Nonroot container

docker/Dockerfile

@@ -64,7 +64,8 @@ RUN set -eux; \
     groupadd --system taiga --gid=999; \
     useradd --system --no-create-home --gid taiga --uid=999 --shell=/bin/bash taiga; \
     mkdir -p /taiga-back/media/exports; \
-    chown -R taiga:taiga /taiga-back; \
+    chown -R taiga:0 /taiga-back; \
+    chmod -R g+rwX /taiga-back; \
     # remove unneeded files and packages
     apt-get purge -y \
        build-essential \

docker/async_entrypoint.sh

@@ -8,13 +8,18 @@
 
 set -euo pipefail
 
-# Give permission to taiga:taiga after mounting volumes
-echo Give permission to taiga:taiga
-chown -R taiga:taiga /taiga-back
+cmd=( celery -A taiga.celery worker -B --concurrency 4 -l INFO "$@" )
 
-# Start Celery processes
-echo Starting Celery...
-exec gosu taiga celery -A taiga.celery worker -B \
-    --concurrency 4 \
-    -l INFO \
-    "$@"
+if [ "$(id -u)" -eq 0 ]; then
+    # Give permission to taiga:taiga after mounting volumes
+    echo Give permission to taiga:taiga
+    # chown -R taiga:taiga /taiga-back
+
+    # Start Celery processes
+    echo Starting Celery...
+    exec gosu taiga "${cmd[@]}"
+else
+    # Start Celery processes
+    echo Starting Celery...
+    exec "${cmd[@]}"
+fi

docker/entrypoint.sh

@@ -8,6 +8,15 @@
 
 set -euo pipefail
 
+cmd=( gunicorn taiga.wsgi:application \
+    --name taiga_api \
+    --bind 0.0.0.0:8000 \
+    --workers 3 \
+    --worker-tmp-dir /dev/shm \
+    --log-level=info \
+    --access-logfile - \
+    "$@" )
+
 # Execute pending migrations
 echo Executing pending migrations
 python manage.py migrate
@@ -16,17 +25,16 @@ python manage.py migrate
 echo Load default templates
 python manage.py loaddata initial_project_templates
 
-# Give permission to taiga:taiga after mounting volumes
-echo Give permission to taiga:taiga
-chown -R taiga:taiga /taiga-back
+if [ "$(id -u)" -eq 0 ]; then
+    # Give permission to taiga:taiga after mounting volumes
+    echo Give permission to taiga:taiga
+    chown -R taiga:taiga /taiga-back
 
-# Start Taiga processes
-echo Starting Taiga API...
-exec gosu taiga gunicorn taiga.wsgi:application \
-    --name taiga_api \
-    --bind 0.0.0.0:8000 \
-    --workers 3 \
-    --worker-tmp-dir /dev/shm \
-    --log-level=info \
-    --access-logfile - \
-    "$@"
+    # Start Taiga processes
+    echo Starting Taiga API...
+    exec gosu taiga "${cmd[@]}"
+else
+    # Start Taiga processes
+    echo Starting Taiga API...
+    exec "${cmd[@]}"
+fi