Skip to content

Commit b00a8ba

Browse files
committed
WIP: allow supervisord to drop privileges to APP_USER
1 parent 59bf731 commit b00a8ba

File tree

3 files changed

+110
-5
lines changed

3 files changed

+110
-5
lines changed

Dockerfile

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ RUN apt-get install -y --no-install-recommends \
4848
RUN apt-get install -y --no-install-recommends openjdk-21-jre-headless
4949

5050
RUN rm -rf /usr/local/WowzaStreamingEngine/java
51+
52+
# for some reason, OpenJDK's default directory includes the architecture
53+
# name and does not symlink it to something more straightforward like
54+
# /usr/lib/jvm/java-21-openjdk so we have to detect the architecture
55+
5156
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
5257
RUN arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) ln -s "/usr/lib/jvm/java-21-openjdk-${arch}" /usr/local/WowzaStreamingEngine/java
5358

@@ -81,7 +86,7 @@ RUN venv/bin/pip3 install unittest-xml-reporting
8186

8287
COPY --chown=$APP_USER test /opt/app/test
8388

84-
# Put artifacts where Jenkins can get at them
89+
# Put artifacts where Github Actions can get at them
8590
RUN mkdir /opt/app/artifacts && \
8691
chown $APP_USER:$APP_USER /opt/app/artifacts
8792

@@ -95,6 +100,13 @@ RUN for app in vod live; \
95100
rm -r /usr/local/WowzaStreamingEngine/conf/${app}; \
96101
done
97102

103+
# modify supervisord configurations to run as $APP_USER
104+
# TODO: use templates to produce these files
105+
RUN sed -i "s/^user=root$/user=${APP_USER}/g" \
106+
/etc/supervisor/conf.d/WowzaStreamingEngine.conf \
107+
/etc/supervisor/conf.d/WowzaStreamingEngineManager.conf
108+
COPY etc/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
109+
98110
# Copy our scripts, configs, templates, etc. into the container
99111
COPY --chown=$APP_USER WowzaStreamingEngine /usr/local/WowzaStreamingEngine
100112
COPY --chown=$APP_USER log4j-templates /opt/app/log4j-templates
@@ -135,11 +147,10 @@ RUN rm -r /opt/app/WEB-INF
135147
# Uninstall zip
136148
RUN apt-get remove -y zip
137149

138-
# TODO: Fix this? Wowza's default image expects to run Wowza as root.
139150
# =============================================================================
140-
# Run as the wowza user to minimize risk to the host.
141-
142-
# USER $APP_USER
151+
# Unlike most of our containers, this container starts as root as privileges
152+
# are dropped by supervisord instead of settingg the `USER` set in the
153+
# Dockerfile.
143154

144155
# =============================================================================
145156
# Default command
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
# this is a BerkeleyLibrary modified version of the WSE startup script
3+
4+
# check for root access. If not, put up message and exit
5+
# if [ "$(/usr/bin/id -u)" -ne "0" ] ; then
6+
# echo "The Wowza Streaming Engine requires root access to start. Please run script again using sudo."
7+
# exit
8+
# fi
9+
10+
systemctl >> /dev/null 2>&1
11+
if [ $? -eq 0 ]; then
12+
# Restart XRM service
13+
SERVICE_NAME="xrmd.service"
14+
systemctl list-units --full -all | grep -Fq $SERVICE_NAME
15+
16+
if [ $? -eq 0 ]; then
17+
echo "Restarting XRM service"
18+
systemctl restart $SERVICE_NAME
19+
. /opt/xilinx/xcdr/setup.sh
20+
fi
21+
fi
22+
23+
. /usr/local/WowzaStreamingEngine/bin/setenv.sh
24+
mode=standalone
25+
if [ "$#" -eq 1 ];
26+
then
27+
mode=$1
28+
fi
29+
30+
#chmod 600 /usr/local/WowzaStreamingEngine/conf/jmxremote.password
31+
#chmod 600 /usr/local/WowzaStreamingEngine/conf/jmxremote.access
32+
33+
# NOTE: Here you can configure the JVM's built in JMX interface.
34+
# See the "Server Management Console and Monitoring" chapter
35+
# of the "User's Guide" for more information on how to configure the
36+
# remote JMX interface in the [install-dir]/conf/Server.xml file.
37+
38+
JMXOPTIONS=-Dcom.sun.management.jmxremote=true
39+
#JMXOPTIONS="$JMXOPTIONS -Djava.rmi.server.hostname=192.168.1.7"
40+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.port=1099"
41+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.authenticate=true"
42+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.ssl=false"
43+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.password.file=$WMSCONFIG_HOME/conf/jmxremote.password"
44+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.access.file=$WMSCONFIG_HOME/conf/jmxremote.access"
45+
46+
ulimit -n 64000 > /dev/null 2>&1
47+
48+
rc=144
49+
while [ $rc -eq 144 ]
50+
do
51+
52+
WMSTUNE_OPTS=`$WMSAPP_HOME/bin/tune.sh $mode`
53+
export LD_PRELOAD=`$WMSAPP_HOME/bin/ldpreload.sh`
54+
55+
# log interceptor com.wowza.wms.logging.LogNotify - see Javadocs for ILogNotify
56+
57+
$_EXECJAVA $WMSTUNE_OPTS $JMXOPTIONS -Dorg.slf4j.simpleLogger.defaultLogLevel=warn -Dcom.wowza.wms.runmode="$mode" -Dcom.wowza.wms.native.base="linux" -Dlog4j.configurationFile="$WMSCONFIG_HOME/conf/log4j2-config.xml" -Dcom.wowza.wms.AppHome="$WMSAPP_HOME" -Dcom.wowza.wms.ConfigURL="$WMSCONFIG_URL" -Dcom.wowza.wms.ConfigHome="$WMSCONFIG_HOME" -cp $WMSAPP_HOME/bin/wms-bootstrap.jar com.wowza.wms.bootstrap.Bootstrap start
58+
59+
rc=$?
60+
if [ $rc -ge 10 ] && [ $rc -le 15 ] ; then
61+
WSE_EXIT_CODE=$rc
62+
$_EXECJAVA $WMSTUNE_OPTS $JMXOPTIONS -Dcom.wowza.wms.runmode="$mode" -Dcom.wowza.wms.native.base="linux" -Dlog4j.configurationFile="$WMSCONFIG_HOME/conf/log4j2-config.xml" -Dcom.wowza.wms.AppHome="$WMSAPP_HOME" -Dcom.wowza.wms.ConfigURL="$WMSCONFIG_URL" -Dcom.wowza.wms.ConfigHome="$WMSCONFIG_HOME" -cp $WMSAPP_HOME/bin/wms-bootstrap.jar com.wowza.wms.bootstrap.Bootstrap startLicenseUpdateServer
63+
rc=$?
64+
fi
65+
done

etc/supervisor/supervisord.conf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
; supervisor config file
2+
3+
[unix_http_server]
4+
file=/tmp/supervisor.sock ; (the path to the socket file)
5+
chmod=0700 ; sockef file mode (default 0700)
6+
7+
[supervisord]
8+
logfile=/usr/local/supervisor/supervisord.log ;
9+
pidfile=/tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
10+
childlogdir=/var/log/supervisor ; ('AUTO' child log dir, default $TEMP)
11+
user=wowza
12+
13+
; the below section must remain in the config file for RPC
14+
; (supervisorctl/web interface) to work, additional interfaces may be
15+
; added by defining them in separate rpcinterface: sections
16+
[rpcinterface:supervisor]
17+
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
18+
19+
[supervisorctl]
20+
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket
21+
22+
; The [include] section can just contain the "files" setting. This
23+
; setting can list multiple files (separated by whitespace or
24+
; newlines). It can also contain wildcards. The filenames are
25+
; interpreted as relative to this file. Included files *cannot*
26+
; include files themselves.
27+
28+
[include]
29+
files = /etc/supervisor/conf.d/*.conf

0 commit comments

Comments
 (0)