Skip to content

Commit e953159

Browse files
anarchivistanarchivist
committed
allow supervisord to drop privileges to APP_USER
1 parent 59bf731 commit e953159

File tree

6 files changed

+133
-5
lines changed

6 files changed

+133
-5
lines changed

‎Dockerfile‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ RUN apt-get update -qq
2727
RUN apt-get install -y --no-install-recommends \
2828
curl \
2929
dnsutils \
30+
gettext \
3031
iputils-ping
3132

3233
# =============================================================================
@@ -48,6 +49,11 @@ RUN apt-get install -y --no-install-recommends \
4849
RUN apt-get install -y --no-install-recommends openjdk-21-jre-headless
4950

5051
RUN rm -rf /usr/local/WowzaStreamingEngine/java
52+
53+
# for some reason, OpenJDK's default directory includes the architecture
54+
# name and does not symlink it to something more straightforward like
55+
# /usr/lib/jvm/java-21-openjdk so we have to detect the architecture
56+
5157
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
5258
RUN arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) ln -s "/usr/lib/jvm/java-21-openjdk-${arch}" /usr/local/WowzaStreamingEngine/java
5359

@@ -67,6 +73,10 @@ RUN usermod -u $APP_UID $APP_USER && \
6773
# transfer now-orphaned files to new wowza user (-h to chown symlinks)
6874
RUN find / -xdev -nouser -exec chown -h $APP_USER:$APP_USER {} \;
6975

76+
# set variables to be used by envsubst to overwrite the default wowza config
77+
ENV SUPERVISORD_PID_FILE=/tmp/supervisord.pid
78+
ENV SUPERVISORD_SOCKET_FILE=/tmp/supervisor.sock
79+
7080
# =============================================================================
7181
# Set working directory
7282

@@ -81,7 +91,7 @@ RUN venv/bin/pip3 install unittest-xml-reporting
8191

8292
COPY --chown=$APP_USER test /opt/app/test
8393

84-
# Put artifacts where Jenkins can get at them
94+
# Put artifacts where Github Actions can get at them
8595
RUN mkdir /opt/app/artifacts && \
8696
chown $APP_USER:$APP_USER /opt/app/artifacts
8797

@@ -98,6 +108,7 @@ RUN for app in vod live; \
98108
# Copy our scripts, configs, templates, etc. into the container
99109
COPY --chown=$APP_USER WowzaStreamingEngine /usr/local/WowzaStreamingEngine
100110
COPY --chown=$APP_USER log4j-templates /opt/app/log4j-templates
111+
COPY --chown=$APP_USER etc_templates /opt/app/etc_templates
101112
COPY --chown=$APP_USER bin /opt/app/bin
102113

103114
# =============================================================================
@@ -135,11 +146,10 @@ RUN rm -r /opt/app/WEB-INF
135146
# Uninstall zip
136147
RUN apt-get remove -y zip
137148

138-
# TODO: Fix this? Wowza's default image expects to run Wowza as root.
139149
# =============================================================================
140-
# Run as the wowza user to minimize risk to the host.
141-
142-
# USER $APP_USER
150+
# Unlike most of our containers, this container starts as root as privileges
151+
# are dropped by supervisord instead of setting the `USER` set in the
152+
# Dockerfile.
143153

144154
# =============================================================================
145155
# Default command

‎WowzaStreamingEngine/bin/startup.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
# this is a BerkeleyLibrary modified version of the WSE startup script
3+
4+
# check for root access. If not, put up message and exit
5+
# if [ "$(/usr/bin/id -u)" -ne "0" ] ; then
6+
# echo "The Wowza Streaming Engine requires root access to start. Please run script again using sudo."
7+
# exit
8+
# fi
9+
10+
systemctl >> /dev/null 2>&1
11+
if [ $? -eq 0 ]; then
12+
# Restart XRM service
13+
SERVICE_NAME="xrmd.service"
14+
systemctl list-units --full -all | grep -Fq $SERVICE_NAME
15+
16+
if [ $? -eq 0 ]; then
17+
echo "Restarting XRM service"
18+
systemctl restart $SERVICE_NAME
19+
. /opt/xilinx/xcdr/setup.sh
20+
fi
21+
fi
22+
23+
. /usr/local/WowzaStreamingEngine/bin/setenv.sh
24+
mode=standalone
25+
if [ "$#" -eq 1 ];
26+
then
27+
mode=$1
28+
fi
29+
30+
#chmod 600 /usr/local/WowzaStreamingEngine/conf/jmxremote.password
31+
#chmod 600 /usr/local/WowzaStreamingEngine/conf/jmxremote.access
32+
33+
# NOTE: Here you can configure the JVM's built in JMX interface.
34+
# See the "Server Management Console and Monitoring" chapter
35+
# of the "User's Guide" for more information on how to configure the
36+
# remote JMX interface in the [install-dir]/conf/Server.xml file.
37+
38+
JMXOPTIONS=-Dcom.sun.management.jmxremote=true
39+
#JMXOPTIONS="$JMXOPTIONS -Djava.rmi.server.hostname=192.168.1.7"
40+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.port=1099"
41+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.authenticate=true"
42+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.ssl=false"
43+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.password.file=$WMSCONFIG_HOME/conf/jmxremote.password"
44+
#JMXOPTIONS="$JMXOPTIONS -Dcom.sun.management.jmxremote.access.file=$WMSCONFIG_HOME/conf/jmxremote.access"
45+
46+
ulimit -n 64000 > /dev/null 2>&1
47+
48+
rc=144
49+
while [ $rc -eq 144 ]
50+
do
51+
52+
WMSTUNE_OPTS=`$WMSAPP_HOME/bin/tune.sh $mode`
53+
export LD_PRELOAD=`$WMSAPP_HOME/bin/ldpreload.sh`
54+
55+
# log interceptor com.wowza.wms.logging.LogNotify - see Javadocs for ILogNotify
56+
57+
$_EXECJAVA $WMSTUNE_OPTS $JMXOPTIONS -Dorg.slf4j.simpleLogger.defaultLogLevel=warn -Dcom.wowza.wms.runmode="$mode" -Dcom.wowza.wms.native.base="linux" -Dlog4j.configurationFile="$WMSCONFIG_HOME/conf/log4j2-config.xml" -Dcom.wowza.wms.AppHome="$WMSAPP_HOME" -Dcom.wowza.wms.ConfigURL="$WMSCONFIG_URL" -Dcom.wowza.wms.ConfigHome="$WMSCONFIG_HOME" -cp $WMSAPP_HOME/bin/wms-bootstrap.jar com.wowza.wms.bootstrap.Bootstrap start
58+
59+
rc=$?
60+
if [ $rc -ge 10 ] && [ $rc -le 15 ] ; then
61+
WSE_EXIT_CODE=$rc
62+
$_EXECJAVA $WMSTUNE_OPTS $JMXOPTIONS -Dcom.wowza.wms.runmode="$mode" -Dcom.wowza.wms.native.base="linux" -Dlog4j.configurationFile="$WMSCONFIG_HOME/conf/log4j2-config.xml" -Dcom.wowza.wms.AppHome="$WMSAPP_HOME" -Dcom.wowza.wms.ConfigURL="$WMSCONFIG_URL" -Dcom.wowza.wms.ConfigHome="$WMSCONFIG_HOME" -cp $WMSAPP_HOME/bin/wms-bootstrap.jar com.wowza.wms.bootstrap.Bootstrap startLicenseUpdateServer
63+
rc=$?
64+
fi
65+
done

‎bin/docker-entrypoint.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,12 @@ export WSE_MGR_USER=$WOWZA_MANAGER_USER
3131
export WSE_MGR_PASS=$WOWZA_MANAGER_PASSWORD
3232
export WSE_LIC=$WOWZA_LICENSE_KEY
3333

34+
# use envsubst to transform templates into supervisord config files
35+
echo "Creating supervisord configuration files from templates..."
36+
envsubst < /opt/app/etc_templates/supervisor/supervisord.conf.tmpl > /etc/supervisor/supervisord.conf
37+
envsubst < /opt/app/etc_templates/supervisor/conf.d/WowzaStreamingEngine.conf.tmpl > /etc/supervisor/conf.d/WowzaStreamingEngine.conf
38+
envsubst < /opt/app/etc_templates/supervisor/conf.d/WowzaStreamingEngineManager.conf.tmpl > /etc/supervisor/conf.d/WowzaStreamingEngineManager.conf
39+
3440
# ########################################
3541
# Start server and manager by handing off to Wowza's entrypoint
3642

‎etc_templates/supervisor/conf.d/WowzaStreamingEngine.conf.tmpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[program:WowzaStreamingEngine]
2+
priority=10
3+
directory=/usr/local/WowzaStreamingEngine/bin
4+
command=/usr/local/WowzaStreamingEngine/bin/startup.sh
5+
user=${APP_USER}
6+
autostart=true
7+
autorestart=true
8+
stdout_logfile=/usr/local/supervisor/supervisorStdOut.log
9+
stderr_logfile=/usr/local/supervisor/supervisorStdErr.log

‎etc_templates/supervisor/conf.d/WowzaStreamingEngineManager.conf.tmpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[program:WowzaStreamingEngineManager]
2+
priority=20
3+
directory=/usr/local/WowzaStreamingEngine/manager/bin
4+
command=/usr/local/WowzaStreamingEngine/manager/bin/startmgr.sh
5+
user=${APP_USER}
6+
autostart=true
7+
autorestart=true
8+
stdout_logfile=/usr/local/supervisor/supervisorStdOut.log
9+
stderr_logfile=/usr/local/supervisor/supervisorStdErr.log

‎etc_templates/supervisor/supervisord.conf.tmpl‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
; supervisor config file
2+
3+
[unix_http_server]
4+
file=${SUPERVISORD_SOCKET_FILE} ; (the path to the socket file)
5+
chmod=0700 ; sockef file mode (default 0700)
6+
7+
[supervisord]
8+
logfile=/usr/local/supervisor/supervisord.log ;
9+
pidfile=${SUPERVISORD_PID_FILE} ; (supervisord pidfile;default supervisord.pid)
10+
childlogdir=/var/log/supervisor ; ('AUTO' child log dir, default $TEMP)
11+
user=${APP_USER}
12+
13+
; the below section must remain in the config file for RPC
14+
; (supervisorctl/web interface) to work, additional interfaces may be
15+
; added by defining them in separate rpcinterface: sections
16+
[rpcinterface:supervisor]
17+
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
18+
19+
[supervisorctl]
20+
serverurl=unix://${SUPERVISORD_SOCKET_FILE} ; use a unix:// URL for a unix socket
21+
22+
; The [include] section can just contain the "files" setting. This
23+
; setting can list multiple files (separated by whitespace or
24+
; newlines). It can also contain wildcards. The filenames are
25+
; interpreted as relative to this file. Included files *cannot*
26+
; include files themselves.
27+
28+
[include]
29+
files = /etc/supervisor/conf.d/*.conf

0 commit comments

Comments
 (0)