KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(scripts): grind-stack fidelity - readonly rootfs, chown, sbom cmd

Browse Source 
- emulate the Cloudron 8 app contract: --read-only + /tmp,/run tmpfs
- chown /app/data to the image uid (localstorage contract)
- wire the previously unreachable sbom subcommand into dispatch
- probe containers use --entrypoint (images wrap start.sh)

Umbrella: https://projects.knownelement.com/issues/632
This commit is contained in:
vpengops
2026-09-07 10:02:16 -05:00
parent 17a3e8e9c0
commit 26f335ed5a
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/grind-stack.sh
+13 -1
View File
@@ -75,10 +75,21 @@ cmd_up() {
$(label_args) redis:7-alpine --requirepass testrd >/dev/null ;; $(label_args) redis:7-alpine --requirepass testrd >/dev/null ;;
esac esac
# emulate the Cloudron localstorage contract: /app/data is chowned to the
# app container's user (Cloudron does this in apptask before every start).
# --entrypoint is required: package images wrap everything in start.sh.
APP_UID="$(docker run --rm --entrypoint id --cgroup-parent "$SLICE" $(label_args) "grind-$APPNAME:test" -u 2>/dev/null || echo 0)"
APP_GID="$(docker run --rm --entrypoint id --cgroup-parent "$SLICE" $(label_args) "grind-$APPNAME:test" -g 2>/dev/null || echo 0)"
docker run --rm --user 0 --entrypoint chown --cgroup-parent "$SLICE" $(label_args) \
-v "grind-$APPNAME-data:/app/data" "grind-$APPNAME:test" \
-R "${APP_UID}:${APP_GID}" /app/data >/dev/null
# the same env contract Cloudron injects, pointed at the test services. # the same env contract Cloudron injects, pointed at the test services.
# Read-only rootfs + writable /tmp,/run matches the Cloudron 8 app contract.
# No --rm on the app: a crashed container must keep its logs for `logs`. # No --rm on the app: a crashed container must keep its logs for `logs`.
docker run -d --name "$APP" --cgroup-parent "$SLICE" --network "$NET" \ docker run -d --name "$APP" --cgroup-parent "$SLICE" --network "$NET" \
$(label_args) -v "grind-$APPNAME-data:/app/data" \ $(label_args) -v "grind-$APPNAME-data:/app/data" \
--read-only --tmpfs /tmp --tmpfs /run \
-p "127.0.0.1:$TESTPORT:$PORT" \ -p "127.0.0.1:$TESTPORT:$PORT" \
-e CLOUDRON_POSTGRESQL_HOST="$PG" -e CLOUDRON_POSTGRESQL_PORT=5432 \ -e CLOUDRON_POSTGRESQL_HOST="$PG" -e CLOUDRON_POSTGRESQL_PORT=5432 \
-e CLOUDRON_POSTGRESQL_DATABASE=testdb -e CLOUDRON_POSTGRESQL_USERNAME=testdb \ -e CLOUDRON_POSTGRESQL_DATABASE=testdb -e CLOUDRON_POSTGRESQL_USERNAME=testdb \
@@ -161,6 +172,7 @@ case "${1:-preflight}" in
logs) cmd_logs ;; logs) cmd_logs ;;
down) cmd_down ;; down) cmd_down ;;
sweep) shift; cmd_sweep "$@" ;; sweep) shift; cmd_sweep "$@" ;;
sbom) shift; cmd_sbom "$@" ;;
preflight) cmd_preflight ;; preflight) cmd_preflight ;;
*) echo "usage: $0 up <pkg-dir> | curl [path] | logs | down | sweep <pkg-dir> | preflight"; exit 2 ;; *) echo "usage: $0 up <pkg-dir> | curl [path] | logs | down | sweep <pkg-dir> | sbom <pkg-dir> | preflight"; exit 2 ;;
esac esac