7aae7c3788
Due to the execution of profile files when running /exec, it was possible to get into a state where files owned by root would exist in a built herokuish image. We now instead chown the files directly, which ensures profile files only get executed at runtime. Closes gliderlabs/herokuish#1212 Refs dokku/dokku#6851
9 lines
335 B
Docker
9 lines
335 B
Docker
ARG APP_IMAGE
|
|
FROM $APP_IMAGE
|
|
|
|
ARG DOKKU_APP_USER herokuishuser
|
|
COPY --chown=$DOKKU_APP_USER 00-global-env.sh 01-app-env.sh /app/.profile.d/
|
|
RUN find "/app" \( \! -user "$DOKKU_APP_USER" -o \! -group "$DOKKU_APP_USER" \) -print0 | xargs -0 -r chown "$DOKKU_APP_USER:$DOKKU_APP_USER"
|
|
USER $DOKKU_APP_USER
|
|
ENV HEROKUISH_SETUIDGUID false
|