Update permissions from 777 to 1777 (redux)

I somehow missed Debian in 25b3034 (only updated Alpine), so this updates Debian in the same way. > This still supports the "arbitrary user" use case but with slightly tighter permissions on the end result. > > This one is a little bit more "special" other images (due to the existing runtime/entrypoint modification of the directory modes) so I've tried to pick reasonable values for both halves.
docker-library · Nov 30, 2023 · 2468c9d · 2468c9d
1 parent f85674c
commit 2468c9d
Show file tree

Hide file tree

Showing 26 changed files with 52 additions and 52 deletions.
diff --git a/11/alpine3.17/Dockerfile b/11/alpine3.17/Dockerfile
diff --git a/11/alpine3.18/Dockerfile b/11/alpine3.18/Dockerfile
diff --git a/11/bookworm/Dockerfile b/11/bookworm/Dockerfile
diff --git a/11/bullseye/Dockerfile b/11/bullseye/Dockerfile
diff --git a/12/alpine3.17/Dockerfile b/12/alpine3.17/Dockerfile
diff --git a/12/alpine3.18/Dockerfile b/12/alpine3.18/Dockerfile
diff --git a/12/bookworm/Dockerfile b/12/bookworm/Dockerfile
diff --git a/12/bullseye/Dockerfile b/12/bullseye/Dockerfile
diff --git a/13/alpine3.17/Dockerfile b/13/alpine3.17/Dockerfile
diff --git a/13/alpine3.18/Dockerfile b/13/alpine3.18/Dockerfile
diff --git a/13/bookworm/Dockerfile b/13/bookworm/Dockerfile
diff --git a/13/bullseye/Dockerfile b/13/bullseye/Dockerfile
diff --git a/14/alpine3.17/Dockerfile b/14/alpine3.17/Dockerfile
diff --git a/14/alpine3.18/Dockerfile b/14/alpine3.18/Dockerfile
diff --git a/14/bookworm/Dockerfile b/14/bookworm/Dockerfile
diff --git a/14/bullseye/Dockerfile b/14/bullseye/Dockerfile
diff --git a/15/alpine3.17/Dockerfile b/15/alpine3.17/Dockerfile
diff --git a/15/alpine3.18/Dockerfile b/15/alpine3.18/Dockerfile
diff --git a/15/bookworm/Dockerfile b/15/bookworm/Dockerfile
diff --git a/15/bullseye/Dockerfile b/15/bullseye/Dockerfile
diff --git a/16/alpine3.17/Dockerfile b/16/alpine3.17/Dockerfile
diff --git a/16/alpine3.18/Dockerfile b/16/alpine3.18/Dockerfile
diff --git a/16/bookworm/Dockerfile b/16/bookworm/Dockerfile
diff --git a/16/bullseye/Dockerfile b/16/bullseye/Dockerfile
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
@@ -190,7 +190,7 @@ RUN set -eux; \
 RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgresql && chmod 3777 /var/run/postgresql
 
 ENV PGDATA /var/lib/postgresql/data
-# this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
+# this 1777 will be replaced by 0700 at runtime (allows semi-arbitrary "--user" values)
 RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 1777 "$PGDATA"
 VOLUME /var/lib/postgresql/data
 

diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
@@ -173,11 +173,11 @@ RUN set -eux; \
 	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
 	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
 
-RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgresql && chmod 2777 /var/run/postgresql
+RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgresql && chmod 3777 /var/run/postgresql
 
 ENV PGDATA /var/lib/postgresql/data
-# this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
-RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA"
+# this 1777 will be replaced by 0700 at runtime (allows semi-arbitrary "--user" values)
+RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 1777 "$PGDATA"
 VOLUME /var/lib/postgresql/data
 
 COPY docker-entrypoint.sh /usr/local/bin/