mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
jnfrati
6cff570022
Persisted profiles remain scoped to the creating UID. Verify same-UID container recreation without broadening application permissions, and document the Kubernetes volume permission behavior observed on OpenShift. Remove unused synthetic-user home metadata.
42 lines
1.6 KiB
Plaintext
42 lines
1.6 KiB
Plaintext
# build & run locally with:
|
|
# cd "$(git rev-parse --show-toplevel)"
|
|
# CGO_ENABLED=0 go build -o netbird ./client
|
|
# podman build -t localhost/netbird:latest -f client/Dockerfile-rootless --ignorefile .dockerignore-client .
|
|
# podman run --rm -it --user 1001230000:0 --cap-drop=ALL --security-opt=no-new-privileges localhost/netbird:latest
|
|
#
|
|
# Reuse /var/lib/netbird volumes with the same runtime UID.
|
|
# Config/profile files start at 0600; Kubernetes fsGroup may widen their modes.
|
|
# Where supported, pod securityContext.fsGroupChangePolicy: OnRootMismatch
|
|
# preserves modes when the volume root's ownership and permissions match.
|
|
|
|
FROM alpine:3.24
|
|
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
ca-certificates \
|
|
&& adduser -D -u 1000 -h /var/lib/netbird netbird \
|
|
&& chgrp -R 0 /var/lib/netbird \
|
|
&& chmod -R g=u /var/lib/netbird
|
|
|
|
WORKDIR /var/lib/netbird
|
|
USER 1000:0
|
|
|
|
ENV \
|
|
HOME="/var/lib/netbird" \
|
|
NETBIRD_BIN="/usr/local/bin/netbird" \
|
|
NB_USE_NETSTACK_MODE="true" \
|
|
NB_ENABLE_NETSTACK_LOCAL_FORWARDING="true" \
|
|
NB_CONFIG="/var/lib/netbird/config.json" \
|
|
NB_STATE_DIR="/var/lib/netbird" \
|
|
NB_DAEMON_ADDR="unix:///var/lib/netbird/netbird.sock" \
|
|
NB_LOG_FILE="console,/var/lib/netbird/client.log" \
|
|
NB_DISABLE_DNS="true" \
|
|
NB_ENABLE_CAPTURE="false" \
|
|
NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
|
|
|
|
ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
|
|
ARG TARGETPLATFORM
|
|
ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
|
|
COPY --chown=0:0 --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
|
|
COPY --chown=0:0 --chmod=0755 "${NETBIRD_BINARY}" /usr/local/bin/netbird
|