almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-28 18:02:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

running dangerzone without root in container

Browse source 
There was previously a user created in the container but it was not
used via the dockerfile RUN directive (as pointed out by
gmarmstrong[1]).

Fixes #169

[1]: https://github.com/freedomofpress/dangerzone/issues/169#issue-1268399245
This commit is contained in:
deeplow 2022-08-15 11:10:02 +01:00
parent 2d4bad680e
commit 21a9a6c98c
No known key found for this signature in database
GPG key ID: 577982871529A52A
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
container/Dockerfile
View file

@ -91,7 +91,8 @@ COPY dangerzone.py /usr/local/bin/
RUN chmod +x /usr/local/bin/dangerzone.py RUN chmod +x /usr/local/bin/dangerzone.py
# Add the unprivileged user # Add the unprivileged user
RUN adduser -h /home/user -s /bin/sh -D user RUN adduser -s /bin/sh -D dangerzone
USER dangerzone
# /tmp/input_file is where the first convert expects the input file to be, and # /tmp/input_file is where the first convert expects the input file to be, and
# /tmp where it will write the pixel files # /tmp where it will write the pixel files

3
dangerzone/container.py
View file

@ -85,11 +85,13 @@ def convert(input_filename, output_filename, ocr_lang, stdout_callback):
# drop all linux kernel capabilities # drop all linux kernel capabilities
security_args += ["--cap-drop", "all"] security_args += ["--cap-drop", "all"]
user_args = ["-u", "dangerzone"]
# Convert document to pixels # Convert document to pixels
args = ( args = (
["run", "--network", "none"] ["run", "--network", "none"]
+ platform_args + platform_args
+ user_args
+ security_args + security_args
+ [ + [
"-v", "-v",
@ -113,6 +115,7 @@ def convert(input_filename, output_filename, ocr_lang, stdout_callback):
["run", "--network", "none"] ["run", "--network", "none"]
+ platform_args + platform_args
+ security_args + security_args
+ user_args
+ [ + [
"-v", "-v",
f"{pixel_dir}:/dangerzone", f"{pixel_dir}:/dangerzone",