mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-23 23:29:08 +02:00
jnfrati
ae765a09c5
The challenge listener defaulted to :80, which the image's non-root user cannot bind on runtimes that keep the kernel's privileged-port floor, such as OpenShift and Podman. The proxy logged the failure and kept running without it, so http-01 issuance could never succeed. Default it to :8081, mirroring how the main listener already moves to :8443.
33 lines
1.2 KiB
Docker
33 lines
1.2 KiB
Docker
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
|
|
|
|
ARG TARGETPLATFORM
|
|
ARG VERSION=dev
|
|
ARG RELEASE=1
|
|
|
|
LABEL name="netbird-reverse-proxy" \
|
|
maintainer="NetBird <dev@netbird.io>" \
|
|
vendor="NetBird GmbH" \
|
|
version="${VERSION}" \
|
|
release="${RELEASE}" \
|
|
summary="NetBird Reverse Proxy" \
|
|
description="NetBird Reverse Proxy provides an identity-aware entrypoint to services in NetBird networks."
|
|
|
|
COPY --chmod=0555 ${TARGETPLATFORM}/netbird-proxy /go/bin/netbird-proxy
|
|
COPY licenses/ /licenses/
|
|
# Only the writable directories share the root group for arbitrary non-root UIDs.
|
|
# Runtime-created private keys retain the application's restrictive file modes.
|
|
RUN mkdir -p /var/lib/netbird /certs && \
|
|
chown 1000:0 /var/lib/netbird /certs && \
|
|
chmod 0770 /var/lib/netbird /certs && \
|
|
chmod -R a+rX /licenses
|
|
|
|
USER 1000:0
|
|
ENV HOME=/var/lib/netbird
|
|
ENV NB_PROXY_ADDRESS=":8443"
|
|
# Unprivileged ports: runtimes such as OpenShift and Podman keep the kernel
|
|
# default that reserves ports below 1024 for root. 8080 is the health probe.
|
|
ENV NB_PROXY_ACME_ADDRESS=":8081"
|
|
EXPOSE 8443
|
|
STOPSIGNAL SIGTERM
|
|
ENTRYPOINT ["/go/bin/netbird-proxy"]
|