feat: openshift compatible rootless container support added

Author: dotconfig404

openvoxserver/Containerfile.alpine

@@ -191,6 +191,44 @@ RUN apk update \
 # install puppet gem as library into jruby loadpath
 && puppetserver gem install --no-document openvox
 
+# explicitly set HOME: random UIDs will cause HOME to be "/" generally
+ENV HOME=${data_dir}/puppetserver
+
+# use system confdir to make it easier to manage permissions and paths
+# the conf in that dir should also contain other dirs that are being used for interpolation
+# to make sure we use the same dirs as if the server was started as root
+RUN mkdir -p ${HOME}/.puppetlabs/etc/puppet && \
+    cat > ${HOME}/.puppetlabs/etc/puppet/puppet.conf <<'EOF'
+[main]
+confdir = /etc/puppetlabs/puppet/
+EOF
+
+# mirror user permissions to group, set group to root, and set gid bit on dirs
+RUN for d in \
+    /etc/puppetlabs \
+    /var/log/puppetlabs \
+    /var/run/puppetlabs \
+    /opt/puppetlabs/var \
+    /opt/puppetlabs/cache \
+    ${data_dir} \
+  ; do \
+    mkdir -p "$d"; \
+    chgrp -R 0 "$d"; \
+    chmod -R g=u "$d"; \
+    find "$d" -type d -exec chmod g+s {} +; \
+  done
+
+# the foreground starting script has this check before running the server:
+# [ "$EUID" = "$(id -u ${USER})" ]
+# simply calling `id -u` results in the UID of the current user and the check will pass
+RUN sed -i 's/^ *USER="puppet"/USER=""/' /etc/default/puppetserver
+# `puppetserver setup` forces symlinking the "old" cadir to the "new" one for puppet 6 compatibility 
+# reasons. this won't work because after creating a link ruby tries to call chown
+RUN sed -i '/Puppetserver::Ca::Utils::Config\.symlink_to_old_cadir/ s/^/# /' \
+  /usr/lib/ruby/gems/3.4.0/gems/openvoxserver-ca-3.0.0/lib/puppetserver/ca/action/setup.rb
+
+USER puppet:0
+
 # k8s uses livenessProbe, startupProbe, readinessProbe and ignores HEALTHCHECK
 HEALTHCHECK --interval=20s --timeout=15s --retries=12 --start-period=3m CMD ["/healthcheck.sh"]
 

openvoxserver/container-entrypoint.d/30-ensure-config.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -e
+
+puppet config set vardir /opt/puppetlabs/puppet/cache
+puppet config set logdir /var/log/puppetlabs/puppet
+puppet config set codedir /etc/puppetlabs/code
+puppet config set rundir /var/run/puppetlabs
+puppet config set manage_internal_file_permissions false