From 8c7a8de42415f01d37f35114937f4972fefa46c3 Mon Sep 17 00:00:00 2001 From: Peter Havekes Date: Fri, 28 Aug 2026 15:05:32 +0200 Subject: [PATCH] Rename APACHE_GUID to APACHE_GID. Fixes #42 --- README.md | 7 +++---- apache2-shibboleth/bin/entrypoint.sh | 20 ++++++++++++-------- apache2/bin/entrypoint.sh | 20 ++++++++++++-------- php72-apache2/bin/entrypoint.sh | 18 +++++++++++------- php82-apache2/bin/entrypoint.sh | 18 +++++++++++------- php85-apache2/bin/entrypoint.sh | 18 +++++++++++------- 6 files changed, 60 insertions(+), 41 deletions(-) diff --git a/README.md b/README.md index 28c0865..39dcd13 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,6 @@ We provide the following base containers which can be used in downstream project **Apache 2 with shibboleth**
![Build status for apache2 shibboleth production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-apache2-shibboleth.yaml/badge.svg) - ## PHP 72 images **PROD image:**
@@ -32,11 +31,11 @@ We provide the following base containers which can be used in downstream project ## Features - At every start, the php containers will recreate the symfony cache dir.
-- You can supply the environment variable APACHE_UID. It creates the user "openconext", and starts Apache with that the supplied uid. +- You can supply the environment variables APACHE_UID and APACHE_GID. It creates the user and group "openconext", and starts Apache with the supplied uid and gid. This allows for strict permissions on mounted files. -You need to prefix the uid with a # like so: +You need to prefix the uid/gid with a # like so: ``` -docker run -e APACHE_UID=#1337 ghcr.io/openconext/openconext-basecontainers/php72-apache2:latest +docker run -e APACHE_UID=#1337 -e APACHE_GID=#1337 ghcr.io/openconext/openconext-basecontainers/php72-apache2:latest ``` - You can supply the environment variable "HTTPD_CSP" which will set the CSP header on responses. - You can supply the environment variable TZ to set the timezone on the php82 containers diff --git a/apache2-shibboleth/bin/entrypoint.sh b/apache2-shibboleth/bin/entrypoint.sh index 0012143..56fadb2 100755 --- a/apache2-shibboleth/bin/entrypoint.sh +++ b/apache2-shibboleth/bin/entrypoint.sh @@ -8,7 +8,11 @@ if [[ -v APACHE_RUN_USER ]]; then APACHE_UID=$APACHE_RUN_USER fi if [[ -v APACHE_RUN_GROUP ]]; then - APACHE_GUID=$APACHE_RUN_GROUP + APACHE_GID=$APACHE_RUN_GROUP +fi + +if [[ ! -v APACHE_GID ]] && [[ -v APACHE_GUID ]]; then + APACHE_GID=$APACHE_GUID fi # Read the envars for Apache2 @@ -19,11 +23,11 @@ source /etc/apache2/envvars if [[ -v APACHE_UID ]]; then export APACHE_RUN_USER=$APACHE_UID APACHE_UID_TO_CREATE=$(echo $APACHE_UID | sed 's/#//') - if [[ -v APACHE_GUID ]]; then - export APACHE_RUN_GROUP=$APACHE_GUID - APACHE_GUID_TO_CREATE=$(echo $APACHE_GUID | sed 's/#//') - [ $(getent group openconext) ] || groupadd -g $APACHE_GUID_TO_CREATE openconext - [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GUID_TO_CREATE openconext + if [[ -v APACHE_GID ]]; then + export APACHE_RUN_GROUP=$APACHE_GID + APACHE_GID_TO_CREATE=$(echo $APACHE_GID | sed 's/#//') + [ $(getent group openconext) ] || groupadd -g $APACHE_GID_TO_CREATE openconext + [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GID_TO_CREATE openconext else [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE openconext fi @@ -34,8 +38,8 @@ for dir in \ "$APACHE_RUN_DIR" \ "$APACHE_LOG_DIR"; do if [[ -v APACHE_UID_TO_CREATE ]]; then - if [[ -v APACHE_GUID_TO_CREATE ]]; then - chown "$APACHE_UID_TO_CREATE:$APACHE_GUID_TO_CREATE" "$dir" + if [[ -v APACHE_GID_TO_CREATE ]]; then + chown "$APACHE_UID_TO_CREATE:$APACHE_GID_TO_CREATE" "$dir" else chown "$APACHE_UID_TO_CREATE" "$dir" fi diff --git a/apache2/bin/entrypoint.sh b/apache2/bin/entrypoint.sh index e712ce1..491660c 100755 --- a/apache2/bin/entrypoint.sh +++ b/apache2/bin/entrypoint.sh @@ -8,7 +8,11 @@ if [[ -v APACHE_RUN_USER ]]; then APACHE_UID=$APACHE_RUN_USER fi if [[ -v APACHE_RUN_GROUP ]]; then - APACHE_GUID=$APACHE_RUN_GROUP + APACHE_GID=$APACHE_RUN_GROUP +fi + +if [[ ! -v APACHE_GID ]] && [[ -v APACHE_GUID ]]; then + APACHE_GID=$APACHE_GUID fi # Read the envars for Apache2 @@ -19,11 +23,11 @@ source /etc/apache2/envvars if [[ -v APACHE_UID ]]; then export APACHE_RUN_USER=$APACHE_UID APACHE_UID_TO_CREATE=$(echo $APACHE_UID | sed 's/#//') - if [[ -v APACHE_GUID ]]; then - export APACHE_RUN_GROUP=$APACHE_GUID - APACHE_GUID_TO_CREATE=$(echo $APACHE_GUID | sed 's/#//') - [ $(getent group openconext) ] || groupadd -g $APACHE_GUID_TO_CREATE openconext - [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GUID_TO_CREATE openconext + if [[ -v APACHE_GID ]]; then + export APACHE_RUN_GROUP=$APACHE_GID + APACHE_GID_TO_CREATE=$(echo $APACHE_GID | sed 's/#//') + [ $(getent group openconext) ] || groupadd -g $APACHE_GID_TO_CREATE openconext + [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GID_TO_CREATE openconext else [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE openconext fi @@ -35,8 +39,8 @@ for dir in \ "$APACHE_LOG_DIR" \ ; do \ if [[ -v APACHE_UID_TO_CREATE ]]; then - if [[ -v APACHE_GUID_TO_CREATE ]]; then - chown -R "$APACHE_UID_TO_CREATE:$APACHE_GUID_TO_CREATE" "$dir"; + if [[ -v APACHE_GID_TO_CREATE ]]; then + chown -R "$APACHE_UID_TO_CREATE:$APACHE_GID_TO_CREATE" "$dir"; else chown -R "$APACHE_UID_TO_CREATE" "$dir"; fi diff --git a/php72-apache2/bin/entrypoint.sh b/php72-apache2/bin/entrypoint.sh index 25b5dcf..04f92cc 100755 --- a/php72-apache2/bin/entrypoint.sh +++ b/php72-apache2/bin/entrypoint.sh @@ -4,16 +4,20 @@ set +e # Read the envars for Apache2 source /etc/apache2/envvars +if [[ ! -v APACHE_GID ]] && [[ -v APACHE_GUID ]]; then + APACHE_GID=$APACHE_GUID +fi + # Run as an arbitrary user / group if the user asked for one. It needs # to be created first and stripped of the leading # if [[ -v APACHE_UID ]]; then export APACHE_RUN_USER=$APACHE_UID APACHE_UID_TO_CREATE=$(echo $APACHE_UID | sed 's/#//') - if [[ -v APACHE_GUID ]]; then - export APACHE_RUN_GROUP=$APACHE_GUID - APACHE_GUID_TO_CREATE=$(echo $APACHE_GUID | sed 's/#//') - [ $(getent group openconext) ] || groupadd -g $APACHE_GUID_TO_CREATE openconext - [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GUID_TO_CREATE openconext + if [[ -v APACHE_GID ]]; then + export APACHE_RUN_GROUP=$APACHE_GID + APACHE_GID_TO_CREATE=$(echo $APACHE_GID | sed 's/#//') + [ $(getent group openconext) ] || groupadd -g $APACHE_GID_TO_CREATE openconext + [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GID_TO_CREATE openconext else [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE openconext fi @@ -41,8 +45,8 @@ fi for dir in "${apache_dirs[@]}"; do if [[ -v APACHE_UID_TO_CREATE ]]; then - if [[ -v APACHE_GUID_TO_CREATE ]]; then - chown -R "$APACHE_UID_TO_CREATE:$APACHE_GUID_TO_CREATE" "$dir" + if [[ -v APACHE_GID_TO_CREATE ]]; then + chown -R "$APACHE_UID_TO_CREATE:$APACHE_GID_TO_CREATE" "$dir" else chown -R "$APACHE_UID_TO_CREATE" "$dir" fi diff --git a/php82-apache2/bin/entrypoint.sh b/php82-apache2/bin/entrypoint.sh index 42d1e83..af7202b 100755 --- a/php82-apache2/bin/entrypoint.sh +++ b/php82-apache2/bin/entrypoint.sh @@ -4,16 +4,20 @@ set +e # Read the envars for Apache2 source /etc/apache2/envvars +if [[ ! -v APACHE_GID ]] && [[ -v APACHE_GUID ]]; then + APACHE_GID=$APACHE_GUID +fi + # Run as an arbitrary user / group if the user asked for one. It needs # to be created first and stripped of the leading # if [[ -v APACHE_UID ]]; then export APACHE_RUN_USER=$APACHE_UID APACHE_UID_TO_CREATE=$(echo $APACHE_UID | sed 's/#//') - if [[ -v APACHE_GUID ]]; then - export APACHE_RUN_GROUP=$APACHE_GUID - APACHE_GUID_TO_CREATE=$(echo $APACHE_GUID | sed 's/#//') - [ $(getent group openconext) ] || groupadd -g $APACHE_GUID_TO_CREATE openconext - [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GUID_TO_CREATE openconext + if [[ -v APACHE_GID ]]; then + export APACHE_RUN_GROUP=$APACHE_GID + APACHE_GID_TO_CREATE=$(echo $APACHE_GID | sed 's/#//') + [ $(getent group openconext) ] || groupadd -g $APACHE_GID_TO_CREATE openconext + [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GID_TO_CREATE openconext else [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE openconext fi @@ -37,8 +41,8 @@ fi for dir in "${apache_dirs[@]}"; do if [[ -v APACHE_UID_TO_CREATE ]]; then - if [[ -v APACHE_GUID_TO_CREATE ]]; then - chown -R "$APACHE_UID_TO_CREATE:$APACHE_GUID_TO_CREATE" "$dir" + if [[ -v APACHE_GID_TO_CREATE ]]; then + chown -R "$APACHE_UID_TO_CREATE:$APACHE_GID_TO_CREATE" "$dir" else chown -R "$APACHE_UID_TO_CREATE" "$dir" fi diff --git a/php85-apache2/bin/entrypoint.sh b/php85-apache2/bin/entrypoint.sh index 42d1e83..af7202b 100755 --- a/php85-apache2/bin/entrypoint.sh +++ b/php85-apache2/bin/entrypoint.sh @@ -4,16 +4,20 @@ set +e # Read the envars for Apache2 source /etc/apache2/envvars +if [[ ! -v APACHE_GID ]] && [[ -v APACHE_GUID ]]; then + APACHE_GID=$APACHE_GUID +fi + # Run as an arbitrary user / group if the user asked for one. It needs # to be created first and stripped of the leading # if [[ -v APACHE_UID ]]; then export APACHE_RUN_USER=$APACHE_UID APACHE_UID_TO_CREATE=$(echo $APACHE_UID | sed 's/#//') - if [[ -v APACHE_GUID ]]; then - export APACHE_RUN_GROUP=$APACHE_GUID - APACHE_GUID_TO_CREATE=$(echo $APACHE_GUID | sed 's/#//') - [ $(getent group openconext) ] || groupadd -g $APACHE_GUID_TO_CREATE openconext - [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GUID_TO_CREATE openconext + if [[ -v APACHE_GID ]]; then + export APACHE_RUN_GROUP=$APACHE_GID + APACHE_GID_TO_CREATE=$(echo $APACHE_GID | sed 's/#//') + [ $(getent group openconext) ] || groupadd -g $APACHE_GID_TO_CREATE openconext + [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE -g $APACHE_GID_TO_CREATE openconext else [ $(getent passwd openconext) ] || useradd -M -u $APACHE_UID_TO_CREATE openconext fi @@ -37,8 +41,8 @@ fi for dir in "${apache_dirs[@]}"; do if [[ -v APACHE_UID_TO_CREATE ]]; then - if [[ -v APACHE_GUID_TO_CREATE ]]; then - chown -R "$APACHE_UID_TO_CREATE:$APACHE_GUID_TO_CREATE" "$dir" + if [[ -v APACHE_GID_TO_CREATE ]]; then + chown -R "$APACHE_UID_TO_CREATE:$APACHE_GID_TO_CREATE" "$dir" else chown -R "$APACHE_UID_TO_CREATE" "$dir" fi