From e10864a9ba92dfaaf0cf52d974ccdde815a8a405 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 21 Oct 2022 09:37:29 +0100 Subject: [PATCH] Migrate to s6v3 --- .github/workflows/external_trigger.yml | 2 +- Dockerfile | 10 ++++------ Dockerfile.aarch64 | 10 ++++------ Dockerfile.armhf | 10 ++++------ Jenkinsfile | 4 ++-- README.md | 5 +++++ jenkins-vars.yml | 4 ++-- readme-vars.yml | 4 ++++ .../init-config-end/dependencies.d/init-openboxcopy | 0 .../init-openboxcopy/dependencies.d/init-config | 0 .../s6-rc.d/init-openboxcopy/run} | 3 ++- root/etc/s6-overlay/s6-rc.d/init-openboxcopy/type | 1 + root/etc/s6-overlay/s6-rc.d/init-openboxcopy/up | 1 + .../s6-rc.d/user/contents.d/init-openboxcopy | 0 14 files changed, 30 insertions(+), 24 deletions(-) create mode 100644 root/etc/s6-overlay/s6-rc.d/init-config-end/dependencies.d/init-openboxcopy create mode 100644 root/etc/s6-overlay/s6-rc.d/init-openboxcopy/dependencies.d/init-config rename root/etc/{cont-init.d/56-openboxcopy => s6-overlay/s6-rc.d/init-openboxcopy/run} (78%) mode change 100644 => 100755 create mode 100644 root/etc/s6-overlay/s6-rc.d/init-openboxcopy/type create mode 100644 root/etc/s6-overlay/s6-rc.d/init-openboxcopy/up create mode 100644 root/etc/s6-overlay/s6-rc.d/user/contents.d/init-openboxcopy diff --git a/.github/workflows/external_trigger.yml b/.github/workflows/external_trigger.yml index a1d2917..49e1339 100644 --- a/.github/workflows/external_trigger.yml +++ b/.github/workflows/external_trigger.yml @@ -18,7 +18,7 @@ jobs: fi echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_FIREFOX_MASTER\". ****" echo "**** Retrieving external version ****" - EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ + EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ && awk '/^P:'"firefox"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://') if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then echo "**** Can't retrieve external version, exiting ****" diff --git a/Dockerfile b/Dockerfile index 5284dce..f124034 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM lsiobase/rdesktop-web:alpine +FROM ghcr.io/linuxserver/baseimage-rdesktop-web:3.16 # set version label ARG BUILD_DATE @@ -9,17 +9,14 @@ LABEL maintainer="thelamer" RUN \ echo "**** install packages ****" && \ - apk add --no-cache --virtual=build-dependencies \ - curl && \ if [ -z ${FIREFOX_VERSION+x} ]; then \ - FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ + FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ && awk '/^P:firefox$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \ fi && \ apk add --no-cache \ firefox==${FIREFOX_VERSION} && \ + sed -i 's|| \n yes\n \n|' /etc/xdg/openbox/rc.xml && \ echo "**** cleanup ****" && \ - apk del --purge \ - build-dependencies && \ rm -rf \ /tmp/* @@ -28,4 +25,5 @@ COPY /root / # ports and volumes EXPOSE 3000 + VOLUME /config diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 9c7bee7..461cfe2 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -1,4 +1,4 @@ -FROM lsiobase/rdesktop-web:arm64v8-alpine +FROM ghcr.io/linuxserver/baseimage-rdesktop-web:arm64v8-3.16 # set version label ARG BUILD_DATE @@ -9,17 +9,14 @@ LABEL maintainer="thelamer" RUN \ echo "**** install packages ****" && \ - apk add --no-cache --virtual=build-dependencies \ - curl && \ if [ -z ${FIREFOX_VERSION+x} ]; then \ - FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ + FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ && awk '/^P:firefox$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \ fi && \ apk add --no-cache \ firefox==${FIREFOX_VERSION} && \ + sed -i 's|| \n yes\n \n|' /etc/xdg/openbox/rc.xml && \ echo "**** cleanup ****" && \ - apk del --purge \ - build-dependencies && \ rm -rf \ /tmp/* @@ -28,4 +25,5 @@ COPY /root / # ports and volumes EXPOSE 3000 + VOLUME /config diff --git a/Dockerfile.armhf b/Dockerfile.armhf index be073f4..2672342 100644 --- a/Dockerfile.armhf +++ b/Dockerfile.armhf @@ -1,4 +1,4 @@ -FROM lsiobase/rdesktop-web:arm32v7-alpine +FROM ghcr.io/linuxserver/baseimage-rdesktop-web:arm32v7-3.16 # set version label ARG BUILD_DATE @@ -9,17 +9,14 @@ LABEL maintainer="thelamer" RUN \ echo "**** install packages ****" && \ - apk add --no-cache --virtual=build-dependencies \ - curl && \ if [ -z ${FIREFOX_VERSION+x} ]; then \ - FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ + FIREFOX_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \ && awk '/^P:firefox$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \ fi && \ apk add --no-cache \ firefox==${FIREFOX_VERSION} && \ + sed -i 's|| \n yes\n \n|' /etc/xdg/openbox/rc.xml && \ echo "**** cleanup ****" && \ - apk del --purge \ - build-dependencies && \ rm -rf \ /tmp/* @@ -28,4 +25,5 @@ COPY /root / # ports and volumes EXPOSE 3000 + VOLUME /config diff --git a/Jenkinsfile b/Jenkinsfile index 1341be5..e4bc261 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -25,8 +25,8 @@ pipeline { DEV_DOCKERHUB_IMAGE = 'lsiodev/firefox' PR_DOCKERHUB_IMAGE = 'lspipepr/firefox' DIST_IMAGE = 'alpine' - DIST_TAG = '3.15' - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.15/community/' + DIST_TAG = '3.16' + DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.16/community/' DIST_REPO_PACKAGES = 'firefox' MULTIARCH = 'true' CI = 'true' diff --git a/README.md b/README.md index 36c0908..cc9388a 100644 --- a/README.md +++ b/README.md @@ -81,6 +81,8 @@ services: firefox: image: lscr.io/linuxserver/firefox:latest container_name: firefox + security_opt: + - seccomp:unconfined #optional environment: - PUID=1000 - PGID=1000 @@ -98,6 +100,7 @@ services: ```bash docker run -d \ --name=firefox \ + --security-opt seccomp=unconfined `#optional` \ -e PUID=1000 \ -e PGID=1000 \ -e TZ=Europe/London \ @@ -120,6 +123,7 @@ Container images are configured using parameters passed at runtime (such as thos | `-e TZ=Europe/London` | Specify a timezone to use EG Europe/London. | | `-v /config` | Users home directory in the container, stores local files and settings | | `--shm-size=` | This is needed for any modern website to function like youtube. | +| `--security-opt seccomp=unconfined` | For Docker Engine only, many modern gui apps need this to function as syscalls are unkown to Docker. | ## Environment variables from files (Docker secrets) @@ -230,6 +234,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **21.10.22:** - Rebase to Alpine 3.16, migrate to s6v3. * **23.12.21:** - Rebase to Alpine 3.15, stop using ESR. * **26.09.21:** - Rebase to Alpine 3.14. * **19.04.21:** - Initial release. diff --git a/jenkins-vars.yml b/jenkins-vars.yml index d752d7e..413f1a0 100644 --- a/jenkins-vars.yml +++ b/jenkins-vars.yml @@ -15,8 +15,8 @@ repo_vars: - DEV_DOCKERHUB_IMAGE = 'lsiodev/firefox' - PR_DOCKERHUB_IMAGE = 'lspipepr/firefox' - DIST_IMAGE = 'alpine' - - DIST_TAG = '3.15' - - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.15/community/' + - DIST_TAG = '3.16' + - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.16/community/' - DIST_REPO_PACKAGES = 'firefox' - MULTIARCH = 'true' - CI = 'true' diff --git a/readme-vars.yml b/readme-vars.yml index 662eb68..5a645ea 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -31,6 +31,9 @@ param_ports: - { external_port: "3000", internal_port: "3000", port_desc: "Firefox desktop gui." } custom_params: - { name: "shm-size", name_compose: "shm_size", value: "1gb",desc: "This is needed for any modern website to function like youtube." } +opt_security_opt_param: true +opt_security_opt_param_vars: + - { run_var: "seccomp=unconfined", compose_var: "seccomp:unconfined", desc: "For Docker Engine only, many modern gui apps need this to function as syscalls are unkown to Docker." } # application setup block app_setup_block_enabled: true @@ -45,6 +48,7 @@ app_setup_block: | # changelog changelogs: + - { date: "21.10.22:", desc: "Rebase to Alpine 3.16, migrate to s6v3." } - { date: "23.12.21:", desc: "Rebase to Alpine 3.15, stop using ESR." } - { date: "26.09.21:", desc: "Rebase to Alpine 3.14." } - { date: "19.04.21:", desc: "Initial release." } diff --git a/root/etc/s6-overlay/s6-rc.d/init-config-end/dependencies.d/init-openboxcopy b/root/etc/s6-overlay/s6-rc.d/init-config-end/dependencies.d/init-openboxcopy new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/dependencies.d/init-config b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/dependencies.d/init-config new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/cont-init.d/56-openboxcopy b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/run old mode 100644 new mode 100755 similarity index 78% rename from root/etc/cont-init.d/56-openboxcopy rename to root/etc/s6-overlay/s6-rc.d/init-openboxcopy/run index f22df65..e7504d5 --- a/root/etc/cont-init.d/56-openboxcopy +++ b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/run @@ -1,7 +1,8 @@ #!/usr/bin/with-contenv bash # default file copies first run -[[ ! -f /config/.config/openbox/menu.xml ]] && \ +if [[ ! -f /config/.config/openbox/menu.xml ]]; then mkdir -p /config/.config/openbox && \ cp /defaults/menu.xml /config/.config/openbox/menu.xml && \ chown -R abc:abc /config/.config +fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/type b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/type new file mode 100644 index 0000000..3d92b15 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/type @@ -0,0 +1 @@ +oneshot \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/up b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/up new file mode 100644 index 0000000..c5a506f --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-openboxcopy/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-openboxcopy/run \ No newline at end of file diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-openboxcopy b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-openboxcopy new file mode 100644 index 0000000..e69de29