15308555518/ MaxKB
1
0
Fork 0
mirror of https://github.com/1Panel-dev/MaxKB.git synced 2025-12-25 17:22:55 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

security: minimize permission of sandbox user

This commit is contained in:
liqiang-fit2cloud 2024-12-17 11:53:52 +08:00
parent a42848d183
commit b7cac7defc
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/build-and-push.yml vendored
View File

@ -7,7 +7,7 @@ on:
inputs:
dockerImageTag:
description: 'Docker Image Tag'
default: 'v1.6.0-dev'
default: 'v1.9.0-dev'
required: true
architecture:
description: 'Architecture'

11
installer/Dockerfile
View File

@ -60,13 +60,14 @@ RUN chmod 755 /opt/maxkb/app/installer/run-maxkb.sh && \
cp -r /opt/maxkb/model/base/hub /opt/maxkb/model/tokenizer && \
cp -f /opt/maxkb/app/installer/run-maxkb.sh /usr/bin/run-maxkb.sh && \
cp -f /opt/maxkb/app/installer/init.sql /docker-entrypoint-initdb.d && \
curl -L --connect-timeout 120 -m 1800 https://resource.fit2cloud.com/maxkb/ffmpeg/get-ffmpeg-linux | sh && \
mkdir -p /opt/maxkb/app/sandbox/python-packages && \
find /opt/maxkb/app -mindepth 1 -not -name 'sandbox' -exec chmod 700 {} + && \
chmod 755 /tmp && \
useradd --no-create-home --home /opt/maxkb/app/sandbox --shell /bin/bash sandbox && \
chown sandbox:sandbox /opt/maxkb/app/sandbox && \
curl -L --connect-timeout 120 -m 1800 https://resource.fit2cloud.com/maxkb/ffmpeg/get-ffmpeg-linux | sh
chmod 755 /tmp && \
useradd --no-create-home --home /opt/maxkb/app/sandbox sandbox -g root && \
chown -R sandbox:root /opt/maxkb/app/sandbox && \
chmod g-x /usr/local/bin/* /usr/bin/* /bin/* /usr/sbin/* /sbin/* /usr/lib/postgresql/15/bin/* && \
chmod g+x /usr/local/bin/python* /bin/sh
EXPOSE 8080