OpenCloud
/
element-web
mirror of https://github.com/vector-im/element-web
1
0
Fork 0
Code Issues Releases Wiki Activity

Docker: run as non-root (#28849) 

* Docker: allow configuration of HTTP listen port via env var

* Update docs/install.md

Co-authored-by: Michael Telatynski <7t3chguy@gmail.com>

* prettier

* Docker: run as non-root

* Simplify sed incantation

---------

Co-authored-by: Michael Telatynski <7t3chguy@gmail.com>
pull/28878/head
Richard van der Hoff 2025-01-03 22:54:52 +00:00 committed by GitHub
parent cf49f9e22c
commit 3fb10baedf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Dockerfile
View File

@ -1,5 +1,5 @@
# Builder # Builder
FROM --platform=$BUILDPLATFORM node:22-bullseye as builder FROM --platform=$BUILDPLATFORM node:22-bullseye AS builder
# Support custom branch of the js-sdk. This also helps us build images of element-web develop. # Support custom branch of the js-sdk. This also helps us build images of element-web develop.
ARG USE_CUSTOM_SDKS=false ARG USE_CUSTOM_SDKS=false
@ -25,8 +25,18 @@ COPY --from=builder /src/webapp /app
# through `envsubst` by the nginx docker image entry point. # through `envsubst` by the nginx docker image entry point.
COPY /docker/nginx-templates/* /etc/nginx/templates/ COPY /docker/nginx-templates/* /etc/nginx/templates/
# Tell nginx to put its pidfile elsewhere, so it can run as non-root
RUN sed -i -e 's,/var/run/nginx.pid,/tmp/nginx.pid,' /etc/nginx/nginx.conf
# nginx user must own the cache and etc directory to write cache and tweak the nginx config
RUN chown -R nginx:0 /var/cache/nginx /etc/nginx
RUN chmod -R g+w /var/cache/nginx /etc/nginx
RUN rm -rf /usr/share/nginx/html \ RUN rm -rf /usr/share/nginx/html \
&& ln -s /app /usr/share/nginx/html && ln -s /app /usr/share/nginx/html
# Run as nginx user by default
USER nginx
# HTTP listen port # HTTP listen port
ENV ELEMENT_WEB_PORT=80 ENV ELEMENT_WEB_PORT=80

6
docs/install.md
View File

@ -60,6 +60,12 @@ would be:
docker run --rm -p 127.0.0.1:80:80 -v /etc/element-web/config.json:/app/config.json vectorim/element-web docker run --rm -p 127.0.0.1:80:80 -v /etc/element-web/config.json:/app/config.json vectorim/element-web
``` ```
The Docker image is configured to run as an unprivileged (non-root) user by
default. This should be fine on modern Docker runtimes, but binding to port 80
on other runtimes may require root privileges. To resolve this, either run the
image as root (`docker run --user 0`) or, better, change the port that nginx
listens on via the `ELEMENT_WEB_PORT` environment variable.
The behaviour of the docker image can be customised via the following The behaviour of the docker image can be customised via the following
environment variables: environment variables: