Merge branch 'fix-healthcheck-no-port' into 'next'

Docker: Healtcheck and build fixes

Closes #222

See merge request famedly/conduit!277

Dockerfile

@@ -1,9 +1,9 @@
 # syntax=docker/dockerfile:1
-FROM docker.io/rust:1.58-alpine AS builder
+FROM docker.io/rust:1.58-bullseye AS builder
 WORKDIR /usr/src/conduit
 
 # Install required packages to build Conduit and it's dependencies
-RUN apk add musl-dev
+RUN apt update && apt -y install libclang-dev
 
 # == Build dependencies without our own code separately for caching ==
 #
@@ -26,28 +26,27 @@ COPY src src
 # Builds conduit and places the binary at /usr/src/conduit/target/release/conduit
 RUN touch src/main.rs && touch src/lib.rs && cargo build --release
 
-
-
-
 # ---------------------------------------------------------------------------------------------------------------
 # Stuff below this line actually ends up in the resulting docker image
 # ---------------------------------------------------------------------------------------------------------------
-FROM docker.io/alpine:3.15.0 AS runner
+FROM docker.io/debian:bullseye-slim AS runner
 
 # Standard port on which Conduit launches.
 # You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs.
+# Note from @jfowl: I would like to remove the config file in the future and just have the Docker version be configured with envs.
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml" \
+    CONDUIT_PORT=6167
 
 # Conduit needs:
 #   ca-certificates: for https
-#   libgcc: Apparently this is needed, even if I (@jfowl) don't know exactly why. But whatever, it's not that big.
+#   iproute2 & wget: for the healthcheck script
-RUN apk add --no-cache \
+RUN apt update && apt -y install \
     ca-certificates \
-    libgcc
+    iproute2 \
-
+    wget \
+    && rm -rf /var/lib/apt/lists/*
 
 # Created directory for the database and media files
 RUN mkdir -p /srv/conduit/.local/share/conduit
@@ -59,20 +58,20 @@ HEALTHCHECK --start-period=5s --interval=5s CMD ./healthcheck.sh
 # Copy over the actual Conduit binary from the builder stage
 COPY --from=builder /usr/src/conduit/target/release/conduit /srv/conduit/conduit
 
-# Improve security: Don't run stuff as root, that does not need to run as root:
+# Improve security: Don't run stuff as root, that does not need to run as root
-# Add www-data user and group with UID 82, as used by alpine
+# Add 'conduit' user and group (100:82). The UID:GID choice is to be compatible
-# https://git.alpinelinux.org/aports/tree/main/nginx/nginx.pre-install
+# with previous, Alpine-based containers, where the user and group were both
+# named 'www-data'.
 RUN set -x ; \
-    addgroup -Sg 82 www-data 2>/dev/null ; \
+    groupadd -r -g 82 conduit ; \
-    adduser -S -D -H -h /srv/conduit -G www-data -g www-data www-data 2>/dev/null ; \
+    useradd -r -M -d /srv/conduit -o -u 100 -g conduit conduit && exit 0 ; exit 1
-    addgroup www-data www-data 2>/dev/null && exit 0 ; exit 1
 
-# Change ownership of Conduit files to www-data user and group
+# Change ownership of Conduit files to conduit user and group and make the healthcheck executable:
-RUN chown -cR www-data:www-data /srv/conduit
+RUN chown -cR conduit:conduit /srv/conduit && \
-RUN chmod +x /srv/conduit/healthcheck.sh
+    chmod +x /srv/conduit/healthcheck.sh
 
-# Change user to www-data
+# Change user to conduit, no root permissions afterwards:
-USER www-data
+USER conduit
 # Set container home directory
 WORKDIR /srv/conduit
 

conduit-example.toml

@@ -22,6 +22,7 @@ database_backend = "rocksdb"
 # The port Conduit will be running on. You need to set up a reverse proxy in
 # your web server (e.g. apache or nginx), so all requests to /_matrix on port
 # 443 and 8448 will be forwarded to the Conduit instance running on this port
+# Docker users: Don't change this, you'll need to map an external port to this.
 port = 6167
 
 # Max size for uploads

docker/ci-binaries-packaging.Dockerfile

@@ -14,13 +14,16 @@ FROM docker.io/alpine:3.15.0 AS runner
 # You still need to map the port when using the docker command or docker-compose.
 EXPOSE 6167
 
-# Note from @jfowl: I would like to remove this in the future and just have the Docker version be configured with envs. 
+# Note from @jfowl: I would like to remove the config file in the future and just have the Docker version be configured with envs. 
-ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml"
+ENV CONDUIT_CONFIG="/srv/conduit/conduit.toml" \
+    CONDUIT_PORT=6167
 
 # Conduit needs:
 #   ca-certificates: for https
+#   iproute2: for `ss` for the healthcheck script
 RUN apk add --no-cache \
-    ca-certificates
+    ca-certificates \
+    iproute2
 
 
 ARG CREATED

docker/healthcheck.sh

@@ -1,13 +1,9 @@
 #!/bin/sh
 
-# If the port is not specified as env var, take it from the config file
+# If the config file does not contain a default port and the CONDUIT_PORT env is not set, create
+# try to get port from process list
 if [ -z "${CONDUIT_PORT}" ]; then
-  CONDUIT_PORT=$(grep -m1 -o 'port\s=\s[0-9]*' conduit.toml | grep -m1 -o '[0-9]*')
+  CONDUIT_PORT=$(ss -tlpn | grep conduit | grep -m1 -o ':[0-9]*' | grep -m1 -o '[0-9]*')
-fi
-
-# If the config file also does not contain a default port, just use the default one: 6167.
-if [ -z "${CONDUIT_PORT}" ]; then
-  CONDUIT_PORT=6167
 fi
 
 # The actual health check.