mirror of
https://github.com/bolkedebruin/rdpgw.git
synced 2026-05-13 03:40:01 +00:00
8998ab1066
The dev container image generated a TLS keypair at build time and shipped it inside the image, so every pull of the same image tag was serving the same private key. The entrypoint also reverted to USER 0 to support a dead `createusers.txt` loop and a `chmod u+s` that was a no-op (set on a binary owned by 1001). Net result was that any RCE in the gateway landed as root and the wire-trust posture relied on a shared private key. Stop generating the cert at build time: the runtime image now carries openssl and the entrypoint mints an ephemeral self-signed cert at first start when no cert is mounted at the configured path. Each container instance gets its own key. Drop USER 0 entirely; the entrypoint runs as 1001 throughout. Prune the dead createusers loop and the `chmod u+s`. Separately, the README and the dev compose files publish a small set of literal placeholder values for SessionKey, SessionEncryptionKey, and the various Token*Key fields. Operators copy-paste these into real deployments. Refuse to start when any of those literals appear in the corresponding config field.
43 lines
1.5 KiB
Docker
43 lines
1.5 KiB
Docker
# builder stage
|
|
FROM golang:1.24-alpine as builder
|
|
|
|
# Install CA certificates explicitly in builder
|
|
RUN apk --no-cache add git gcc musl-dev linux-pam-dev
|
|
|
|
# add user
|
|
RUN adduser --disabled-password --gecos "" --home /opt/rdpgw --uid 1001 rdpgw
|
|
|
|
# build rdpgw and set rights
|
|
ARG CACHEBUST
|
|
RUN git clone https://github.com/bolkedebruin/rdpgw.git /app && \
|
|
cd /app && \
|
|
go mod tidy -compat=1.19 && \
|
|
CGO_ENABLED=0 GOOS=linux go build -trimpath -tags '' -ldflags '' -o '/opt/rdpgw/rdpgw' ./cmd/rdpgw && \
|
|
CGO_ENABLED=1 GOOS=linux go build -trimpath -tags '' -ldflags '' -o '/opt/rdpgw/rdpgw-auth' ./cmd/auth && \
|
|
chmod +x /opt/rdpgw/rdpgw && \
|
|
chmod +x /opt/rdpgw/rdpgw-auth
|
|
|
|
FROM alpine:latest
|
|
# Install CA certificates and (for the dev compose) openssl so the
|
|
# entrypoint can mint an ephemeral self-signed cert at startup. No cert
|
|
# is baked into the image, so each container instance gets its own key.
|
|
RUN apk --no-cache add linux-pam musl tzdata ca-certificates openssl && update-ca-certificates
|
|
|
|
# make tempdir in case filestore is used
|
|
ADD tmp.tar /
|
|
COPY --chown=0 rdpgw-pam /etc/pam.d/rdpgw
|
|
|
|
USER 1001
|
|
COPY --chown=1001 run.sh run.sh
|
|
COPY --chown=1001 --from=builder /opt/rdpgw /opt/rdpgw
|
|
COPY --chown=1001 --from=builder /etc/passwd /etc/passwd
|
|
|
|
# Copy templates directory
|
|
COPY --from=builder /app/cmd/rdpgw/templates /opt/rdpgw/templates
|
|
|
|
# Copy assets directory from the app source
|
|
COPY --chown=1001 --from=builder /app/assets /opt/rdpgw/assets
|
|
|
|
WORKDIR /opt/rdpgw
|
|
ENTRYPOINT ["/bin/sh", "/run.sh"]
|