restore gosu suid bit when supervisor container stops

docker/base/alpine/conf/bin/config.sh

@@ -68,37 +68,46 @@ function deprecationNotice() {
 
 ###
  # Run "entrypoint" scripts
+ #
  ##
 function runEntrypoints() {
-    ###############
-    # Try to find entrypoint
-    ###############
-
+    # try to find entrypoint task script
     ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
-
-    if [ -f "$ENTRYPOINT_SCRIPT" ]; then
-        . "$ENTRYPOINT_SCRIPT"
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        # use default
+        ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
     fi
 
-    ###############
-    # Run default
-    ###############
-    if [ -f "/opt/docker/bin/entrypoint.d/default.sh" ]; then
-        . /opt/docker/bin/entrypoint.d/default.sh
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        exit 1
     fi
 
-    exit 1
+    . "$ENTRYPOINT_SCRIPT"
 }
 
+###
  # Run "entrypoint" provisioning
+ #
  ##
 function runProvisionEntrypoint() {
     includeScriptDir "/opt/docker/provision/entrypoint.d"
     includeScriptDir "/entrypoint.d"
 }
 
+###
+ # https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
+ # https://hynek.me/articles/docker-signals/
+ #
+ ##
+function runTeardownEntrypoint() {
+    echo "Container stopped, performing teardown..."
+    includeScriptDir "/opt/docker/provision/entrypoint.d/teardown"
+    includeScriptDir "/entrypoint.d/teardown"
+}
+
 ###
  # List environment variables (based on prefix)
+ #
  ##
 function envListVars() {
     if [[ $# -eq 1 ]]; then

docker/base/alpine/conf/bin/entrypoint.d/cli.sh

@@ -5,13 +5,13 @@
 #############################################
 
 if [ -n "${CLI_SCRIPT}" ]; then
-    if [ -n "$APPLICATION_USER" ]; then
+    if [ -n "${CONTAINER_UID}" ]; then
         # Run as EFFECTIVE_USER
         shift
-        exec gosu "${APPLICATION_USER}" ${CLI_SCRIPT} "$@"
+        exec gosu "${CONTAINER_UID}" "${CLI_SCRIPT}" "$@"
     else
         # Run as root
-        exec ${CLI_SCRIPT} "$@"
+        exec "${CLI_SCRIPT}" "$@"
     fi
 else
     echo "[ERROR] No CLI_SCRIPT in in docker environment defined"

docker/base/alpine/conf/bin/entrypoint.sh

@@ -1,46 +1,35 @@
 #!/usr/bin/env bash
 
 if [[ -z "$CONTAINER_UID" ]]; then
-    export CONTAINER_UID="application"
+    export CONTAINER_UID=1000
 fi
 
-set -o pipefail  # trace ERR through pipes
-set -o errtrace  # trace ERR through 'time command' and other functions
-set -o nounset   ## set -u : exit the script if you try to use an uninitialised variable
-set -o errexit   ## set -e : exit the script if any statement returns a non-true return value
+set -o pipefail # trace ERR through pipes
+set -o errtrace # trace ERR through 'time command' and other functions
+set -o nounset  ## set -u : exit the script if you try to use an uninitialised variable
+set -o errexit  ## set -e : exit the script if any statement returns a non-true return value
 
 # auto elevate privileges (if container is not started as root)
 if [[ "$UID" -ne 0 ]]; then
     export CONTAINER_UID="$UID"
     exec gosu root "$0" "$@"
 fi
-# remove suid bit on gosu
-chmod -s /sbin/gosu
-
-trap 'echo sigterm ; exit' SIGTERM
-trap 'echo sigkill ; exit' SIGKILL
-
-# sanitize input and set task
-TASK="$(echo $1| sed 's/[^-_a-zA-Z0-9]*//g')"
-
-source /opt/docker/bin/config.sh
 
+. /opt/docker/bin/config.sh
 createDockerStdoutStderr
 
-if [[ "$UID" -eq 0 ]]; then
-    # Only run provision if user is root
-
-    if [ "$TASK" == "supervisord" -o "$TASK" == "noop" ]; then
-        # Visible provisioning
-        runProvisionEntrypoint
-    else
-        # Hidden provisioning
-        runProvisionEntrypoint  > /dev/null
-    fi
+# sanitize input and set task
+TASK="$(echo $1 | sed 's/[^-_a-zA-Z0-9]*//g')"
+
+if [ "$TASK" == "supervisord" ] || [ "$TASK" == "noop" ]; then
+    # visible provisioning
+    runProvisionEntrypoint
+    trap 'runTeardownEntrypoint' SIGTERM
+    runEntrypoints "$@" &
+    wait $!
+    runTeardownEntrypoint
+else
+    # hidden provisioning
+    runProvisionEntrypoint > /dev/null
+    runEntrypoints "$@"
 fi
-
-#############################
-## COMMAND
-#############################
-
-runEntrypoints "$@"

docker/base/centos-7/conf/bin/config.sh

@@ -68,37 +68,46 @@ function deprecationNotice() {
 
 ###
  # Run "entrypoint" scripts
+ #
  ##
 function runEntrypoints() {
-    ###############
-    # Try to find entrypoint
-    ###############
-
+    # try to find entrypoint task script
     ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
-
-    if [ -f "$ENTRYPOINT_SCRIPT" ]; then
-        . "$ENTRYPOINT_SCRIPT"
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        # use default
+        ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
     fi
 
-    ###############
-    # Run default
-    ###############
-    if [ -f "/opt/docker/bin/entrypoint.d/default.sh" ]; then
-        . /opt/docker/bin/entrypoint.d/default.sh
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        exit 1
     fi
 
-    exit 1
+    . "$ENTRYPOINT_SCRIPT"
 }
 
+###
  # Run "entrypoint" provisioning
+ #
  ##
 function runProvisionEntrypoint() {
     includeScriptDir "/opt/docker/provision/entrypoint.d"
     includeScriptDir "/entrypoint.d"
 }
 
+###
+ # https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
+ # https://hynek.me/articles/docker-signals/
+ #
+ ##
+function runTeardownEntrypoint() {
+    echo "Container stopped, performing teardown..."
+    includeScriptDir "/opt/docker/provision/entrypoint.d/teardown"
+    includeScriptDir "/entrypoint.d/teardown"
+}
+
 ###
  # List environment variables (based on prefix)
+ #
  ##
 function envListVars() {
     if [[ $# -eq 1 ]]; then

docker/base/centos-7/conf/bin/entrypoint.d/cli.sh

@@ -5,13 +5,13 @@
 #############################################
 
 if [ -n "${CLI_SCRIPT}" ]; then
-    if [ -n "$APPLICATION_USER" ]; then
+    if [ -n "${CONTAINER_UID}" ]; then
         # Run as EFFECTIVE_USER
         shift
-        exec gosu "${APPLICATION_USER}" ${CLI_SCRIPT} "$@"
+        exec gosu "${CONTAINER_UID}" "${CLI_SCRIPT}" "$@"
     else
         # Run as root
-        exec ${CLI_SCRIPT} "$@"
+        exec "${CLI_SCRIPT}" "$@"
     fi
 else
     echo "[ERROR] No CLI_SCRIPT in in docker environment defined"

docker/base/centos-7/conf/bin/entrypoint.sh

@@ -1,46 +1,35 @@
 #!/usr/bin/env bash
 
 if [[ -z "$CONTAINER_UID" ]]; then
-    export CONTAINER_UID="application"
+    export CONTAINER_UID=1000
 fi
 
-set -o pipefail  # trace ERR through pipes
-set -o errtrace  # trace ERR through 'time command' and other functions
-set -o nounset   ## set -u : exit the script if you try to use an uninitialised variable
-set -o errexit   ## set -e : exit the script if any statement returns a non-true return value
+set -o pipefail # trace ERR through pipes
+set -o errtrace # trace ERR through 'time command' and other functions
+set -o nounset  ## set -u : exit the script if you try to use an uninitialised variable
+set -o errexit  ## set -e : exit the script if any statement returns a non-true return value
 
 # auto elevate privileges (if container is not started as root)
 if [[ "$UID" -ne 0 ]]; then
     export CONTAINER_UID="$UID"
     exec gosu root "$0" "$@"
 fi
-# remove suid bit on gosu
-chmod -s /sbin/gosu
-
-trap 'echo sigterm ; exit' SIGTERM
-trap 'echo sigkill ; exit' SIGKILL
-
-# sanitize input and set task
-TASK="$(echo $1| sed 's/[^-_a-zA-Z0-9]*//g')"
-
-source /opt/docker/bin/config.sh
 
+. /opt/docker/bin/config.sh
 createDockerStdoutStderr
 
-if [[ "$UID" -eq 0 ]]; then
-    # Only run provision if user is root
-
-    if [ "$TASK" == "supervisord" -o "$TASK" == "noop" ]; then
-        # Visible provisioning
-        runProvisionEntrypoint
-    else
-        # Hidden provisioning
-        runProvisionEntrypoint  > /dev/null
-    fi
+# sanitize input and set task
+TASK="$(echo $1 | sed 's/[^-_a-zA-Z0-9]*//g')"
+
+if [ "$TASK" == "supervisord" ] || [ "$TASK" == "noop" ]; then
+    # visible provisioning
+    runProvisionEntrypoint
+    trap 'runTeardownEntrypoint' SIGTERM
+    runEntrypoints "$@" &
+    wait $!
+    runTeardownEntrypoint
+else
+    # hidden provisioning
+    runProvisionEntrypoint > /dev/null
+    runEntrypoints "$@"
 fi
-
-#############################
-## COMMAND
-#############################
-
-runEntrypoints "$@"

docker/base/debian-10/conf/bin/config.sh

@@ -68,37 +68,46 @@ function deprecationNotice() {
 
 ###
  # Run "entrypoint" scripts
+ #
  ##
 function runEntrypoints() {
-    ###############
-    # Try to find entrypoint
-    ###############
-
+    # try to find entrypoint task script
     ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/${TASK}.sh"
-
-    if [ -f "$ENTRYPOINT_SCRIPT" ]; then
-        . "$ENTRYPOINT_SCRIPT"
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        # use default
+        ENTRYPOINT_SCRIPT="/opt/docker/bin/entrypoint.d/default.sh"
     fi
 
-    ###############
-    # Run default
-    ###############
-    if [ -f "/opt/docker/bin/entrypoint.d/default.sh" ]; then
-        . /opt/docker/bin/entrypoint.d/default.sh
+    if [ ! -f "$ENTRYPOINT_SCRIPT" ]; then
+        exit 1
     fi
 
-    exit 1
+    . "$ENTRYPOINT_SCRIPT"
 }
 
+###
  # Run "entrypoint" provisioning
+ #
  ##
 function runProvisionEntrypoint() {
     includeScriptDir "/opt/docker/provision/entrypoint.d"
     includeScriptDir "/entrypoint.d"
 }
 
+###
+ # https://stackoverflow.com/questions/41451159/how-to-execute-a-script-when-i-terminate-a-docker-container
+ # https://hynek.me/articles/docker-signals/
+ #
+ ##
+function runTeardownEntrypoint() {
+    echo "Container stopped, performing teardown..."
+    includeScriptDir "/opt/docker/provision/entrypoint.d/teardown"
+    includeScriptDir "/entrypoint.d/teardown"
+}
+
 ###
  # List environment variables (based on prefix)
+ #
  ##
 function envListVars() {
     if [[ $# -eq 1 ]]; then

docker/base/debian-10/conf/bin/entrypoint.d/cli.sh

@@ -5,13 +5,13 @@
 #############################################
 
 if [ -n "${CLI_SCRIPT}" ]; then
-    if [ -n "$APPLICATION_USER" ]; then
+    if [ -n "${CONTAINER_UID}" ]; then
         # Run as EFFECTIVE_USER
         shift
-        exec gosu "${APPLICATION_USER}" ${CLI_SCRIPT} "$@"
+        exec gosu "${CONTAINER_UID}" "${CLI_SCRIPT}" "$@"
     else
         # Run as root
-        exec ${CLI_SCRIPT} "$@"
+        exec "${CLI_SCRIPT}" "$@"
     fi
 else
     echo "[ERROR] No CLI_SCRIPT in in docker environment defined"