Commit 44ba5c78 authored by Fabio Luchetti's avatar Fabio Luchetti
Browse files

add eos-nobody user and use the rpm provided forwardable keytab

parent 5e052130
Pipeline #2628403 skipped with stage
......@@ -31,7 +31,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often.
......@@ -79,15 +79,13 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8.
RUN yum install -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
RUN chown daemon:daemon /var/spool/xrootd
......
......@@ -26,7 +26,7 @@ COPY xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Install XRootD
ENV XRD_VERSION 4.12.7
......@@ -43,13 +43,10 @@ RUN yum -y --nogpg update \
xrootd-server-libs-$XRD_VERSION \
&& yum clean all
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
......
......@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often.
......@@ -70,13 +70,10 @@ RUN createrepo ${EOSREPODIR} \
RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb; else yum -y --nogpg install eos-quarkdb; fi
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"]
......@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Note: Docker will aggressively cache the following command.
# However, these packages don't change often
......@@ -88,13 +88,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8.
RUN dnf -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
......
......@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often.
......@@ -79,13 +79,10 @@ RUN echo -e "export EOS_COVERAGE_REPORT=1" >> /etc/sysconfig/eos
RUN mkdir -p /root/rpmbuild/BUILD/ \
&& cp -r --preserve /usr/src/debug/eos-* /root/rpmbuild/BUILD/
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"]
......@@ -34,7 +34,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Note: Docker will aggressively cache the following command.
# However, these packages don't change often
......@@ -90,13 +90,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8.
RUN dnf -y --nogpg install xrootd-client
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
......
......@@ -32,7 +32,7 @@ RUN sed -i "s/__EOS_CODENAME__/${EOS_CODENAME}/g" /etc/yum.repos.d/eos.repo
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often.
......@@ -83,13 +83,10 @@ RUN if [ "${EOS_CODENAME}" != "diopside" ]; then yum -y --nogpg install quarkdb;
# fails. This happens on CC7 and C8.
RUN yum install -y --nogpg install xrootd-client-4.11.3
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
......
......@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
ENV DEBIAN_FRONTEND noninteractive
......
......@@ -21,7 +21,7 @@ COPY eos-docker/fstfmd.dict /var/eos/md/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
ENV DEBIAN_FRONTEND noninteractive
......
......@@ -26,7 +26,7 @@ COPY eos-docker/xrootd-fwd-proxy.cfg /etc/xrootd/
RUN mkdir /var/tmp/eosxd-cache/ /var/tmp/eosxd-journal/
RUN adduser eos-user
RUN adduser eos-user && adduser eosnobody
# Docker will aggressively cache the following command, but this is fine, since
# these packages are not updated often.
......@@ -62,13 +62,10 @@ RUN createrepo ${EOSREPODIR} \
eos-archive eos-client eos-fuse eos-fusex eos-ns-inspect eos-server eos-test eos-testkeytab \
&& yum clean all
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package).
# This is useful to deploy EOS on Kubernetes clusters running on CERN's Cloud
# Infrastructure; you can remove these lines if you don't need one.
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
ENTRYPOINT ["/bin/bash"]
......@@ -34,13 +34,10 @@ RUN sed -i "s|/usr/bin/xrdcp|/opt/eos/xrootd/bin/xrdcp|g" /etc/xrd.cf.fst
# Install some much needed utility: please bloat with care!
RUN yum -y --nogpg install nano redis && yum clean all && rm -rf /var/cache/yum
# Generate a new forwardable keytab 'eos-test+' to replace the not-forwardable
# one (installed by the eos-testkeytab package). This is mmostly useful to deploy EOS
# on containerized envoronments; you can remove these lines if you don't need one.
# @todo review: what about not installing eos-testkeytab at all?
RUN yes | xrdsssadmin -k eos-test del /etc/eos.keytab \
&& yes | xrdsssadmin -u daemon -g daemon -k eos-test+ -n 1234567890123456789 add /etc/eos.keytab \
&& chown daemon:daemon /etc/eos.keytab \
# Swap and use the forwardable keytab (installed by the eos-testkeytab package).
# This is useful for clients who reside on a private network and tunnel through a
# Network Address Translation (NAT) device. You can remove these lines if you don't need them.
RUN mv -f /etc/eos.keytab.fw /etc/eos.keytab \
&& chmod 400 /etc/eos.keytab
# Change owner of /var/spool/xrootd directory to daemon
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment