/ha_entrypoint.sh
|
|
COPY ha_entrypoint.sh /ha_entrypoint.sh
|
|
RUN chmod 777 /ha_entrypoint.sh
|
|
|
|
# Install bashio
|
|
COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
|
|
RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
|
|
|
|
############
|
|
# 5 Labels #
|
|
############
|
|
|
|
ARG BUILD_ARCH
|
|
ARG BUILD_DATE
|
|
ARG BUILD_DESCRIPTION
|
|
ARG BUILD_NAME
|
|
ARG BUILD_REF
|
|
ARG BUILD_REPOSITORY
|
|
ARG BUILD_VERSION
|
|
ENV BUILD_VERSION="${BUILD_VERSION}"
|
|
LABEL \
|
|
io.hass.name="${BUILD_NAME}" \
|
|
io.hass.description="${BUILD_DESCRIPTION}" \
|
|
io.hass.arch="${BUILD_ARCH}" \
|
|
io.hass.type="addon" \
|
|
io.hass.version=${BUILD_VERSION} \
|
|
maintainer="alexbelgium (https://github.com/alexbelgium)" \
|
|
org.opencontainers.image.title="${BUILD_NAME}" \
|
|
org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
|
|
org.opencontainers.image.vendor="Home Assistant Add-ons" \
|
|
org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
|
|
org.opencontainers.image.licenses="MIT" \
|
|
org.opencontainers.image.url="https://github.com/alexbelgium" \
|
|
org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
|
|
org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
|
|
org.opencontainers.image.created=${BUILD_DATE} \
|
|
org.opencontainers.image.revision=${BUILD_REF} \
|
|
org.opencontainers.image.version=${BUILD_VERSION}
|
|
|
|
#################
|
|
# 6 Healthcheck #
|
|
#################
|
|
|
|
# Avoid spamming logs
|
|
# hadolint ignore=SC2016
|
|
RUN \
|
|
# Handle Apache configuration
|
|
if [ -d /etc/apache2/sites-available ]; then \
|
|
for file in /etc/apache2/sites-*/*.conf; do \
|
|
sed -i '/<VirtualHost/a \ \n # Match requests with the custom User-Agent "HealthCheck" \n SetEnvIf User-Agent "HealthCheck" dontlog \n # Exclude matching requests from access logs \n CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog' "$file"; \
|
|
done; \
|
|
fi && \
|
|
\
|
|
# Handle Nginx configuration
|
|
if [ -f /etc/nginx/nginx.conf ]; then \
|
|
awk '/http \{/{print; print "map $http_user_agent $dontlog {\n default 0;\n \"~*HealthCheck\" 1;\n}\naccess_log /var/log/nginx/access.log combined if=$dontlog;"; next}1' /etc/nginx/nginx.conf > /etc/nginx/nginx.conf.new && \
|
|
mv /etc/nginx/nginx.conf.new /etc/nginx/nginx.conf; \
|
|
fi
|
|
|
|
ENV HEALTH_PORT="9200" \
|
|
HEALTH_URL=""
|
|
HEALTHCHECK \
|
|
--interval=5s \
|
|
--retries=5 \
|
|
--start-period=30s \
|
|
--timeout=25s \
|
|
CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
|
|
|
|
# Stay root at runtime: addon-init.sh must chown/mv pre-existing /data
|
|
# content that may be owned by root from earlier installs, and the upstream
|
|
# entrypoint no longer drops privileges itself, so a non-root container
|
|
# can't touch that data at all. This matches the addon's own AppArmor
|
|
# profile (chown, setuid, setgid, sys_chroot, mount capabilities), which
|
|
# assumes a root process.
|