mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
UNITRONIX
0f161181f1
Privilege separation across all installers so the long-running services no longer run with full administrative rights: betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too. betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1. Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec). Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles. This commit was made possible thanks to Insolve.
78 lines
2.4 KiB
Docker
78 lines
2.4 KiB
Docker
# Dockerfile for BetterDesk Server (Go)
|
|
# Multi-stage build: compile from source, then copy to minimal runtime image
|
|
#
|
|
# The BetterDesk server is a single binary that replaces both hbbs and hbbr.
|
|
# It provides: signal (UDP/TCP/WS), relay (TCP/WS), HTTP API, admin console.
|
|
#
|
|
# Build: docker build -f Dockerfile.server -t betterdesk-server:local .
|
|
|
|
# ---- Build stage ----
|
|
FROM golang:1.25-alpine AS builder
|
|
|
|
RUN apk add --no-cache git || { sleep 2 && apk add --no-cache git; }
|
|
|
|
WORKDIR /src
|
|
|
|
# Copy Go module files first (cache dependencies)
|
|
COPY betterdesk-server/go.mod betterdesk-server/go.sum ./
|
|
|
|
RUN go mod download
|
|
|
|
# Copy full source
|
|
COPY betterdesk-server/ .
|
|
|
|
# Build static binary (modernc.org/sqlite is pure Go — no CGO needed)
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-ldflags="-s -w" \
|
|
-tags "netgo osusergo" \
|
|
-o /betterdesk-server .
|
|
|
|
# ---- Runtime stage ----
|
|
FROM alpine:3.20
|
|
|
|
LABEL maintainer="UNITRONIX"
|
|
LABEL description="BetterDesk Server - RustDesk-compatible signal + relay"
|
|
LABEL version="2.4.0"
|
|
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
curl \
|
|
sqlite \
|
|
tini \
|
|
su-exec \
|
|
|| { sleep 2 && apk add --no-cache \
|
|
ca-certificates curl sqlite tini su-exec; } \
|
|
&& addgroup -g 10001 -S betterdesk \
|
|
&& adduser -u 10001 -S -G betterdesk betterdesk
|
|
|
|
COPY --from=builder /betterdesk-server /usr/local/bin/betterdesk-server
|
|
RUN chmod +x /usr/local/bin/betterdesk-server
|
|
|
|
# Create data directory
|
|
RUN mkdir -p /opt/rustdesk && chown betterdesk:betterdesk /opt/rustdesk
|
|
|
|
# Entrypoint script: fixes volume permissions, then drops to betterdesk user
|
|
COPY docker/server-entrypoint.sh /server-entrypoint.sh
|
|
RUN chmod +x /server-entrypoint.sh
|
|
|
|
WORKDIR /opt/rustdesk
|
|
|
|
# Ports:
|
|
# 21121 - HTTP API (RustDesk client API + REST)
|
|
# 21115 - NAT type test
|
|
# 21116 - Signal (TCP+UDP)
|
|
# 21117 - Relay (TCP)
|
|
# 21118 - WebSocket Signal
|
|
# 21119 - WebSocket Relay
|
|
EXPOSE 21115 21116/tcp 21116/udp 21117 21118 21119 21121
|
|
|
|
# Health check via API
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
|
|
CMD curl -sf http://localhost:21121/api/health || exit 1
|
|
|
|
# Note: Container starts as root so entrypoint can fix volume permissions.
|
|
# server-entrypoint.sh drops to betterdesk user via su-exec before running the server.
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/server-entrypoint.sh"]
|
|
CMD ["/usr/local/bin/betterdesk-server", "-mode", "all", "-key-file", "/opt/rustdesk/id_ed25519"]
|