init
This commit is contained in:
@@ -0,0 +1,154 @@
|
||||
FROM alpine:3.22
|
||||
|
||||
# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
|
||||
RUN set -eux; \
|
||||
# alpine already has a gid 999, so we'll use the next id
|
||||
addgroup -S -g 1000 redis; \
|
||||
adduser -S -G redis -u 999 redis
|
||||
|
||||
# runtime dependencies
|
||||
RUN set -eux; \
|
||||
apk add --no-cache \
|
||||
# add tzdata for https://github.com/docker-library/redis/issues/138
|
||||
tzdata \
|
||||
# we need setpriv package as busybox provides very limited functionality
|
||||
setpriv \
|
||||
;
|
||||
ENV REDIS_DOWNLOAD_URL=http://download.redis.io/releases/redis-8.2.1.tar.gz
|
||||
ENV REDIS_DOWNLOAD_SHA=e2c1cb9dd4180a35b943b85dfc7dcdd42566cdbceca37d0d0b14c21731582d3e
|
||||
RUN set -eux; \
|
||||
\
|
||||
apk add --no-cache --virtual .build-deps \
|
||||
coreutils \
|
||||
dpkg-dev dpkg \
|
||||
gcc \
|
||||
linux-headers \
|
||||
make \
|
||||
musl-dev \
|
||||
openssl-dev \
|
||||
g++; \
|
||||
\
|
||||
arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
|
||||
case "$arch" in \
|
||||
'amd64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \
|
||||
'arm64') export BUILD_WITH_MODULES=yes; export INSTALL_RUST_TOOLCHAIN=yes; export DISABLE_WERRORS=yes ;; \
|
||||
*) echo >&2 "Modules are NOT supported! unsupported architecture: '$arch'"; export BUILD_WITH_MODULES=no ;; \
|
||||
esac; \
|
||||
if [ "$BUILD_WITH_MODULES" = "yes" ]; then \
|
||||
apk add --no-cache --virtual .module-build-deps \
|
||||
autoconf \
|
||||
automake \
|
||||
bash \
|
||||
bsd-compat-headers \
|
||||
build-base \
|
||||
cargo \
|
||||
clang \
|
||||
clang-static \
|
||||
clang-libclang \
|
||||
cmake \
|
||||
curl \
|
||||
g++ \
|
||||
git \
|
||||
libffi-dev \
|
||||
libgcc \
|
||||
libtool \
|
||||
llvm-dev \
|
||||
ncurses-dev \
|
||||
openssh \
|
||||
openssl \
|
||||
py-virtualenv \
|
||||
py3-cryptography \
|
||||
py3-pip \
|
||||
py3-virtualenv \
|
||||
python3 \
|
||||
python3-dev \
|
||||
rsync \
|
||||
tar \
|
||||
unzip \
|
||||
which \
|
||||
xsimd \
|
||||
xz; \
|
||||
fi; \
|
||||
\
|
||||
# install required python packages for RedisJSON module
|
||||
pip install -q --upgrade setuptools && pip install -q --upgrade pip && PIP_BREAK_SYSTEM_PACKAGES=1 pip install -q addict toml jinja2 ramp-packer ;\
|
||||
wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL"; \
|
||||
echo "$REDIS_DOWNLOAD_SHA *redis.tar.gz" | sha256sum -c -; \
|
||||
mkdir -p /usr/src/redis; \
|
||||
tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1; \
|
||||
rm redis.tar.gz; \
|
||||
\
|
||||
# disable Redis protected mode [1] as it is unnecessary in context of Docker
|
||||
# (ports are not automatically exposed when running inside Docker, but rather explicitly by specifying -p / -P)
|
||||
# [1]: https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
|
||||
grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' /usr/src/redis/src/config.c; \
|
||||
sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' /usr/src/redis/src/config.c; \
|
||||
grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' /usr/src/redis/src/config.c; \
|
||||
# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"
|
||||
# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840
|
||||
# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)
|
||||
\
|
||||
# https://github.com/jemalloc/jemalloc/issues/467 -- we need to patch the "./configure" for the bundled jemalloc to match how Debian compiles, for compatibility
|
||||
# (also, we do cross-builds, so we need to embed the appropriate "--build=xxx" values to that "./configure" invocation)
|
||||
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
|
||||
extraJemallocConfigureFlags="--build=$gnuArch"; \
|
||||
# https://salsa.debian.org/debian/jemalloc/-/blob/c0a88c37a551be7d12e4863435365c9a6a51525f/debian/rules#L8-23
|
||||
dpkgArch="$(dpkg --print-architecture)"; \
|
||||
case "${dpkgArch##*-}" in \
|
||||
amd64 | i386 | x32) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=12" ;; \
|
||||
*) extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-page=16" ;; \
|
||||
esac; \
|
||||
extraJemallocConfigureFlags="$extraJemallocConfigureFlags --with-lg-hugepage=21"; \
|
||||
grep -F 'cd jemalloc && ./configure ' /usr/src/redis/deps/Makefile; \
|
||||
sed -ri 's!cd jemalloc && ./configure !&'"$extraJemallocConfigureFlags"' !' /usr/src/redis/deps/Makefile; \
|
||||
grep -F "cd jemalloc && ./configure $extraJemallocConfigureFlags " /usr/src/redis/deps/Makefile; \
|
||||
\
|
||||
# Disable static linking the C runtime for RediSearch's rust submodule
|
||||
export RUST_DYN_CRT=1; \
|
||||
export BUILD_TLS=yes; \
|
||||
if [ "$BUILD_WITH_MODULES" = "yes" ]; then \
|
||||
make -C /usr/src/redis/modules/redisjson get_source; \
|
||||
sed -i 's/^RUST_FLAGS=$/RUST_FLAGS += -C target-feature=-crt-static/' /usr/src/redis/modules/redisjson/src/Makefile ; \
|
||||
grep -E 'RUST_FLAGS' /usr/src/redis/modules/redisjson/src/Makefile; \
|
||||
fi; \
|
||||
make -C /usr/src/redis -j "$(nproc)" all; \
|
||||
make -C /usr/src/redis install; \
|
||||
\
|
||||
# TODO https://github.com/redis/redis/pull/3494 (deduplicate "redis-server" copies)
|
||||
serverMd5="$(md5sum /usr/local/bin/redis-server | cut -d' ' -f1)"; export serverMd5; \
|
||||
find /usr/local/bin/redis* -maxdepth 0 \
|
||||
-type f -not -name redis-server \
|
||||
-exec sh -eux -c ' \
|
||||
md5="$(md5sum "$1" | cut -d" " -f1)"; \
|
||||
test "$md5" = "$serverMd5"; \
|
||||
' -- '{}' ';' \
|
||||
-exec ln -svfT 'redis-server' '{}' ';' \
|
||||
; \
|
||||
\
|
||||
make -C /usr/src/redis distclean; \
|
||||
rm -r /usr/src/redis; \
|
||||
\
|
||||
runDeps="$( \
|
||||
scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
|
||||
| tr ',' '\n' \
|
||||
| sort -u \
|
||||
| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
|
||||
)"; \
|
||||
apk add --no-network --virtual .redis-rundeps $runDeps; \
|
||||
if [ "$BUILD_WITH_MODULES" = "yes" ]; then \
|
||||
apk del --no-network .module-build-deps; \
|
||||
fi; \
|
||||
apk del --no-network .build-deps; \
|
||||
rm -rf ~/.cache ~/.gitconfig; \
|
||||
\
|
||||
redis-cli --version; \
|
||||
redis-server --version;
|
||||
RUN mkdir /data && chown redis:redis /data
|
||||
VOLUME /data
|
||||
WORKDIR /data
|
||||
|
||||
COPY docker-entrypoint.sh /usr/local/bin/
|
||||
ENTRYPOINT ["docker-entrypoint.sh"]
|
||||
|
||||
EXPOSE 6379
|
||||
CMD ["redis-server"]
|
||||
Executable
+184
@@ -0,0 +1,184 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
SETPRIV="/bin/setpriv --reuid redis --regid redis --clear-groups"
|
||||
IS_REDIS_SENTINEL=""
|
||||
IS_REDIS_SERVER=""
|
||||
CONFIG=""
|
||||
|
||||
SKIP_FIX_PERMS_NOTICE="Use SKIP_FIX_PERMS=1 to skip permission changes."
|
||||
|
||||
# functions
|
||||
has_cap() {
|
||||
/bin/setpriv -d | grep -q 'Capability bounding set:.*\b'"$1"'\b'
|
||||
}
|
||||
|
||||
check_for_sentinel() {
|
||||
CMD="$1"
|
||||
shift
|
||||
if [ "$CMD" = '/usr/local/bin/redis-server' ]; then
|
||||
for arg in "$@"; do
|
||||
if [ "$arg" = "--sentinel" ]; then
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ "$CMD" = '/usr/local/bin/redis-sentinel' ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
# Note: Change permissions only in simple, default cases to avoid affecting
|
||||
# unexpected or user-specific files.
|
||||
|
||||
fix_data_dir_perms() {
|
||||
# Expecting only *.rdb files and default appendonlydir; skip if others are found.
|
||||
unknown_file="$(find . -mindepth 1 -maxdepth 1 \
|
||||
-not \( -name \*.rdb -or \( -type d -and -name appendonlydir \) \) \
|
||||
-print -quit)"
|
||||
if [ -z "$unknown_file" ]; then
|
||||
find . -print0 | fix_perms_and_owner rw
|
||||
else
|
||||
echo "Notice: Unknown file '$unknown_file' found in data dir. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
|
||||
fi
|
||||
}
|
||||
|
||||
fix_config_perms() {
|
||||
config="$1"
|
||||
mode="$2"
|
||||
|
||||
if [ ! -f "$config" ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
confdir="$(dirname "$config")"
|
||||
if [ ! -d "$confdir" ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Expecting only the config file; skip if others are found.
|
||||
pattern=$(printf "%s" "$(basename "$config")" | sed 's/[][?*]/\\&/g')
|
||||
unknown_file=$(find "$confdir" -mindepth 1 -maxdepth 1 -not -name "$pattern" -print -quit)
|
||||
|
||||
if [ -z "$unknown_file" ]; then
|
||||
printf '%s\0%s\0' "$confdir" "$config" | fix_perms_and_owner "$mode"
|
||||
else
|
||||
echo "Notice: Unknown file '$unknown_file' found in '$confdir'. Permissions will not be modified. $SKIP_FIX_PERMS_NOTICE"
|
||||
|
||||
fi
|
||||
}
|
||||
|
||||
fix_perms_and_owner() {
|
||||
mode="$1"
|
||||
|
||||
# shellcheck disable=SC3045
|
||||
while IFS= read -r -d '' file; do
|
||||
if [ "$mode" = "rw" ] && $SETPRIV test -r "$file" -a -w "$file"; then
|
||||
continue
|
||||
elif [ "$mode" = "r" ] && $SETPRIV test -r "$file"; then
|
||||
continue
|
||||
fi
|
||||
new_mode=$mode
|
||||
if [ -d "$file" ]; then
|
||||
new_mode=${mode}x
|
||||
fi
|
||||
err=$(chown redis "$file" 2>&1) || echo "Warning: cannot change owner to 'redis' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
|
||||
err=$(chmod "u+$new_mode" "$file" 2>&1) || echo "Warning: cannot change mode to 'u+$new_mode' for '$file': $err. $SKIP_FIX_PERMS_NOTICE"
|
||||
done
|
||||
}
|
||||
|
||||
# first arg is `-f` or `--some-option`
|
||||
# or first arg is `something.conf`
|
||||
if [ "${1#-}" != "$1" ] || [ "${1%.conf}" != "$1" ]; then
|
||||
set -- redis-server "$@"
|
||||
fi
|
||||
CMD=$(command -v "$1" 2>/dev/null || :)
|
||||
|
||||
if [ "$(readlink -f "$CMD")" = '/usr/local/bin/redis-server' ]; then
|
||||
IS_REDIS_SERVER=1
|
||||
fi
|
||||
|
||||
if check_for_sentinel "$CMD" "$@"; then
|
||||
IS_REDIS_SENTINEL=1
|
||||
fi
|
||||
|
||||
# if is server and its first arg is not an option then it's a config
|
||||
if [ "$IS_REDIS_SERVER" ] && [ "${2#-}" = "$2" ]; then
|
||||
CONFIG="$2"
|
||||
fi
|
||||
|
||||
# drop privileges only if
|
||||
# we are starting either server or sentinel
|
||||
# our uid is 0 (container started without explicit --user)
|
||||
# and we have capabilities required to drop privs
|
||||
if [ "$IS_REDIS_SERVER" ] && [ -z "$SKIP_DROP_PRIVS" ] && [ "$(id -u)" = '0' ] && has_cap setuid && has_cap setgid; then
|
||||
if [ -z "$SKIP_FIX_PERMS" ]; then
|
||||
# fix permissions
|
||||
if [ "$IS_REDIS_SENTINEL" ]; then
|
||||
fix_config_perms "$CONFIG" rw
|
||||
else
|
||||
fix_data_dir_perms
|
||||
fix_config_perms "$CONFIG" r
|
||||
fi
|
||||
fi
|
||||
|
||||
CAPS_TO_KEEP=""
|
||||
if has_cap sys_resource; then
|
||||
# we have sys_resource capability, keep it available for redis
|
||||
# as redis may use it to increase open files limit
|
||||
CAPS_TO_KEEP=",+sys_resource"
|
||||
fi
|
||||
exec $SETPRIV \
|
||||
--nnp \
|
||||
--inh-caps=-all$CAPS_TO_KEEP \
|
||||
--ambient-caps=-all$CAPS_TO_KEEP \
|
||||
--bounding-set=-all$CAPS_TO_KEEP \
|
||||
"$0" "$@"
|
||||
fi
|
||||
|
||||
# set an appropriate umask (if one isn't set already)
|
||||
# - https://github.com/docker-library/redis/issues/305
|
||||
# - https://github.com/redis/redis/blob/bb875603fb7ff3f9d19aad906bd45d7db98d9a39/utils/systemd-redis_server.service#L37
|
||||
um="$(umask)"
|
||||
if [ "$um" = '0022' ]; then
|
||||
umask 0077
|
||||
fi
|
||||
|
||||
if [ "$IS_REDIS_SERVER" ] && ! [ "$IS_REDIS_SENTINEL" ]; then
|
||||
echo "Starting Redis Server"
|
||||
modules_dir="/usr/local/lib/redis/modules/"
|
||||
|
||||
if [ ! -d "$modules_dir" ]; then
|
||||
echo "Warning: Default Redis modules directory $modules_dir does not exist."
|
||||
elif [ -n "$(ls -A $modules_dir 2>/dev/null)" ]; then
|
||||
for module in "$modules_dir"/*.so;
|
||||
do
|
||||
if [ ! -s "$module" ]; then
|
||||
echo "Skipping module $module: file has no size."
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ -d "$module" ]; then
|
||||
echo "Skipping module $module: is a directory."
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ ! -r "$module" ]; then
|
||||
echo "Skipping module $module: file is not readable."
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ ! -x "$module" ]; then
|
||||
echo "Warning: Module $module is not executable."
|
||||
continue
|
||||
fi
|
||||
|
||||
set -- "$@" --loadmodule "$module"
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
exec "$@"
|
||||
Reference in New Issue
Block a user