gsadmin/rustguac
1
0
Fork 0
mirror of https://github.com/sol1/rustguac.git synced 2026-09-10 01:26:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Docker writable paths for non-root user (#57)

Browse Source 
Pre-create certs/, drives/, scripts/ dirs and chown them to the
rustguac user. Also chown the top-level /opt/rustguac dir (non-recursive)
so startup loaders can write config.toml and cert material without
needing root.
This commit is contained in:
Dave Kempe
2026-03-12 21:12:18 +11:00
parent d559da5775
commit 991a8cf9e6
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+11 -6
View File
@@ -106,8 +106,9 @@ COPY static/ /opt/rustguac/static/
# Library path for guacd
RUN echo "/opt/rustguac/lib" > /etc/ld.so.conf.d/rustguac.conf && ldconfig
# Create data directories
RUN mkdir -p /opt/rustguac/data /opt/rustguac/recordings /opt/rustguac/tls
# Create writable runtime directories
RUN mkdir -p /opt/rustguac/data /opt/rustguac/recordings /opt/rustguac/tls \
/opt/rustguac/certs /opt/rustguac/drives /opt/rustguac/scripts
# Chromium policy: web session hardening.
# DeveloperToolsAvailability=0: CDP needed for login scripts. Users can't reach DevTools
@@ -141,9 +142,13 @@ key_path = "/opt/rustguac/tls/key.pem"
guacd_cert_path = "/opt/rustguac/tls/cert.pem"
EOF
# Set ownership so the non-root user can write to data dirs and read certs
RUN chown -R rustguac:rustguac /opt/rustguac/data /opt/rustguac/recordings \
/opt/rustguac/tls /opt/rustguac/config.toml.default
# Set ownership so the non-root user can write to runtime dirs.
# The top-level dir is chowned (not recursive) so loaders can create config.toml;
# subdirs are chowned recursively for data, certs, etc.
RUN chown rustguac:rustguac /opt/rustguac && \
chown -R rustguac:rustguac /opt/rustguac/data /opt/rustguac/recordings \
/opt/rustguac/tls /opt/rustguac/certs /opt/rustguac/drives \
/opt/rustguac/scripts /opt/rustguac/config.toml.default
# Entrypoint script: starts guacd in background, then rustguac in foreground
RUN cat > /opt/rustguac/entrypoint.sh <<'SCRIPT'
@@ -193,7 +198,7 @@ RUN chmod +x /opt/rustguac/entrypoint.sh
WORKDIR /opt/rustguac
EXPOSE 8089
VOLUME ["/opt/rustguac/data", "/opt/rustguac/recordings"]
VOLUME ["/opt/rustguac/data", "/opt/rustguac/recordings", "/opt/rustguac/drives"]
ENV RUST_LOG=info
ENV GUACD_LOG_LEVEL=info