Skip to content

Commit ec0cb4d

Browse files
yosifkityosifkit
authored
Merge pull request #71 from infosiftr/protected-mode-redux
Redo "protected-mode" enablement in a way that preserves "save on SIGTERM"
2 parents ab53760 + 71807ba commit ec0cb4d

File tree

6 files changed

+66
-91
lines changed

6 files changed

+66
-91
lines changed

‎3.2/32bit/Dockerfile

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,40 @@ ENV REDIS_DOWNLOAD_SHA1 92d6d93ef2efc91e595c8bf578bf72baff397507
2727
RUN apt-get update && apt-get install -y libc6-i386 --no-install-recommends && rm -rf /var/lib/apt/lists/*
2828

2929
# for redis-sentinel see: http://redis.io/topics/sentinel
30-
RUN buildDeps='gcc gcc-multilib libc6-dev-i386 make' \
31-
&& set -x \
32-
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends \
30+
RUN set -ex \
31+
\
32+
&& buildDeps=' \
33+
gcc \
34+
gcc-multilib \
35+
libc6-dev-i386 \
36+
make \
37+
' \
38+
&& apt-get update \
39+
&& apt-get install -y $buildDeps --no-install-recommends \
3340
&& rm -rf /var/lib/apt/lists/* \
41+
\
3442
&& wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL" \
3543
&& echo "$REDIS_DOWNLOAD_SHA1 *redis.tar.gz" | sha1sum -c - \
3644
&& mkdir -p /usr/src/redis \
3745
&& tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1 \
3846
&& rm redis.tar.gz \
47+
\
48+
# Disable Redis protected mode [1] as it is unnecessary in context
49+
# of Docker. Ports are not automatically exposed when running inside
50+
# Docker, but rather explicitely by specifying -p / -P.
51+
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
52+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 1$' /usr/src/redis/src/server.h \
53+
&& sed -ri 's!^(#define CONFIG_DEFAULT_PROTECTED_MODE) 1$!\1 0!' /usr/src/redis/src/server.h \
54+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 0$' /usr/src/redis/src/server.h \
55+
# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"
56+
# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840
57+
# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)
58+
\
3959
&& make -C /usr/src/redis 32bit \
4060
&& make -C /usr/src/redis install \
61+
\
4162
&& rm -r /usr/src/redis \
63+
\
4264
&& apt-get purge -y --auto-remove $buildDeps
4365

4466
RUN mkdir /data && chown redis:redis /data

‎3.2/32bit/docker-entrypoint.sh

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,32 +13,4 @@ if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
1313
exec gosu redis "$0" "$@"
1414
fi
1515

16-
if [ "$1" = 'redis-server' ]; then
17-
# Disable Redis protected mode [1] as it is unnecessary in context
18-
# of Docker. Ports are not automatically exposed when running inside
19-
# Docker, but rather explicitely by specifying -p / -P.
20-
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
21-
doProtectedMode=1
22-
configFile=
23-
if [ -f "$2" ]; then
24-
configFile="$2"
25-
if grep -q '^protected-mode' "$configFile"; then
26-
# if a config file is supplied and explicitly specifies "protected-mode", let it win
27-
doProtectedMode=
28-
fi
29-
fi
30-
if [ "$doProtectedMode" ]; then
31-
shift # "redis-server"
32-
if [ "$configFile" ]; then
33-
shift
34-
fi
35-
set -- --protected-mode no "$@"
36-
if [ "$configFile" ]; then
37-
set -- "$configFile" "$@"
38-
fi
39-
set -- redis-server "$@" # redis-server [config file] --protected-mode no [other options]
40-
# if this is supplied again, the "latest" wins, so "--protected-mode no --protected-mode yes" will result in an enabled status
41-
fi
42-
fi
43-
4416
exec "$@"

‎3.2/Dockerfile

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,39 @@ ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-3.2.3.tar.gz
2525
ENV REDIS_DOWNLOAD_SHA1 92d6d93ef2efc91e595c8bf578bf72baff397507
2626

2727
# for redis-sentinel see: http://redis.io/topics/sentinel
28-
RUN buildDeps='gcc libc6-dev make' \
29-
&& set -x \
30-
&& apt-get update && apt-get install -y $buildDeps --no-install-recommends \
28+
RUN set -ex \
29+
\
30+
&& buildDeps=' \
31+
gcc \
32+
libc6-dev \
33+
make \
34+
' \
35+
&& apt-get update \
36+
&& apt-get install -y $buildDeps --no-install-recommends \
3137
&& rm -rf /var/lib/apt/lists/* \
38+
\
3239
&& wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL" \
3340
&& echo "$REDIS_DOWNLOAD_SHA1 *redis.tar.gz" | sha1sum -c - \
3441
&& mkdir -p /usr/src/redis \
3542
&& tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1 \
3643
&& rm redis.tar.gz \
44+
\
45+
# Disable Redis protected mode [1] as it is unnecessary in context
46+
# of Docker. Ports are not automatically exposed when running inside
47+
# Docker, but rather explicitely by specifying -p / -P.
48+
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
49+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 1$' /usr/src/redis/src/server.h \
50+
&& sed -ri 's!^(#define CONFIG_DEFAULT_PROTECTED_MODE) 1$!\1 0!' /usr/src/redis/src/server.h \
51+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 0$' /usr/src/redis/src/server.h \
52+
# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"
53+
# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840
54+
# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)
55+
\
3756
&& make -C /usr/src/redis \
3857
&& make -C /usr/src/redis install \
58+
\
3959
&& rm -r /usr/src/redis \
60+
\
4061
&& apt-get purge -y --auto-remove $buildDeps
4162

4263
RUN mkdir /data && chown redis:redis /data

‎3.2/alpine/Dockerfile

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,21 +11,37 @@ ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-3.2.3.tar.gz
1111
ENV REDIS_DOWNLOAD_SHA1 92d6d93ef2efc91e595c8bf578bf72baff397507
1212

1313
# for redis-sentinel see: http://redis.io/topics/sentinel
14-
RUN set -x \
14+
RUN set -ex \
15+
\
1516
&& apk add --no-cache --virtual .build-deps \
1617
gcc \
1718
linux-headers \
1819
make \
1920
musl-dev \
2021
tar \
22+
\
2123
&& wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL" \
2224
&& echo "$REDIS_DOWNLOAD_SHA1 *redis.tar.gz" | sha1sum -c - \
2325
&& mkdir -p /usr/src/redis \
2426
&& tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1 \
2527
&& rm redis.tar.gz \
28+
\
29+
# Disable Redis protected mode [1] as it is unnecessary in context
30+
# of Docker. Ports are not automatically exposed when running inside
31+
# Docker, but rather explicitely by specifying -p / -P.
32+
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
33+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 1$' /usr/src/redis/src/server.h \
34+
&& sed -ri 's!^(#define CONFIG_DEFAULT_PROTECTED_MODE) 1$!\1 0!' /usr/src/redis/src/server.h \
35+
&& grep -q '^#define CONFIG_DEFAULT_PROTECTED_MODE 0$' /usr/src/redis/src/server.h \
36+
# for future reference, we modify this directly in the source instead of just supplying a default configuration flag because apparently "if you specify any argument to redis-server, [it assumes] you are going to specify everything"
37+
# see also https://github.com/docker-library/redis/issues/4#issuecomment-50780840
38+
# (more exactly, this makes sure the default behavior of "save on SIGTERM" stays functional by default)
39+
\
2640
&& make -C /usr/src/redis \
2741
&& make -C /usr/src/redis install \
42+
\
2843
&& rm -r /usr/src/redis \
44+
\
2945
&& apk del .build-deps
3046

3147
RUN mkdir /data && chown redis:redis /data

‎3.2/alpine/docker-entrypoint.sh

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,32 +13,4 @@ if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
1313
exec su-exec redis "$0" "$@"
1414
fi
1515

16-
if [ "$1" = 'redis-server' ]; then
17-
# Disable Redis protected mode [1] as it is unnecessary in context
18-
# of Docker. Ports are not automatically exposed when running inside
19-
# Docker, but rather explicitely by specifying -p / -P.
20-
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
21-
doProtectedMode=1
22-
configFile=
23-
if [ -f "$2" ]; then
24-
configFile="$2"
25-
if grep -q '^protected-mode' "$configFile"; then
26-
# if a config file is supplied and explicitly specifies "protected-mode", let it win
27-
doProtectedMode=
28-
fi
29-
fi
30-
if [ "$doProtectedMode" ]; then
31-
shift # "redis-server"
32-
if [ "$configFile" ]; then
33-
shift
34-
fi
35-
set -- --protected-mode no "$@"
36-
if [ "$configFile" ]; then
37-
set -- "$configFile" "$@"
38-
fi
39-
set -- redis-server "$@" # redis-server [config file] --protected-mode no [other options]
40-
# if this is supplied again, the "latest" wins, so "--protected-mode no --protected-mode yes" will result in an enabled status
41-
fi
42-
fi
43-
4416
exec "$@"

‎3.2/docker-entrypoint.sh

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,32 +13,4 @@ if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
1313
exec gosu redis "$0" "$@"
1414
fi
1515

16-
if [ "$1" = 'redis-server' ]; then
17-
# Disable Redis protected mode [1] as it is unnecessary in context
18-
# of Docker. Ports are not automatically exposed when running inside
19-
# Docker, but rather explicitely by specifying -p / -P.
20-
# [1] https://github.com/antirez/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da
21-
doProtectedMode=1
22-
configFile=
23-
if [ -f "$2" ]; then
24-
configFile="$2"
25-
if grep -q '^protected-mode' "$configFile"; then
26-
# if a config file is supplied and explicitly specifies "protected-mode", let it win
27-
doProtectedMode=
28-
fi
29-
fi
30-
if [ "$doProtectedMode" ]; then
31-
shift # "redis-server"
32-
if [ "$configFile" ]; then
33-
shift
34-
fi
35-
set -- --protected-mode no "$@"
36-
if [ "$configFile" ]; then
37-
set -- "$configFile" "$@"
38-
fi
39-
set -- redis-server "$@" # redis-server [config file] --protected-mode no [other options]
40-
# if this is supplied again, the "latest" wins, so "--protected-mode no --protected-mode yes" will result in an enabled status
41-
fi
42-
fi
43-
4416
exec "$@"

0 commit comments

Comments
 (0)