Harden entrypoint NSS wrapper setup for Pterodactyl runtime
Some checks failed
Build and Publish Docker Image / docker (push) Failing after 7s
Some checks failed
Build and Publish Docker Image / docker (push) Failing after 7s
Improve uid/gid passwd mapping checks, broaden libnss-wrapper detection, and emit startup diagnostics so Avorion home-directory resolution issues are easier to verify in panel logs.
This commit is contained in:
@@ -2,8 +2,12 @@
|
|||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
||||||
export USER=container
|
export USER=container
|
||||||
|
export LOGNAME=container
|
||||||
export HOME=/home/container
|
export HOME=/home/container
|
||||||
|
export XDG_CONFIG_HOME=/home/container/.config
|
||||||
|
export XDG_DATA_HOME=/home/container/.local/share
|
||||||
mkdir -p /home/container /tmp
|
mkdir -p /home/container /tmp
|
||||||
|
mkdir -p "$XDG_CONFIG_HOME" "$XDG_DATA_HOME"
|
||||||
|
|
||||||
uid="$(id -u)"
|
uid="$(id -u)"
|
||||||
gid="$(id -g)"
|
gid="$(id -g)"
|
||||||
@@ -14,24 +18,33 @@ GROUP_FILE="/tmp/group"
|
|||||||
cp /etc/passwd "$PASSWD_FILE"
|
cp /etc/passwd "$PASSWD_FILE"
|
||||||
cp /etc/group "$GROUP_FILE"
|
cp /etc/group "$GROUP_FILE"
|
||||||
|
|
||||||
if ! getent passwd "$uid" >/dev/null 2>&1; then
|
if ! awk -F: -v target_uid="$uid" '$3 == target_uid { found=1 } END { exit !found }' "$PASSWD_FILE"; then
|
||||||
echo "container:x:${uid}:${gid}::/home/container:/bin/bash" >> "$PASSWD_FILE"
|
echo "container:x:${uid}:${gid}::/home/container:/bin/bash" >> "$PASSWD_FILE"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if ! getent group "$gid" >/dev/null 2>&1; then
|
if ! awk -F: -v target_gid="$gid" '$3 == target_gid { found=1 } END { exit !found }' "$GROUP_FILE"; then
|
||||||
echo "container:x:${gid}:" >> "$GROUP_FILE"
|
echo "container:x:${gid}:" >> "$GROUP_FILE"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
export NSS_WRAPPER_PASSWD="$PASSWD_FILE"
|
export NSS_WRAPPER_PASSWD="$PASSWD_FILE"
|
||||||
export NSS_WRAPPER_GROUP="$GROUP_FILE"
|
export NSS_WRAPPER_GROUP="$GROUP_FILE"
|
||||||
|
|
||||||
libnss="$(find /usr/lib /lib -name 'libnss_wrapper.so' 2>/dev/null | head -n 1 || true)"
|
libnss="$(find /usr/lib /lib -type f \( -name 'libnss_wrapper.so' -o -name 'libnss_wrapper.so.*' \) -print -quit 2>/dev/null || true)"
|
||||||
if [ -n "$libnss" ]; then
|
if [ -n "$libnss" ]; then
|
||||||
export LD_PRELOAD="${libnss}${LD_PRELOAD:+:${LD_PRELOAD}}"
|
export LD_PRELOAD="${libnss}${LD_PRELOAD:+:${LD_PRELOAD}}"
|
||||||
|
else
|
||||||
|
echo "[entrypoint] WARNING: libnss_wrapper not found; UID/GID passthrough may fail for Avorion." >&2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
cd /home/container
|
cd /home/container
|
||||||
|
|
||||||
|
echo "[entrypoint] uid=${uid} gid=${gid} home=${HOME} user=${USER}" >&2
|
||||||
|
echo "[entrypoint] NSS wrapper passwd=${NSS_WRAPPER_PASSWD} group=${NSS_WRAPPER_GROUP}" >&2
|
||||||
|
echo "[entrypoint] LD_PRELOAD=${LD_PRELOAD:-<empty>}" >&2
|
||||||
|
if ! getent passwd "$uid" >/dev/null 2>&1; then
|
||||||
|
echo "[entrypoint] WARNING: getent cannot resolve uid ${uid} prior to exec." >&2
|
||||||
|
fi
|
||||||
|
|
||||||
if [ -n "${STARTUP:-}" ]; then
|
if [ -n "${STARTUP:-}" ]; then
|
||||||
echo ":/home/container$ ${STARTUP}"
|
echo ":/home/container$ ${STARTUP}"
|
||||||
exec /bin/bash -c "${STARTUP}"
|
exec /bin/bash -c "${STARTUP}"
|
||||||
|
|||||||
Reference in New Issue
Block a user