EXPOSE 5000
-WORKDIR /keystone
+WORKDIR /app
-COPY scripts/start.sh /keystone/start.sh
+COPY scripts/start.sh /app/start.sh
RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
DEBIAN_FRONTEND=noninteractive apt-get dist-upgrade -y && \
DEBIAN_FRONTEND=noninteractive apt-get install -y \
apache2=2.4.* \
- keystone=2:18.0.* \
+ keystone=2:18.1.* \
libapache2-mod-wsgi-py3=4.6.* \
python3-pip=20.0.* \
build-essential=12.8* \
RUN pip3 install -U pip==21.3.1 && \
pip3 install python-ldap==3.2.0 ldappool==3.0.0 python-openstackclient==5.7.0
+# Creating the user for the app
+RUN groupadd -g 1000 appuser && \
+ useradd -u 1000 -g 1000 -d /app appuser && \
+ usermod -a -G keystone appuser && \
+ usermod -a -G adm appuser && \
+ chown -R appuser:appuser /app && \
+ chown root:keystone /etc/keystone && \
+ chmod 770 /etc/keystone && \
+ chown root:keystone /etc/ssl/certs && \
+ chmod 770 /etc/ssl/certs && \
+ chown root:keystone /etc/apache2/apache2.conf && \
+ chmod 664 /etc/apache2/apache2.conf && \
+ sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \
+ chown root:keystone /var/spool && \
+ chmod 775 /var/spool && \
+ chmod 770 /var/log/apache2 && \
+ chmod 660 /var/log/apache2/* && \
+ chmod 770 /var/log/keystone && \
+ chown root:keystone /var/run/apache2 && \
+ chmod 775 /var/run/apache2 && \
+ mkdir -p /etc/sudoers.d && \
+ echo "%appuser ALL= NOPASSWD: /sbin/service apache2 *" > /etc/sudoers.d/appuser
+
+USER appuser
+
# database
ENV DB_HOST keystone-db
ENV DB_PORT 3306