bd9e8c22d7
This uses the grouping feature of sudo to limit the amount of times the base sudo file has to be modified to only once. The container contents always runs as the user root, except the software which is controlled by Kolla. This software may run as root, but it has undergone a security audit and preserves permissions of the correct files and does not permit the glance user to write any of the set_config.py control files. Change-Id: Ie3cd23edcde5b408a8f66970456279a1b15028e0 Partially-Implements: blueprint drop-root
48 lines
1.3 KiB
Django/Jinja
48 lines
1.3 KiB
Django/Jinja
FROM {{ namespace }}/{{ image_prefix }}openstack-base:{{ tag }}
|
|
MAINTAINER Kolla Project (https://launchpad.net/kolla)
|
|
|
|
{% if install_type == 'binary' %}
|
|
{% if base_distro in ['centos', 'fedora', 'oraclelinux', 'rhel'] %}
|
|
|
|
RUN yum -y install \
|
|
openstack-glance \
|
|
python-oslo-i18n \
|
|
python-castellan \
|
|
python-cryptography \
|
|
python-rbd \
|
|
python-rados \
|
|
&& yum clean all \
|
|
&& mkdir -p /etc/ceph/
|
|
|
|
{% endif %}
|
|
{% elif install_type == 'source' %}
|
|
{% if base_distro in ['centos', 'fedora', 'oraclelinux', 'rhel'] %}
|
|
|
|
RUN yum -y install \
|
|
python-rbd \
|
|
python-rados \
|
|
&& yum clean all \
|
|
&& mkdir -p /etc/ceph/
|
|
|
|
{% elif base_distro in ['ubuntu', 'debian'] %}
|
|
|
|
RUN apt-get install -y --no-install-recommends \
|
|
python-rbd \
|
|
python-rados \
|
|
&& apt-get clean \
|
|
&& mkdir -p /etc/ceph/
|
|
|
|
{% endif %}
|
|
|
|
ADD glance-base-archive /glance-base-source
|
|
RUN ln -s glance-base-source/* glance \
|
|
&& useradd --user-group glance \
|
|
&& pip --no-cache-dir install -c requirements/upper-constraints.txt /glance \
|
|
&& mkdir -p /etc/glance /var/log/glance /home/glance \
|
|
&& cp -r /glance/etc/* /etc/glance/ \
|
|
&& chown -R glance: /etc/glance /var/log/glance /home/glance
|
|
|
|
{% endif %}
|
|
|
|
RUN usermod -a -G kolla glance
|