JOJ/runner-images
21
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enforce correct permission in Dockerfile
Some checks failed
push / build (push) Failing after 7m13s
Details

Browse Source
This commit is contained in:
张泊明518370910136 2025-10-25 08:32:39 -07:00
parent da0aa9d407
commit d2e8ebf5f4
Signed by: 张泊明518370910136
GPG Key ID: CA088E6D9284F870
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Dockerfile
View File

@ -2,16 +2,12 @@ FROM focs.ji.sjtu.edu.cn:5000/gitea/runner-images:ubuntu-latest-slim
ENV TZ="Asia/Shanghai" ENV TZ="Asia/Shanghai"
# install packages
RUN sed -i s@/deb.debian.org/@/mirrors.tuna.tsinghua.edu.cn/@g /etc/apt/sources.list.d/debian.sources && \ RUN sed -i s@/deb.debian.org/@/mirrors.tuna.tsinghua.edu.cn/@g /etc/apt/sources.list.d/debian.sources && \
apt-get update && \ apt-get update && \
apt-get install -y --no-install-recommends sudo python3-minimal python3-pip git git-lfs openssh-client rsync && \ apt-get install -y --no-install-recommends sudo python3-minimal python3-pip git git-lfs openssh-client rsync && \
apt-get clean && \ apt-get clean && \
rm -rf /var/lib/apt/lists/* && \ rm -rf /var/lib/apt/lists/*
userdel -r node && \
useradd -u 1000 -ms /bin/bash tt && \
useradd -u 1001 -ms /bin/bash student && \
usermod -aG student tt && \
echo "student ALL=(tt) NOPASSWD:SETENV:/usr/local/bin/joj3,/usr/local/bin/joj3-forge-convert\ntt ALL=(student) NOPASSWD:SETENV:ALL" > /etc/sudoers.d/joj
# install joint-teapot && joj3-forge # install joint-teapot && joj3-forge
RUN pip install --no-cache-dir --break-system-packages \ RUN pip install --no-cache-dir --break-system-packages \
@ -21,6 +17,17 @@ RUN pip install --no-cache-dir --break-system-packages \
# install joj3 & repo-health-checker & joj3-forge-convert # install joj3 & repo-health-checker & joj3-forge-convert
COPY bin/joj3 bin/repo-health-checker bin/joj3-forge-convert /usr/local/bin/ COPY bin/joj3 bin/repo-health-checker bin/joj3-forge-convert /usr/local/bin/
RUN chmod +x /usr/local/bin/joj3 /usr/local/bin/repo-health-checker /usr/local/bin/joj3-forge-convert
# set permissions
RUN userdel -r node && \
useradd -u 1000 -ms /bin/bash tt && \
useradd -u 1001 -ms /bin/bash student && \
usermod -aG student tt && \
chmod 700 /home/tt /home/student && \
echo "student ALL=(tt) NOPASSWD:SETENV:/usr/local/bin/joj3,/usr/local/bin/joj3-forge-convert\ntt ALL=(student) NOPASSWD:SETENV:ALL" > /etc/sudoers.d/joj && \
chmod 440 /etc/sudoers.d/joj
# entry setup
USER student USER student
WORKDIR /home/student WORKDIR /home/student