From 5caac7aead028198929f306a3c02b5e33c2c787b Mon Sep 17 00:00:00 2001
From: Nathan Price <nathan@gravityfargo.dev>
Date: Tue, 10 Dec 2024 20:08:12 +0000
Subject: [PATCH] Added support for non-root operation

Moved previous stages to base image.
Removed unneeded Makefile targets.
PDS_HOSTNAME must be the same as the container $hostname.
---
 Dockerfile    | 60 +++++++++++----------------------------------------
 Makefile      | 27 ++++++++++++-----------
 entrypoint.sh |  6 +++---
 example.env   |  4 +++-
 4 files changed, 33 insertions(+), 64 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 144ae4f..bc7933c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,50 +1,3 @@
-################################################################################
-# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
-################################################################################
-FROM node:20.11-bookworm-slim AS pds-build
-
-RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
-
-# Download and extract the PDS archive
-WORKDIR /app
-ADD https://github.com/bluesky-social/pds/archive/refs/tags/v0.4.74.zip .
-RUN unzip v0.4.74.zip && \
-    mv pds-0.4.74/service/** . && \
-    mv pds-0.4.74/pdsadmin.sh .
-
-RUN pnpm install --prod=true --frozen-lockfile
-
-################################################################################
-# adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
-################################################################################
-FROM node:20.11-bookworm-slim AS pds-runtime
-
-RUN apt-get update && apt-get install -y \
-    dumb-init \
-    ca-certificates \
-    curl \
-    gnupg \
-    jq \
-    lsb-release \
-    openssl \
-    sqlite3 \
-    bsdextrautils \ 
-    xxd
-# bsdextrautils for `column` command in the accounts script
-
-WORKDIR /app
-COPY --from=pds-build /app /app
-
-EXPOSE 3000
-ENV PDS_PORT=3000
-ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
-
-LABEL org.opencontainers.image.source="https://github.com/bluesky-social/pds"
-LABEL org.opencontainers.image.description="AT Protocol PDS"
-LABEL org.opencontainers.image.licenses="MIT"
-
 ################################################################################
 # adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/installer.sh
 ################################################################################
@@ -69,11 +22,22 @@ RUN mv pdsadmin.sh /usr/local/bin/pdsadmin && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+
+ENV PUID=1000
+ENV PGID=1000
+
+RUN groupadd --gid ${PGID} pds
+RUN useradd --home=${PDS_DATADIR} --uid=${PUID} --no-user-group pds
+RUN usermod --gid ${PGID} pds
+RUN chown -R pds:pds ${PDS_DATADIR}
+
 ENTRYPOINT ["dumb-init", "--"]
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
-CMD ["/entrypoint.sh"]
+
+CMD ["sh", "-c", "chown -R ${PUID}:${PGID} /pds && su pds && /entrypoint.sh"]
+
 
 LABEL org.opencontainers.image.source="https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker"
 LABEL org.opencontainers.image.url="https://github.com/bluesky-social/pds"
diff --git a/Makefile b/Makefile
index 8b8b312..b5f1ce6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,19 +1,20 @@
-REGISTRY=forgejo.gravityfargo.dev
-OWNER=gravityfargo
-IMAGE=bluesky-pds
-TAG=0.4.74
-DOMAIN=sheltersky.social
+REGISTRY = forgejo.gravityfargo.dev
+OWNER = gravityfargo
+IMAGE = bluesky-pds
+TAG ?= 0.4.74
+DOMAIN = sheltersky.social
 
 export DOCKER_BUILDKIT=1
-# export BUILDKIT_PROGRESS=plain
+export BUILDKIT_PROGRESS=plain
+
+.PHONY: build-base
+build-base:
+	docker build --tag pds-runtime ./base
 
 .PHONY: build-tag
 build-tag:
-	docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
-
-.PHONY: wsdump
-wsdump:
-	wsdump "wss://$(DOMAIN)/xrpc/com.atproto.sync.subscribeRepos?cursor=0"
+	sudo rm -rf config 
+	docker build --no-cache --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
 
 .PHONY: generate-env
 generate-env:
@@ -24,7 +25,9 @@ generate-env:
 	@echo "PDS_JWT_SECRET=$(PDS_JWT_SECRET)" > .env
 	@echo "PDS_ADMIN_PASSWORD=$(PDS_ADMIN_PASSWORD)" >> .env
 	@echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)" >> .env
-	@echo "PDS_HOSTNAME=$(DOMAIN)" >> .env
+	@echo "PDS_HOSTNAME=" >> .env
+	@echo "PUID=1000" >> .env
+	@echo "PGID=1000" >> .env
 	@echo "URL_NAME:" >> .env
 	@echo "URL_SUFFIX:" >> .env
 
diff --git a/entrypoint.sh b/entrypoint.sh
index 378c2e9..03073f4 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -20,9 +20,9 @@ function main {
         exit 1
     fi
 
-    # set PDS_HOSTNAME to hostname if not set
-    if [[ -z "${PDS_HOSTNAME}" ]]; then
-        echo "PDS_HOSTNAME not specified"
+    # if hostname is not the same as the PDS_HOSTNAME then quit
+    if [[ "${PDS_HOSTNAME}" != "${HOSTNAME}" ]]; then
+        echo "PDS_HOSTNAME does not match the hostname"
         exit 1
     fi
 
diff --git a/example.env b/example.env
index 404bef3..24781bc 100644
--- a/example.env
+++ b/example.env
@@ -3,4 +3,6 @@ PDS_ADMIN_PASSWORD=
 PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=
 PDS_HOSTNAME=
 PDS_EMAIL_SMTP_URL=
-PDS_EMAIL_FROM_ADDRESS=
\ No newline at end of file
+PDS_EMAIL_FROM_ADDRESS=
+PUID=1000
+PGID=1000
\ No newline at end of file