{"id":16540757,"url":"https://github.com/itzg/entrypoint-demoter","last_synced_at":"2025-03-15T11:33:24.946Z","repository":{"id":39878721,"uuid":"196653113","full_name":"itzg/entrypoint-demoter","owner":"itzg","description":"Container entry point that can demote uid and gid from environment variables or matching directory","archived":false,"fork":false,"pushed_at":"2025-02-12T13:01:46.000Z","size":52,"stargazers_count":11,"open_issues_count":5,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-27T01:11:12.643Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/itzg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-12T22:28:55.000Z","updated_at":"2025-02-12T13:01:09.000Z","dependencies_parsed_at":"2023-12-31T23:19:21.855Z","dependency_job_id":"d9915ea9-a528-4dcb-9cba-7d2bb224d1d4","html_url":"https://github.com/itzg/entrypoint-demoter","commit_stats":{"total_commits":36,"total_committers":3,"mean_commits":12.0,"dds":"0.13888888888888884","last_synced_commit":"1b86d84e401f2a9613ef69b713bd47b92e3a1b22"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itzg%2Fentrypoint-demoter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itzg%2Fentrypoint-demoter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itzg%2Fentrypoint-demoter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/itzg%2Fentrypoint-demoter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/itzg","download_url":"https://codeload.github.com/itzg/entrypoint-demoter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243725078,"owners_count":20337660,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-11T18:53:15.187Z","updated_at":"2025-03-15T11:33:24.438Z","avatar_url":"https://github.com/itzg.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![CircleCI](https://circleci.com/gh/itzg/entrypoint-demoter.svg?style=svg)](https://circleci.com/gh/itzg/entrypoint-demoter)\n[![GitHub release](https://img.shields.io/github/release/itzg/entrypoint-demoter.svg)](https://github.com/itzg/entrypoint-demoter/releases/latest)\n\n# Motivation\n\nIt is  highly recommended that processes within containers do not run as root in order to \n[prevent container breakouts](https://developer.okta.com/blog/2019/07/18/container-security-a-developer-guide#prevent-container-breakouts); however, that\ngoal is hard to maintain when attached volumes come into play. For example, \n[Synology's DiskStation](https://www.synology.com/en-us/dsm)\nmanages ownership of attachable volumes as regular UNIX users; however, its Docker integration\ndoesn't allow for aligning the container's user with what is normally `-u` on the `docker run`\ncommand-line.\n\n`entrypoint-demoter` solves this types of scenarios by allowing the container to momentarily run as \nroot, but demote the initial sub-command to either match the ownership of a given path or be \nexplicitly defined by `UID`/`GID` environment variables.\n\n# Usage\n\nThe command line arguments remaining after the options below are used to execute a \nsub-command with the demoted user ID (uid) and group ID (gid).\n\nIf executed as a non-root user, then this tool skips demoting entirely and just executes\nthe sub-command with the current uid and gid.\n\n## Environment variables\n\n- `UID` : if set, demotes the sub-command to run with the given user ID\n- `GID` : if set, demotes the sub-command to run with the given group ID\n\n## Command-line\n\n- `--match PATH` : uses the ownership of the given path to determine a user and group ID\n- `--stdin-on-term MESSAGE` : some applications prefer to be gracefully stopped with a command on\n   stdin rather than handling SIGTERM, such as Minecraft servers. \n   The `MESSAGE` and a newline will be written to the sub-command's stdin when a `TERM` signal is received.\n- `--debug` : enables debug logging\n- `--version` : show version and exit\n\n# Example\n\nThe following shows how to use `entrypoint-demoter` in a Debian based Dockerfile. The `entry.sh`\nwould be where your own entry point script/application would be specified.\n\n```Dockerfile\nARG DEMOTER_VERSION=0.1.0\nARG DEMOTER_ARCH=amd64\n\nADD https://github.com/itzg/entrypoint-demoter/releases/download/${DEMOTER_VERSION}/entrypoint-demoter_${DEMOTER_VERSION}_linux_${DEMOTER_ARCH}.deb /usr/src\n\nRUN dpkg -i /usr/src/entrypoint-demoter_${DEMOTER_VERSION}_linux_${DEMOTER_ARCH}.deb\n\nENTRYPOINT [\"/usr/local/bin/entrypoint-demoter\", \"--match\", \"/data\", \"/entry.sh\"]\n```\n\n\u003e The full context of this example can be seen [in this Dockerfile](https://github.com/itzg/docker-minecraft-bedrock-server/blob/master/Dockerfile)\n\n# Testing\n\nOn a Linux system with Make and Docker installed invoke:\n\n```\nmake test\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitzg%2Fentrypoint-demoter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fitzg%2Fentrypoint-demoter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fitzg%2Fentrypoint-demoter/lists"}