Merge pull request #917 from linuxserver/mod-scripts-ro

Support ro and user operation
This commit is contained in:
Adam
2024-07-02 13:57:41 +01:00
committed by GitHub
2 changed files with 51 additions and 14 deletions
+1
View File
@@ -2,6 +2,7 @@
These files are used by Linuxserver build processes to handle mods in our images. Not for end-user consumption.
* **26.06.24:** - Add RO and User handlers.
* **10.06.24:** - Move lsiown to its own file. Remove support for legacy v2 and hybrid mods.
* **13.04.24:** - Let lsiown ignore broken symlinks (requires gnu find).
* **26.03.24:** - Add versioning and debug logging to package install script, force venv creation when python packages are to be installed.
+50 -14
View File
@@ -7,7 +7,7 @@
# 2022-09-25 - Initial Release
# 2024-04-13 - Let lsiown ignore broken symlinks (requires gnu find)
# 2024-06-12 - Remove lsiown and legacy s6 handlers
MOD_SCRIPT_VER="3.20240612"
MOD_SCRIPT_VER="3.20240626"
# Define custom folder paths
SCRIPTS_DIR="/custom-cont-init.d"
@@ -434,7 +434,7 @@ run_mods_local() {
run_branding() {
# intentional tabs in the heredoc
cat <<-EOF >/etc/s6-overlay/s6-rc.d/init-adduser/branding
cat <<-EOF | tee /run/branding /etc/s6-overlay/s6-rc.d/init-adduser/branding > /dev/null 2>&1
───────────────────────────────────────
██╗ ███████╗██╗ ██████╗
@@ -449,23 +449,59 @@ run_branding() {
EOF
}
# Run alias creation functions
create_with_contenv_alias
# Main script loop
if [[ -d "${SCRIPTS_DIR}" ]] || [[ -d "${SERVICES_DIR}" ]]; then
tamper_check
process_custom_services
if grep -qEe ' / \w+ ro' /proc/mounts; then
printf '1' > /run/s6/container_environment/LSIO_READ_ONLY_FS
LSIO_READ_ONLY_FS=1
fi
# Run mod logic
if [[ -n "${DOCKER_MODS+x}" ]] && [[ "${DOCKER_MODS_SIDELOAD,,}" = "true" ]]; then
run_mods_local
elif [[ -n "${DOCKER_MODS+x}" ]]; then
curl_check
run_mods
if [[ ! $(stat /run -c %u) == "0" ]]; then
printf '1' > /run/s6/container_environment/LSIO_NON_ROOT_USER
LSIO_NON_ROOT_USER=1
fi
if [[ "${LSIO_FIRST_PARTY}" = "true" ]]; then
run_branding
fi
if [[ -z ${LSIO_READ_ONLY_FS} ]] && [[ -z ${LSIO_NON_ROOT_USER} ]]; then
# Run alias creation functions
create_with_contenv_alias
if [[ -d "${SCRIPTS_DIR}" ]] || [[ -d "${SERVICES_DIR}" ]]; then
tamper_check
process_custom_services
fi
# Run mod logic
if [[ -n "${DOCKER_MODS+x}" ]] && [[ "${DOCKER_MODS_SIDELOAD,,}" = "true" ]]; then
run_mods_local
elif [[ -n "${DOCKER_MODS+x}" ]]; then
curl_check
run_mods
fi
elif [[ -n ${LSIO_READ_ONLY_FS} ]] && [[ -n ${LSIO_NON_ROOT_USER} ]]; then
echo "╔═════════════════════════════════════════════════════════════════════════╗
║ ║
║ You are running this container read-only and as a non-root user: ║
║ This combination of settings is not supported ║
║ and may result in unwanted behaviour. ║
║ ║
╚═════════════════════════════════════════════════════════════════════════╝"
elif [[ -n ${LSIO_READ_ONLY_FS} ]]; then
echo "╔═════════════════════════════════════════════════════════════════════════╗
║ ║
║ You are running this container read-only: ║
║ UMASK, custom services, & docker mod functionality will be disabled ║
║ and the PUID/PGID environment variables will have no effect. ║
║ ║
╚═════════════════════════════════════════════════════════════════════════╝"
elif [[ -n ${LSIO_NON_ROOT_USER} ]]; then
echo "╔═════════════════════════════════════════════════════════════════════════╗
║ ║
║ You are running this container as a non-root user: ║
║ UMASK, custom services, & docker mod functionality will be disabled ║
║ and the PUID/PGID environment variables will have no effect. ║
║ ║
╚═════════════════════════════════════════════════════════════════════════╝"
fi