Commit 4e905ad4 authored by Luca Cinquini's avatar Luca Cinquini
Browse files

Running Tomcat as non-root user.

parent 321435f5
Loading
Loading
Loading
Loading
+9 −3
Original line number Diff line number Diff line
@@ -16,7 +16,8 @@ RUN mkdir -p /usr/local/tomcat/webapps/esg-orp
ADD $ESGF_REPO/dist/devel/esg-orp/esg-orp.war /usr/local/tomcat/webapps/esg-orp/
RUN cd /usr/local/tomcat/webapps/esg-orp && \
    jar xvf esg-orp.war && \
    rm esg-orp.war
    rm esg-orp.war && \
    chown -R tomcat:tomcat /usr/local/tomcat/webapps/esg-orp

# properties to read the Tomcat kesytore, used to sign the authentication cookie
# these values are the same for all ESGF nodes
@@ -28,7 +29,8 @@ RUN mkdir -p /usr/local/tomcat/webapps/thredds
ADD $ESGF_REPO/dist/devel/thredds/5.0/5.0.0/thredds.war /usr/local/tomcat/webapps/thredds/
RUN cd /usr/local/tomcat/webapps/thredds && \
    jar xvf thredds.war && \
    rm thredds.war
    rm thredds.war && \
    chown -R tomcat:tomcat /usr/local/tomcat/webapps/thredds

# TDS memory configuration
COPY thredds/conf/threddsConfig.xml /esg/content/thredds/threddsConfig.xml
@@ -49,5 +51,9 @@ RUN chmod +x /usr/local/bin/change_data_node_password.sh
# TDS test ESGF catalogs
# COPY esgf-content/thredds/ /esg/content/thredds/

# start container
# change ownership of content directory
RUN chown -R tomcat:tomcat /esg/content/thredds

# start container as non-privilged user
USER tomcat
ENTRYPOINT ["/usr/local/tomcat/bin/catalina.sh", "run"]
+1 −1
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ services:
      - dbnetwork 
    volumes:
      - tds_data:/esg/content/thredds
      - $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml:/usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
    volumes_from:
      - esgf-config
    environment:
@@ -47,7 +48,6 @@ services:
     - $ESGF_CONFIG/httpd/conf/esgf-httpd.conf:/etc/httpd/conf.d/esgf-httpd.conf
     - $ESGF_CONFIG/grid-security/certificates/:/etc/grid-security/certificates/
     - $ESGF_CONFIG/esg/config/:/esg/config/
     - $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml:/usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
     - $ESGF_CONFIG/esg/config/tomcat/esg-truststore.ts:/usr/java/latest/jre/lib/security/jssecacerts

  esgf-postgres:
+0 −1
Original line number Diff line number Diff line
@@ -21,7 +21,6 @@ services:
     - $ESGF_CONFIG/httpd/conf/esgf-httpd.conf:/etc/httpd/conf.d/esgf-httpd.conf
     - $ESGF_CONFIG/grid-security/certificates/:/etc/grid-security/certificates/
     - $ESGF_CONFIG/esg/config/:/esg/config/
     - $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml:/usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
     - $ESGF_CONFIG/esg/config/tomcat/esg-truststore.ts:/usr/java/latest/jre/lib/security/jssecacerts

  esgf-solr:
+2 −1
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ services:
      - dbnetwork 
    volumes:
      - tds_data:/esg/content/thredds
      - $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml:/usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
    volumes_from:
      - esgf-config
    environment:
@@ -59,6 +60,7 @@ services:

  # data container holding site-specific ESGF configuration
  # this container stops after the volumes are initialized
  # only include congiguration common to more than one container
  esgf-config:
    image: centos:6
    container_name: esgf-config
@@ -67,7 +69,6 @@ services:
     - $ESGF_CONFIG/httpd/conf/esgf-httpd.conf:/etc/httpd/conf.d/esgf-httpd.conf
     - $ESGF_CONFIG/grid-security/certificates/:/etc/grid-security/certificates/
     - $ESGF_CONFIG/esg/config/:/esg/config/
     - $ESGF_CONFIG/webapps/thredds/WEB-INF/web.xml:/usr/local/tomcat/webapps/thredds/WEB-INF/web.xml
     - $ESGF_CONFIG/esg/config/tomcat/esg-truststore.ts:/usr/java/latest/jre/lib/security/jssecacerts


+8 −2
Original line number Diff line number Diff line
@@ -9,7 +9,13 @@ MAINTAINER Luca Cinquini <luca.cinquini@jpl.nasa.gov>
ARG ESGF_REPO=http://distrib-coffee.ipsl.jussieu.fr/pub/esgf

# FIXME
ADD $ESGF_REPO/dist/devel/esgf-idp/esgf-idp.war /usr/local/tomcat/webapps/
#COPY esgf-idp.war /usr/local/tomcat/webapps
ADD $ESGF_REPO/dist/devel/esgf-idp/esgf-idp.war /usr/local/tomcat/webapps/esgf-idp/
#COPY esgf-idp.war /usr/local/tomcat/webapps/esgf-idp/
RUN cd /usr/local/tomcat/webapps/esgf-idp/ && \
    jar xvf esgf-idp.war && \
    rm esgf-idp.war && \
    chown -R tomcat:tomcat /usr/local/tomcat/webapps/esgf-idp

# run Tomcat as non-privileged user
USER tomcat
ENTRYPOINT ["/usr/local/tomcat/bin/catalina.sh", "run"]
Loading