From 1f47ecbc59560a536d472491a0f5117d4bc456cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Tue, 16 May 2023 15:02:52 +0200 Subject: [PATCH 01/24] add Dockerfile based on @promasu 's work --- Dockerfile | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..0b8de1aff --- /dev/null +++ b/Dockerfile @@ -0,0 +1,51 @@ +# Multistage build to reduce image size and increase security +FROM node:lts-alpine AS build + +# Install requirements to clone repository and install deps +RUN apk add --no-cache git +RUN npm install -g bower + +# Create folder for cryptpad +RUN mkdir /cryptpad +WORKDIR /cryptpad + +# Get cryptpad from repository submodule +COPY . /cryptpad + +RUN sed -i "s@//httpAddress: '::'@httpAddress: '0.0.0.0'@" /cryptpad/config/config.example.js +RUN sed -i "s@installMethod: 'unspecified'@installMethod: 'docker-alpine'@" /cryptpad/config/config.example.js + +# Install dependencies +RUN npm install --production \ + && npm install -g bower \ + && bower install --allow-root + +# Create actual cryptpad image +FROM node:lts-alpine + +# Create user and group for cryptpad so it does not run as root +RUN addgroup -g 4001 -S cryptpad \ + && adduser -u 4001 -S -D -g 4001 -H -h /cryptpad cryptpad + +# Copy cryptpad with installed modules +COPY --from=build --chown=cryptpad /cryptpad /cryptpad +USER cryptpad + +# Set workdir to cryptpad +WORKDIR /cryptpad + +# Create directories +RUN mkdir blob block customize data datastore + +# Volumes for data persistence +VOLUME /cryptpad/blob +VOLUME /cryptpad/block +VOLUME /cryptpad/customize +VOLUME /cryptpad/data +VOLUME /cryptpad/datastore + +# Ports +EXPOSE 3000 3001 + +# Run cryptpad on startup +CMD ["npm", "start"] From faf367f25ff194ca7d8b194cb38e32766c46ee21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Wed, 17 May 2023 09:42:26 +0200 Subject: [PATCH 02/24] add image update & publishing workflows --- .github/workflows/publish-release.yml | 69 +++++++++++++++++++++++++++ .github/workflows/publish.yml | 66 +++++++++++++++++++++++++ 2 files changed, 135 insertions(+) create mode 100644 .github/workflows/publish-release.yml create mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml new file mode 100644 index 000000000..2310a8e02 --- /dev/null +++ b/.github/workflows/publish-release.yml @@ -0,0 +1,69 @@ +# Needs secrets to be set for Docker Hub: +# DH_REGISTRY_USER +# DH_REGISTRY_PASSWORD +on: + push: + tags: [ '*' ] + +env: + BUILDX_NO_DEFAULT_ATTESTATIONS: 1 + IMAGE_NAME: ${{ github.repository_owner }}/cryptpad + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@1e95c1de343b5b0c23352d6417ee3e48d5bcd422 + with: + cosign-release: 'v1.13.1' + + # Use QEmu for multi architecture build + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + + # Workaround: https://github.com/docker/build-push-action/issues/461 + - name: Setup Docker buildx + uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf + + # Login against Docker registry + # https://github.com/docker/login-action + - name: Log into registry + uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c + with: + username: ${{ secrets.DH_REGISTRY_USER }} + password: ${{ secrets.DH_REGISTRY_PASSWORD }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 + with: + images: ${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc + with: + context: . + platforms: linux/amd64,linux/arm64 + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 000000000..d9c040ab7 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,66 @@ +on: + push: + branches: [ main ] + tags: [ '*' ] + pull_request: + branches: [ main ] + +env: + BUILDX_NO_DEFAULT_ATTESTATIONS: 1 + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository_owner }}/cryptpad + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + with: + submodules: recursive + + # Use QEmu for multi architecture build + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + + # Workaround: https://github.com/docker/build-push-action/issues/461 + - name: Setup Docker buildx + uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ${{ env.REGISTRY }} + if: github.event_name != 'pull_request' + uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc + with: + context: . + platforms: linux/amd64,linux/arm64 + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} From 8af292c407f10953bb75246ff79e9982c21147b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 1 Jun 2023 13:19:03 +0200 Subject: [PATCH 03/24] add basic docker-compose file --- docker-compose.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 docker-compose.yml diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 000000000..f94c35172 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,28 @@ +--- +version: '3.8' + +services: + cryptpad: + image: "crytpad/cryptpad:latest" + hostname: cryptpad + + environment: + - CPAD_MAIN_DOMAIN=example.com + - CPAD_SANDBOX_DOMAIN=sandbox.example.com + + volumes: + - ./data/blob:/cryptpad/blob + - ./data/block:/cryptpad/block + - ./customize:/cryptpad/customize + - ./data/data:/cryptpad/data + - ./data/files:/cryptpad/datastore + - ./data/config.js:/cryptpad/config/config.js + + ports: + - "3000:3000" + - "3001:3001" + + ulimits: + nofile: + soft: 1000000 + hard: 1000000 From 58524e9d7e007862bb336782191707aa08240b86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 1 Jun 2023 16:00:21 +0200 Subject: [PATCH 04/24] add basic dockerignore to reduce image size --- .dockerignore | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..e7d60a793 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,9 @@ +.dockerignore +.git +.gitignore +.gitmodules +.github +docker-compose.yml +traefik2.yml +Dockerfile* +*.png From b756b31cd58785f73ef998841f8742f0dccca7fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 14:54:01 +0200 Subject: [PATCH 05/24] update .gitignore to allow .sh files --- .gitignore | 1 - 1 file changed, 1 deletion(-) diff --git a/.gitignore b/.gitignore index 3ef8d2e15..c58bb5639 100644 --- a/.gitignore +++ b/.gitignore @@ -22,4 +22,3 @@ block/ logs/ privileged.conf config/config.js -*.sh From 8fbb4dc2526710ab33b87f2028764a79e4b4b7ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 14:54:34 +0200 Subject: [PATCH 06/24] add basic entrypoint.sh file to set domains and admin email --- docker-entrypoint.sh | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 docker-entrypoint.sh diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh new file mode 100644 index 000000000..5d76afb10 --- /dev/null +++ b/docker-entrypoint.sh @@ -0,0 +1,41 @@ +#/bin/sh + +## Required vars +# CPAD_MAIN_DOMAIN +# CPAD_SANDBOX_DOMAIN +# CPAD_ADMIN_EMAIL +# CPAD_CONF + +set -e + +CPAD_HOME="/cryptpad" + +# If cryptad conf isn't provided +if [ ! -f "$CPAD_CONF" ]; then + echo -e "\n\ + ############################################### \n\ + Warning: No config file provided for CryptPad \n\ + We will create a basic one for now but you should rerun this service \n\ + by providing a file with your settings \n\ + eg: docker run -v /path/to/config.js:/cryptpad/config/config.js \n\ + ############################################### \n" + + cp $CPAD_HOME/config/config.example.js $CPAD_CONF + + # Set domains + sed -i -e "s@\(httpUnsafeOrigin:\).*[^,]@\1 'https://$CPAD_MAIN_DOMAIN'@" \ + -e "s@\(^ *\).*\(httpSafeOrigin:\).*[^,]@\1\2 'https://$CPAD_SANDBOX_DOMAIN'@" $CPAD_CONF + + # Set admin email + if [ -z "$CPAD_ADMIN_EMAIL" ]; then + echo "Error: Missing admin email (Did you read the config?)" + exit 1 + else + sed -i "s@\(adminEmail:\).*[^,]@\1 '$CPAD_ADMIN_EMAIL'@" $CPAD_CONF + fi + fi + +cd $CPAD_HOME +npm run build + +exec "$@" From eed556865e7231c8b9125cc8996a4eadf7514976 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 15:02:20 +0200 Subject: [PATCH 07/24] switch to testing image & add email parameter --- docker-compose.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index f94c35172..3221b9d04 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,12 +3,13 @@ version: '3.8' services: cryptpad: - image: "crytpad/cryptpad:latest" + image: "crytpad/cryptpad:testing" hostname: cryptpad environment: - CPAD_MAIN_DOMAIN=example.com - CPAD_SANDBOX_DOMAIN=sandbox.example.com + - CPAD_ADMIN_EMAIL=username@example.com volumes: - ./data/blob:/cryptpad/blob From cd0ca6fa88ef67d6aad2739996406b5c1f9be734 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 15:05:50 +0200 Subject: [PATCH 08/24] add entrypoint.sh to Dockerfile --- Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Dockerfile b/Dockerfile index 0b8de1aff..f09269755 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,6 +31,9 @@ RUN addgroup -g 4001 -S cryptpad \ COPY --from=build --chown=cryptpad /cryptpad /cryptpad USER cryptpad +# Copy docker-entrypoint.sh script +COPY docker-entrypoint.sh /docker-entrypoint.sh + # Set workdir to cryptpad WORKDIR /cryptpad From 909cba230cb726638277d70e6a18cc97744bd4b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 15:06:20 +0200 Subject: [PATCH 09/24] add proper access rights to created folders --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f09269755..e8be648b0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -38,7 +38,8 @@ COPY docker-entrypoint.sh /docker-entrypoint.sh WORKDIR /cryptpad # Create directories -RUN mkdir blob block customize data datastore +RUN mkdir blob block customize data datastore \ + && chown cryptpad:cryptpad blob block customize data datastore # Volumes for data persistence VOLUME /cryptpad/blob From b6b7044d09096dda6097cb9621f380ec14220315 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 15:07:05 +0200 Subject: [PATCH 10/24] forgot to activate entrypoint.sh at the end of Dockerfile --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index e8be648b0..6a23c3ebe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -51,5 +51,7 @@ VOLUME /cryptpad/datastore # Ports EXPOSE 3000 3001 +ENTRYPOINT ["/bin/sh", "/docker-entrypoint.sh"] + # Run cryptpad on startup CMD ["npm", "start"] From 9d3265ee042155bee327aac1d3e6d653340b68ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 16:06:16 +0200 Subject: [PATCH 11/24] chown not needed here for Alpine based images --- Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6a23c3ebe..0df3e30f1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -38,8 +38,7 @@ COPY docker-entrypoint.sh /docker-entrypoint.sh WORKDIR /cryptpad # Create directories -RUN mkdir blob block customize data datastore \ - && chown cryptpad:cryptpad blob block customize data datastore +RUN mkdir blob block customize data datastore # Volumes for data persistence VOLUME /cryptpad/blob From 811e2be6e64e0931194dc3dab0d4e7556ccc73c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Thu, 22 Jun 2023 16:06:43 +0200 Subject: [PATCH 12/24] fix typo in image namespace --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 3221b9d04..13beb1997 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.8' services: cryptpad: - image: "crytpad/cryptpad:testing" + image: "cryptpad/cryptpad:testing" hostname: cryptpad environment: From 032b094b7532a2bba91f51da46c14b94b7ab8855 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 23 Jun 2023 14:31:37 +0200 Subject: [PATCH 13/24] switch from Alpine images to Debian --- Dockerfile | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/Dockerfile b/Dockerfile index 0df3e30f1..43582ba53 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,8 @@ # Multistage build to reduce image size and increase security -FROM node:lts-alpine AS build +FROM node:lts-slim AS build # Install requirements to clone repository and install deps -RUN apk add --no-cache git +RUN apt update && DEBIAN_FRONTEND=noninteractive apt install -yq git RUN npm install -g bower # Create folder for cryptpad @@ -13,7 +13,7 @@ WORKDIR /cryptpad COPY . /cryptpad RUN sed -i "s@//httpAddress: '::'@httpAddress: '0.0.0.0'@" /cryptpad/config/config.example.js -RUN sed -i "s@installMethod: 'unspecified'@installMethod: 'docker-alpine'@" /cryptpad/config/config.example.js +RUN sed -i "s@installMethod: 'unspecified'@installMethod: 'docker'@" /cryptpad/config/config.example.js # Install dependencies RUN npm install --production \ @@ -21,18 +21,18 @@ RUN npm install --production \ && bower install --allow-root # Create actual cryptpad image -FROM node:lts-alpine +FROM node:lts-slim # Create user and group for cryptpad so it does not run as root -RUN addgroup -g 4001 -S cryptpad \ - && adduser -u 4001 -S -D -g 4001 -H -h /cryptpad cryptpad +RUN groupadd cryptpad -g 4001 +RUN useradd cryptpad -u 4001 -g 4001 -d /cryptpad # Copy cryptpad with installed modules COPY --from=build --chown=cryptpad /cryptpad /cryptpad USER cryptpad # Copy docker-entrypoint.sh script -COPY docker-entrypoint.sh /docker-entrypoint.sh +COPY --chown=cryptpad docker-entrypoint.sh /cryptpad/docker-entrypoint.sh # Set workdir to cryptpad WORKDIR /cryptpad @@ -47,10 +47,11 @@ VOLUME /cryptpad/customize VOLUME /cryptpad/data VOLUME /cryptpad/datastore +ENTRYPOINT ["/bin/bash", "/cryptpad/docker-entrypoint.sh"] + # Ports EXPOSE 3000 3001 -ENTRYPOINT ["/bin/sh", "/docker-entrypoint.sh"] - # Run cryptpad on startup CMD ["npm", "start"] + From 0cb2f42b3367a49f8b58ff16ab98ea24fc6bc833 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 23 Jun 2023 14:32:01 +0200 Subject: [PATCH 14/24] make entrypoint script working with Debian, remove outdated parts --- docker-entrypoint.sh | 29 ++++++++++------------------- 1 file changed, 10 insertions(+), 19 deletions(-) mode change 100644 => 100755 docker-entrypoint.sh diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh old mode 100644 new mode 100755 index 5d76afb10..94889a263 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -1,4 +1,4 @@ -#/bin/sh +#/bin/bash ## Required vars # CPAD_MAIN_DOMAIN @@ -10,32 +10,23 @@ set -e CPAD_HOME="/cryptpad" -# If cryptad conf isn't provided if [ ! -f "$CPAD_CONF" ]; then - echo -e "\n\ - ############################################### \n\ - Warning: No config file provided for CryptPad \n\ + echo -e "\n\ + #################################################################### \n\ + Warning: No config file provided for cryptpad \n\ We will create a basic one for now but you should rerun this service \n\ by providing a file with your settings \n\ eg: docker run -v /path/to/config.js:/cryptpad/config/config.js \n\ - ############################################### \n" + #################################################################### \n" - cp $CPAD_HOME/config/config.example.js $CPAD_CONF +cp "$CPAD_HOME"/config/config.example.js "$CPAD_CONF" - # Set domains - sed -i -e "s@\(httpUnsafeOrigin:\).*[^,]@\1 'https://$CPAD_MAIN_DOMAIN'@" \ - -e "s@\(^ *\).*\(httpSafeOrigin:\).*[^,]@\1\2 'https://$CPAD_SANDBOX_DOMAIN'@" $CPAD_CONF - - # Set admin email - if [ -z "$CPAD_ADMIN_EMAIL" ]; then - echo "Error: Missing admin email (Did you read the config?)" - exit 1 - else - sed -i "s@\(adminEmail:\).*[^,]@\1 '$CPAD_ADMIN_EMAIL'@" $CPAD_CONF - fi - fi +sed -i -e "s@\(httpUnsafeOrigin:\).*[^,]@\1 'https://$CPAD_MAIN_DOMAIN'@" \ + -e "s@\(^ *\).*\(httpSafeOrigin:\).*[^,]@\1\2 'https://$CPAD_SANDBOX_DOMAIN'@" $CPAD_CONF +fi cd $CPAD_HOME npm run build exec "$@" + From 7218a2c96a3daa7945e8aa44203e63f72d4f5892 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 23 Jun 2023 14:32:27 +0200 Subject: [PATCH 15/24] make docker-compose work with entrypoint script --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 13beb1997..4bc3b6fcf 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,13 +3,14 @@ version: '3.8' services: cryptpad: - image: "cryptpad/cryptpad:testing" + image: "cryptpad/cryptpad:latest" hostname: cryptpad environment: - CPAD_MAIN_DOMAIN=example.com - CPAD_SANDBOX_DOMAIN=sandbox.example.com - CPAD_ADMIN_EMAIL=username@example.com + - CPAD_CONF=/cryptpad/config/config.js volumes: - ./data/blob:/cryptpad/blob @@ -17,7 +18,6 @@ services: - ./customize:/cryptpad/customize - ./data/data:/cryptpad/data - ./data/files:/cryptpad/datastore - - ./data/config.js:/cryptpad/config/config.js ports: - "3000:3000" From db975b8fdeae2d5bccfca03a049ac083808f6089 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 23 Jun 2023 15:06:46 +0200 Subject: [PATCH 16/24] remove useless variable for admin email --- docker-compose.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 4bc3b6fcf..a45d9ce04 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,7 +9,6 @@ services: environment: - CPAD_MAIN_DOMAIN=example.com - CPAD_SANDBOX_DOMAIN=sandbox.example.com - - CPAD_ADMIN_EMAIL=username@example.com - CPAD_CONF=/cryptpad/config/config.js volumes: From 712a01af8053c8bdac75b9afe29ad90dc3ea02ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 7 Jul 2023 09:21:21 +0200 Subject: [PATCH 17/24] update Docker section in readme.md --- readme.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/readme.md b/readme.md index 0c8ee4623..66c261006 100644 --- a/readme.md +++ b/readme.md @@ -22,7 +22,9 @@ The most recent version and all past release notes can be found [here](https://g ## Setup using Docker -See [CryptPad-Docker](https://github.com/xwiki-labs/cryptpad-docker) repository for details on how to get up-and-running with CryptPad in Docker. This repository is maintained by the community and not officially supported. +You can find `Dockerfile`, `docker-compose.yml` and `docker-entrypoint.sh` files at the root of this repository. We also publish every release on [Docker Hub](https://hub.docker.com/r/cryptpad/cryptpad) as AMD64 & ARM64 official images. + +Previously, Docker images were community maintained, had their own repository and weren't official supported. We changed that with v5.4.0 during July 2023. Thanks to @promasu for all the work on the community images. # Security From 0a9f01ad7f66f3d9b9a9680945c8383cf1228526 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 7 Jul 2023 11:21:35 +0200 Subject: [PATCH 18/24] update comment for better explanations --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 43582ba53..bc78155dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,15 +1,15 @@ # Multistage build to reduce image size and increase security FROM node:lts-slim AS build -# Install requirements to clone repository and install deps +# Install requirements for dependencies management RUN apt update && DEBIAN_FRONTEND=noninteractive apt install -yq git RUN npm install -g bower -# Create folder for cryptpad +# Create folder for CryptPad RUN mkdir /cryptpad WORKDIR /cryptpad -# Get cryptpad from repository submodule +# Copy CryptPad source code to the container COPY . /cryptpad RUN sed -i "s@//httpAddress: '::'@httpAddress: '0.0.0.0'@" /cryptpad/config/config.example.js @@ -20,10 +20,10 @@ RUN npm install --production \ && npm install -g bower \ && bower install --allow-root -# Create actual cryptpad image +# Create actual CryptPad image FROM node:lts-slim -# Create user and group for cryptpad so it does not run as root +# Create user and group for CryptPad so it does not run as root RUN groupadd cryptpad -g 4001 RUN useradd cryptpad -u 4001 -g 4001 -d /cryptpad From b72c76fe88d82b760ef1a237a6ea7515a14b8918 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 7 Jul 2023 11:32:39 +0200 Subject: [PATCH 19/24] remove uneeded and duplicated entries --- Dockerfile | 5 ----- 1 file changed, 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index bc78155dd..e6a86cc5c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,6 @@ # Multistage build to reduce image size and increase security FROM node:lts-slim AS build -# Install requirements for dependencies management -RUN apt update && DEBIAN_FRONTEND=noninteractive apt install -yq git -RUN npm install -g bower - # Create folder for CryptPad RUN mkdir /cryptpad WORKDIR /cryptpad @@ -54,4 +50,3 @@ EXPOSE 3000 3001 # Run cryptpad on startup CMD ["npm", "start"] - From 8ce3891c0b8f2dd71f2ea67724c80d316add1044 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 7 Jul 2023 11:51:56 +0200 Subject: [PATCH 20/24] have domain examples matching the administrator guide --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index a45d9ce04..756116de4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,8 +7,8 @@ services: hostname: cryptpad environment: - - CPAD_MAIN_DOMAIN=example.com - - CPAD_SANDBOX_DOMAIN=sandbox.example.com + - CPAD_MAIN_DOMAIN=https://your-main-domain.com + - CPAD_SANDBOX_DOMAIN=https://your-sandbox-domain.com - CPAD_CONF=/cryptpad/config/config.js volumes: From aee32e0e788103a8069ca2295deb8e1916a20d13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Fri, 7 Jul 2023 11:52:32 +0200 Subject: [PATCH 21/24] add the possibility to run without TLS for testing locally --- docker-entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index 94889a263..3dcff3288 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -21,8 +21,8 @@ if [ ! -f "$CPAD_CONF" ]; then cp "$CPAD_HOME"/config/config.example.js "$CPAD_CONF" -sed -i -e "s@\(httpUnsafeOrigin:\).*[^,]@\1 'https://$CPAD_MAIN_DOMAIN'@" \ - -e "s@\(^ *\).*\(httpSafeOrigin:\).*[^,]@\1\2 'https://$CPAD_SANDBOX_DOMAIN'@" $CPAD_CONF +sed -i -e "s@\(httpUnsafeOrigin:\).*[^,]@\1 '$CPAD_MAIN_DOMAIN'@" \ + -e "s@\(^ *\).*\(httpSafeOrigin:\).*[^,]@\1\2 '$CPAD_SANDBOX_DOMAIN'@" $CPAD_CONF fi cd $CPAD_HOME From b5983b9fe709ffa2ceb24257236c53b051cf26cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Tue, 11 Jul 2023 10:05:14 +0200 Subject: [PATCH 22/24] remove Bower support & use NPM --- Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index e6a86cc5c..cd20586ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,8 +13,7 @@ RUN sed -i "s@installMethod: 'unspecified'@installMethod: 'docker'@" /cryptpad/c # Install dependencies RUN npm install --production \ - && npm install -g bower \ - && bower install --allow-root + && npm run install:components # Create actual CryptPad image FROM node:lts-slim From 775b63db1a4a3b5db213de045843bdaafc1b7bfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Tue, 11 Jul 2023 10:09:06 +0200 Subject: [PATCH 23/24] use 5.4.0 tag for images --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 756116de4..bf7eca9a4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.8' services: cryptpad: - image: "cryptpad/cryptpad:latest" + image: "cryptpad/cryptpad:version-5.4.0" hostname: cryptpad environment: From 83064550c60e181dd22de811b013694ff27ce73a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= Date: Wed, 12 Jul 2023 14:30:54 +0200 Subject: [PATCH 24/24] forgot to remove old outdated comment in file header --- docker-entrypoint.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index 3dcff3288..f123ec316 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -3,7 +3,6 @@ ## Required vars # CPAD_MAIN_DOMAIN # CPAD_SANDBOX_DOMAIN -# CPAD_ADMIN_EMAIL # CPAD_CONF set -e