Issue-ID: AAI-3588
Signed-off-by: Rommel Pawar <rommel.pawar@bell.ca>
Change-Id: Ibab655238c915c83b8a5b4a29cd5a4c1a3f19a0b
-FROM haproxy:1.7.10-alpine
+FROM haproxy:2.4.13-alpine
# For building the image in a proxy environment if necessary
ARG HTTP_PROXY
# For building the image in a proxy environment if necessary
ARG HTTP_PROXY
ENV http_proxy ${HTTP_PROXY}
ENV https_proxy ${HTTPS_PROXY}
ENV http_proxy ${HTTP_PROXY}
ENV https_proxy ${HTTPS_PROXY}
+# Added to execute commands which required root permission
+USER root
+
RUN apk add --no-cache \
ca-certificates \
curl \
RUN apk add --no-cache \
ca-certificates \
curl \
openssl \
shadow \
util-linux && \
openssl \
shadow \
util-linux && \
- groupadd haproxy -g 1000 && \
- adduser -u 1000 -S -D -G haproxy -s /bin/bash haproxy && \
chown -R haproxy:haproxy /usr/local/etc/haproxy
RUN mkdir -p /etc/ssl/certs/ && mkdir -p /etc/ssl/private
chown -R haproxy:haproxy /usr/local/etc/haproxy
RUN mkdir -p /etc/ssl/certs/ && mkdir -p /etc/ssl/private
COPY --chown=haproxy resolvers.conf /usr/local/etc/haproxy/resolvers.conf
COPY --chown=haproxy haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
COPY --chown=haproxy resolvers.conf /usr/local/etc/haproxy/resolvers.conf
COPY --chown=haproxy haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
-RUN chmod +x /docker-entrypoint.sh
+# Changing group and group permission to allow haproxy user to execute sed comamnd ot change files
+RUN chgrp haproxy /usr/local/etc/haproxy; \
+ chgrp haproxy /docker-entrypoint.sh /usr/local/etc/haproxy/haproxy.cfg /usr/local/etc/haproxy/resolvers.conf
+
+RUN chmod +x /docker-entrypoint.sh; \
+ chmod g+wx /usr/local/etc/haproxy; \
+ chmod g+w /docker-entrypoint.sh /usr/local/etc/haproxy/haproxy.cfg /usr/local/etc/haproxy/resolvers.conf
+
+# Reverting to haproxy use to not run the pod with root permissions
USER haproxy
ENTRYPOINT [ "/docker-entrypoint.sh" ]
USER haproxy
ENTRYPOINT [ "/docker-entrypoint.sh" ]
}
if [ "$1" = 'haproxy' ]; then
}
if [ "$1" = 'haproxy' ]; then
- # if the user wants "haproxy", let's use "haproxy-systemd-wrapper" instead so we can have proper reloadability implemented by upstream
- shift # "haproxy"
- set -- "$(which haproxy-systemd-wrapper)" -p /usr/local/etc/haproxy/haproxy.pid "$@"
+ shift # "haproxy"
+ # if the user wants "haproxy", let's add a couple useful flags
+ # -W -- "master-worker mode" (similar to the old "haproxy-systemd-wrapper"; allows for reload via "SIGUSR2")
+ # -db -- disables background mode
+ set -- haproxy -W -db "$@"