Skip to content

Commit a032128

Browse files
ddavisonddavison
authored
Merge pull request #477 from diemol/master
Run all processes with seluser instead of root
2 parents fe860cb + cff3315 commit a032128

File tree

22 files changed

+171
-176
lines changed

22 files changed

+171
-176
lines changed

‎Base/Dockerfile‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,15 @@ RUN echo "deb http://archive.ubuntu.com/ubuntu xenial main universe\n" > /etc/a
88
&& echo "deb http://archive.ubuntu.com/ubuntu xenial-updates main universe\n" >> /etc/apt/sources.list \
99
&& echo "deb http://security.ubuntu.com/ubuntu xenial-security main universe\n" >> /etc/apt/sources.list
1010

11+
# No interactive frontend during docker build
12+
ENV DEBIAN_FRONTEND=noninteractive \
13+
DEBCONF_NONINTERACTIVE_SEEN=true
14+
1115
#========================
1216
# Miscellaneous packages
1317
# Includes minimal runtime used for executing non GUI Java programs
1418
#========================
15-
RUN apt-get update -qqy \
19+
RUN apt-get -qqy update \
1620
&& apt-get -qqy --no-install-recommends install \
1721
bzip2 \
1822
ca-certificates \
@@ -32,16 +36,26 @@ ENV TZ "UTC"
3236
RUN echo "${TZ}" > /etc/timezone \
3337
&& dpkg-reconfigure --frontend noninteractive tzdata
3438

35-
#==========
36-
# Selenium
37-
#==========
38-
RUN mkdir -p /opt/selenium \
39-
&& wget --no-verbose https://selenium-release.storage.googleapis.com/3.4/selenium-server-standalone-3.4.0.jar -O /opt/selenium/selenium-server-standalone.jar
40-
4139
#========================================
4240
# Add normal user with passwordless sudo
4341
#========================================
44-
RUN sudo useradd seluser --shell /bin/bash --create-home \
45-
&& sudo usermod -a -G sudo seluser \
42+
RUN useradd seluser \
43+
--shell /bin/bash \
44+
--create-home \
45+
&& usermod -a -G sudo seluser \
4646
&& echo 'ALL ALL = (ALL) NOPASSWD: ALL' >> /etc/sudoers \
4747
&& echo 'seluser:secret' | chpasswd
48+
49+
#===================================================
50+
# Run the following commands as non-privileged user
51+
#===================================================
52+
USER seluser
53+
54+
#==========
55+
# Selenium
56+
#==========
57+
RUN sudo mkdir -p /opt/selenium \
58+
&& sudo chown seluser:seluser /opt/selenium \
59+
&& wget --no-verbose https://selenium-release.storage.googleapis.com/3.4/selenium-server-standalone-3.4.0.jar \
60+
-O /opt/selenium/selenium-server-standalone.jar
61+

‎Hub/Dockerfile.txt‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
USER seluser
2+
13
#========================
24
# Selenium Configuration
35
#========================
@@ -21,11 +23,12 @@ ENV GRID_TIMEOUT 30
2123
# Debug
2224
ENV GRID_DEBUG false
2325

24-
COPY generate_config /opt/selenium/generate_config
25-
COPY entry_point.sh /opt/bin/entry_point.sh
26-
RUN /opt/selenium/generate_config > /opt/selenium/config.json
27-
RUN chown -R seluser /opt/selenium
28-
29-
USER seluser
26+
COPY generate_config \
27+
entry_point.sh \
28+
/opt/bin/
29+
# Running this command as sudo just to avoid the message:
30+
# To run a command as administrator (user "root"), use "sudo <command>". See "man sudo_root" for details.
31+
# When logging into the container
32+
RUN sudo /opt/bin/generate_config > /opt/selenium/config.json
3033

3134
CMD ["/opt/bin/entry_point.sh"]

‎Hub/entry_point.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
ROOT=/opt/selenium
44
CONF=$ROOT/config.json
55

6-
$ROOT/generate_config >$CONF
6+
/opt/bin/generate_config >$CONF
77

88
echo "starting selenium hub with configuration:"
99
cat $CONF
@@ -26,4 +26,4 @@ java ${JAVA_OPTS} -jar /opt/selenium/selenium-server-standalone.jar \
2626
NODE_PID=$!
2727

2828
trap shutdown SIGTERM SIGINT
29-
wait $NODE_PID
29+
wait $NODE_PID

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ standalone_firefox: generate_standalone_firefox firefox
6161
cd ./StandaloneFirefox && docker build $(BUILD_ARGS) -t $(NAME)/standalone-firefox:$(VERSION) .
6262

6363
generate_standalone_firefox_debug:
64-
cd ./StandaloneDebug && ./generate.sh StandaloneFirefoxDebug standalone-firefox Firefox $(VERSION) $(NAMESPACE) $(AUTHORS)
64+
cd ./StandaloneDebug && ./generate.sh StandaloneFirefoxDebug node-firefox-debug Firefox $(VERSION) $(NAMESPACE) $(AUTHORS)
6565

6666
standalone_firefox_debug: generate_standalone_firefox_debug standalone_firefox
6767
cd ./StandaloneFirefoxDebug && docker build $(BUILD_ARGS) -t $(NAME)/standalone-firefox-debug:$(VERSION) .
@@ -73,7 +73,7 @@ standalone_chrome: generate_standalone_chrome chrome
7373
cd ./StandaloneChrome && docker build $(BUILD_ARGS) -t $(NAME)/standalone-chrome:$(VERSION) .
7474

7575
generate_standalone_chrome_debug:
76-
cd ./StandaloneDebug && ./generate.sh StandaloneChromeDebug standalone-chrome Chrome $(VERSION) $(NAMESPACE) $(AUTHORS)
76+
cd ./StandaloneDebug && ./generate.sh StandaloneChromeDebug node-chrome-debug Chrome $(VERSION) $(NAMESPACE) $(AUTHORS)
7777

7878
standalone_chrome_debug: generate_standalone_chrome_debug standalone_chrome
7979
cd ./StandaloneChromeDebug && docker build $(BUILD_ARGS) -t $(NAME)/standalone-chrome-debug:$(VERSION) .

‎NodeBase/Dockerfile.txt‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
ENV DEBIAN_FRONTEND noninteractive
2-
ENV DEBCONF_NONINTERACTIVE_SEEN true
1+
USER root
32

43
#==============
54
# VNC and Xvfb
@@ -10,14 +9,18 @@ RUN apt-get update -qqy \
109
xvfb \
1110
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/*
1211

12+
#===================================================
13+
# Run the following commands as non-privileged user
14+
#===================================================
15+
16+
USER seluser
17+
1318
#==============================
1419
# Scripts to run Selenium Node
1520
#==============================
16-
COPY \
17-
entry_point.sh \
21+
COPY entry_point.sh \
1822
functions.sh \
1923
/opt/bin/
20-
RUN chmod +x /opt/bin/entry_point.sh
2124

2225
#============================
2326
# Some configuration options
@@ -27,6 +30,27 @@ ENV SCREEN_HEIGHT 1020
2730
ENV SCREEN_DEPTH 24
2831
ENV DISPLAY :99.0
2932

30-
USER seluser
33+
#========================
34+
# Selenium Configuration
35+
#========================
36+
# As integer, maps to "maxInstances"
37+
ENV NODE_MAX_INSTANCES 1
38+
# As integer, maps to "maxSession"
39+
ENV NODE_MAX_SESSION 1
40+
# As integer, maps to "port"
41+
ENV NODE_PORT 5555
42+
# In milliseconds, maps to "registerCycle"
43+
ENV NODE_REGISTER_CYCLE 5000
44+
# In milliseconds, maps to "nodePolling"
45+
ENV NODE_POLLING 5000
46+
# In milliseconds, maps to "unregisterIfStillDownAfter"
47+
ENV NODE_UNREGISTER_IF_STILL_DOWN_AFTER 60000
48+
# As integer, maps to "downPollingLimit"
49+
ENV NODE_DOWN_POLLING_LIMIT 2
50+
# As string, maps to "applicationName"
51+
ENV NODE_APPLICATION_NAME ""
52+
53+
# Following line fixes https://github.com/SeleniumHQ/docker-selenium/issues/87
54+
ENV DBUS_SESSION_BUS_ADDRESS=/dev/null
3155

3256
CMD ["/opt/bin/entry_point.sh"]

‎NodeBase/entry_point.sh‎

100644100755
Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
source /opt/bin/functions.sh
4-
/opt/selenium/generate_config > /opt/selenium/config.json
4+
/opt/bin/generate_config > /opt/selenium/config.json
55

66
export GEOMETRY="$SCREEN_WIDTH""x""$SCREEN_HEIGHT""x""$SCREEN_DEPTH"
77

@@ -29,8 +29,6 @@ if [ ! -z "$SE_OPTS" ]; then
2929
echo "appending selenium options: ${SE_OPTS}"
3030
fi
3131

32-
# TODO: Look into http://www.seleniumhq.org/docs/05_selenium_rc.jsp#browser-side-logs
33-
3432
SERVERNUM=$(get_server_num)
3533

3634
rm -f /tmp/.X*lock
@@ -44,4 +42,4 @@ xvfb-run -n $SERVERNUM --server-args="-screen 0 $GEOMETRY -ac +extension RANDR"
4442
NODE_PID=$!
4543

4644
trap shutdown SIGTERM SIGINT
47-
wait $NODE_PID
45+
wait $NODE_PID

‎NodeChrome/Dockerfile.txt‎

Lines changed: 4 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key
1919
&& rm /etc/apt/sources.list.d/google-chrome.list \
2020
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/*
2121

22+
USER seluser
23+
2224
#==================
2325
# Chrome webdriver
2426
#==================
@@ -29,40 +31,11 @@ RUN wget --no-verbose -O /tmp/chromedriver_linux64.zip https://chromedriver.stor
2931
&& rm /tmp/chromedriver_linux64.zip \
3032
&& mv /opt/selenium/chromedriver /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
3133
&& chmod 755 /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
32-
&& ln -fs /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION /usr/bin/chromedriver
34+
&& sudo ln -fs /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION /usr/bin/chromedriver
3335

34-
#========================
35-
# Selenium Configuration
36-
#========================
37-
# As integer, maps to "maxInstances"
38-
ENV NODE_MAX_INSTANCES 1
39-
# As integer, maps to "maxSession"
40-
ENV NODE_MAX_SESSION 1
41-
# As integer, maps to "port"
42-
ENV NODE_PORT 5555
43-
# In milliseconds, maps to "registerCycle"
44-
ENV NODE_REGISTER_CYCLE 5000
45-
# In milliseconds, maps to "nodePolling"
46-
ENV NODE_POLLING 5000
47-
# In milliseconds, maps to "unregisterIfStillDownAfter"
48-
ENV NODE_UNREGISTER_IF_STILL_DOWN_AFTER 60000
49-
# As integer, maps to "downPollingLimit"
50-
ENV NODE_DOWN_POLLING_LIMIT 2
51-
# As string, maps to "applicationName"
52-
ENV NODE_APPLICATION_NAME ""
53-
54-
COPY generate_config /opt/selenium/generate_config
55-
RUN chmod +x /opt/selenium/generate_config
36+
COPY generate_config /opt/bin/generate_config
5637

5738
#=================================
5839
# Chrome Launch Script Modification
5940
#=================================
6041
COPY chrome_launcher.sh /opt/google/chrome/google-chrome
61-
RUN chmod +x /opt/google/chrome/google-chrome
62-
63-
RUN chown -R seluser:seluser /opt/selenium
64-
65-
# Following line fixes https://github.com/SeleniumHQ/docker-selenium/issues/87
66-
ENV DBUS_SESSION_BUS_ADDRESS=/dev/null
67-
68-
USER seluser

‎NodeChrome/chrome_launcher.sh‎

100644100755
File mode changed.

‎NodeChromeDebug/entry_point.sh‎

100644100755
Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
#!/bin/bash
2+
#
3+
# IMPORTANT: Change this file only in directory NodeDebug!
24

35
source /opt/bin/functions.sh
4-
/opt/selenium/generate_config > /opt/selenium/config.json
6+
/opt/bin/generate_config > /opt/selenium/config.json
57

68
export GEOMETRY="$SCREEN_WIDTH""x""$SCREEN_HEIGHT""x""$SCREEN_DEPTH"
79

@@ -29,17 +31,11 @@ if [ ! -z "$SE_OPTS" ]; then
2931
echo "appending selenium options: ${SE_OPTS}"
3032
fi
3133

32-
# TODO: Look into http://www.seleniumhq.org/docs/05_selenium_rc.jsp#browser-side-logs
33-
3434
SERVERNUM=$(get_server_num)
3535

3636
rm -f /tmp/.X*lock
3737

38-
env | cut -f 1 -d "=" | sort > asroot
39-
sudo -E -u seluser -i env | cut -f 1 -d "=" | sort > asseluser
40-
sudo -E -i -u seluser \
41-
"$(for E in $(grep -vxFf asseluser asroot); do echo $E=$(eval echo \$$E); done)" \
42-
DISPLAY=$DISPLAY \
38+
DISPLAY=$DISPLAY \
4339
xvfb-run -n $SERVERNUM --server-args="-screen 0 $GEOMETRY -ac +extension RANDR" \
4440
java ${JAVA_OPTS} -jar /opt/selenium/selenium-server-standalone.jar \
4541
-role node \

‎NodeDebug/Dockerfile.txt‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,7 @@ USER root
66
RUN apt-get update -qqy \
77
&& apt-get -qqy install \
88
x11vnc \
9-
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/* \
10-
&& mkdir -p /root/.vnc \
11-
&& x11vnc -storepasswd secret ~/.vnc/passwd
9+
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/*
1210

1311
#=================
1412
# Locale settings
@@ -43,10 +41,19 @@ RUN apt-get update -qqy \
4341
fluxbox \
4442
&& rm -rf /var/lib/apt/lists/* /var/cache/apt/*
4543

44+
USER seluser
45+
46+
#==============================
47+
# Generating the VNC password as seluser
48+
# So the service can be started with seluser
49+
#==============================
50+
51+
RUN mkdir -p ~/.vnc \
52+
&& x11vnc -storepasswd secret ~/.vnc/passwd
53+
4654
#==============================
4755
# Scripts to run Selenium Node
4856
#==============================
4957
COPY entry_point.sh /opt/bin/entry_point.sh
50-
RUN chmod +x /opt/bin/entry_point.sh
5158

5259
EXPOSE 5900

0 commit comments

Comments
 (0)