allow image to run as any non-root user/group, fixes #10
This commit is contained in:
parent
7326e27e8c
commit
0928070a04
3 changed files with 2 additions and 9 deletions
|
@ -36,8 +36,8 @@ RUN \
|
|||
&& mkfifo \
|
||||
/etc/s6/services/nginx/supervise/control \
|
||||
/etc/s6/services/php-fpm8/supervise/control \
|
||||
&& adduser nobody www-data \
|
||||
&& chown -R nobody.www-data /etc/s6 /run /srv/* /var/lib/nginx /var/www \
|
||||
&& chown -R 65534:82 /etc/s6 /run /srv/* /var/lib/nginx /var/www \
|
||||
&& chmod o+rwx /run /var/lib/nginx /var/lib/nginx/tmp \
|
||||
# Clean up
|
||||
&& rm -rf "${GNUPGHOME}" /tmp/* \
|
||||
&& apk del gnupg
|
||||
|
|
|
@ -1,6 +1,3 @@
|
|||
# Run as a unique, less privileged user for security reasons.
|
||||
user nobody www-data;
|
||||
|
||||
# Sets the worker threads to the number of CPU cores available in the system for best performance.
|
||||
# Should be > the number of CPU cores.
|
||||
# Maximum number of connections = worker_processes * worker_connections
|
||||
|
|
|
@ -3,11 +3,7 @@ daemonize = no
|
|||
error_log = /dev/stderr
|
||||
|
||||
[www]
|
||||
user = nobody
|
||||
group = www-data
|
||||
listen = /run/php-fpm.sock
|
||||
listen.owner = nobody
|
||||
listen.group = www-data
|
||||
access.log = /dev/null
|
||||
clear_env = On
|
||||
pm = dynamic
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue