From 47fc38b387dc306f849b1007272c0280ee54d07b Mon Sep 17 00:00:00 2001 From: libops-agent Date: Sun, 2 Aug 2026 17:14:13 +0000 Subject: [PATCH 1/2] [patch] Preserve generated asset ownership --- .../rootfs/usr/local/bin/generate-certs.sh | 10 +++---- .../usr/local/bin/generate-compose-secrets.sh | 6 ++--- .../docker-compose.yml | 10 +++++++ .../tests/GeneratedAssetOwnership/test.sh | 26 +++++++++++++++++++ 4 files changed, 44 insertions(+), 8 deletions(-) create mode 100644 images/base/tests/GeneratedAssetOwnership/docker-compose.yml create mode 100755 images/base/tests/GeneratedAssetOwnership/test.sh diff --git a/images/base/rootfs/usr/local/bin/generate-certs.sh b/images/base/rootfs/usr/local/bin/generate-certs.sh index 08e888f..123411c 100755 --- a/images/base/rootfs/usr/local/bin/generate-certs.sh +++ b/images/base/rootfs/usr/local/bin/generate-certs.sh @@ -34,9 +34,9 @@ if [ ! -s "${LEAF_CERT}" ]; then -set_serial "0x$(openssl rand -hex 16)" -out "${LEAF_CERT}" -days 825 -extfile "${workdir}/leaf.ext" fi chmod 0644 "${LEAF_CERT}" -if [ -n "${HOST_UID:-}" ]; then - printf '%s\n' "${HOST_UID}" >"${CERT_DIR}/UID" - chmod 0644 "${CERT_DIR}/UID" - chown -R "${HOST_UID}:${HOST_GID:-${HOST_UID}}" "${CERT_DIR}" -fi +owner_uid="${HOST_UID:-$(stat -c %u -- "${CERT_DIR}")}" +owner_gid="${HOST_GID:-$(stat -c %g -- "${CERT_DIR}")}" +printf '%s\n' "${owner_uid}" >"${CERT_DIR}/UID" +chmod 0644 "${CERT_DIR}/UID" +chown -R "${owner_uid}:${owner_gid}" "${CERT_DIR}" echo "Development certificates are ready in ${CERT_DIR}." diff --git a/images/base/rootfs/usr/local/bin/generate-compose-secrets.sh b/images/base/rootfs/usr/local/bin/generate-compose-secrets.sh index 1eab23e..9c90c44 100755 --- a/images/base/rootfs/usr/local/bin/generate-compose-secrets.sh +++ b/images/base/rootfs/usr/local/bin/generate-compose-secrets.sh @@ -49,6 +49,6 @@ while IFS=$'\t' read -r name declared; do chmod 0600 "${path}" done < <(yq -r '(.secrets // {}) | to_entries[] | select(.value.file != null) | [.key, .value.file] | @tsv' "${COMPOSE_FILE}") -if [ -n "${HOST_UID:-}" ]; then - chown -R "${HOST_UID}:${HOST_GID:-${HOST_UID}}" "${SECRETS_ROOT}" -fi +owner_uid="${HOST_UID:-$(stat -c %u -- "${SECRETS_ROOT}")}" +owner_gid="${HOST_GID:-$(stat -c %g -- "${SECRETS_ROOT}")}" +chown -R "${owner_uid}:${owner_gid}" "${SECRETS_ROOT}" diff --git a/images/base/tests/GeneratedAssetOwnership/docker-compose.yml b/images/base/tests/GeneratedAssetOwnership/docker-compose.yml new file mode 100644 index 0000000..766c22e --- /dev/null +++ b/images/base/tests/GeneratedAssetOwnership/docker-compose.yml @@ -0,0 +1,10 @@ +--- +name: base-generatedassetownership +services: + base: + image: ${BASE:-libops/base:local} + volumes: + - ./test.sh:/test.sh:ro + command: + - bash + - /test.sh diff --git a/images/base/tests/GeneratedAssetOwnership/test.sh b/images/base/tests/GeneratedAssetOwnership/test.sh new file mode 100755 index 0000000..10ccb1c --- /dev/null +++ b/images/base/tests/GeneratedAssetOwnership/test.sh @@ -0,0 +1,26 @@ +#!/command/with-contenv bash +# shellcheck shell=bash + +set -euo pipefail + +workdir="$(mktemp -d)" +mkdir -p "${workdir}/secrets" "${workdir}/certs" +chown 1234:1235 "${workdir}/secrets" "${workdir}/certs" +cat >"${workdir}/compose.yaml" <<'YAML' +secrets: + TEST_SECRET: + file: ./secrets/TEST_SECRET +YAML + +( + cd "${workdir}" + generate-compose-secrets.sh + generate-certs.sh +) + +test "$(stat -c %u "${workdir}/secrets/TEST_SECRET")" = 1234 +test "$(stat -c %g "${workdir}/secrets/TEST_SECRET")" = 1235 +test "$(stat -c %a "${workdir}/secrets/TEST_SECRET")" = 600 +test "$(stat -c %u "${workdir}/certs/privkey.pem")" = 1234 +test "$(stat -c %g "${workdir}/certs/privkey.pem")" = 1235 +test "$(stat -c %a "${workdir}/certs/privkey.pem")" = 600 From ddd041bbb0f8b277b709e69e45879ac1032cbf8a Mon Sep 17 00:00:00 2001 From: libops-agent <115990865+libops-agent@users.noreply.github.com> Date: Mon, 3 Aug 2026 01:33:46 +0000 Subject: [PATCH 2/2] [patch] Provide Drupal database URL during first install --- .../rootfs/etc/s6-overlay/scripts/install.sh | 30 +++++++++++++++---- 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh b/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh index ef3a774..870987b 100755 --- a/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh +++ b/images/drupal/rootfs/etc/s6-overlay/scripts/install.sh @@ -52,22 +52,40 @@ function drush_cache_setup { } function install_site { - local existing_config_arg=() - if [[ "${DRUPAL_DEFAULT_INSTALL_EXISTING_CONFIG}" == "true" ]]; then - existing_config_arg=("--existing-config") - fi + local db_url - DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" drush \ + # A fresh site has no bootstrapped settings yet. Pass the database through + # Drush's command environment to keep its password out of process arguments. + db_url="mysql://$(php -r 'echo rawurlencode(getenv("DB_USER"));')" + db_url+=":$(php -r 'echo rawurlencode(getenv("DB_PASSWORD"));')" + db_url+="@${DB_HOST}:${DB_PORT}/$(php -r 'echo rawurlencode(getenv("DB_NAME"));')" + + DRUSH_COMMAND_SITE_INSTALL_OPTIONS_DB_URL="${db_url}" \ + DRUSH_COMMAND_SITE_INSTALL_OPTIONS_ACCOUNT_PASS="${DRUPAL_DEFAULT_ACCOUNT_PASSWORD}" drush \ -n \ -r /var/www/drupal/web \ site:install "${DRUPAL_DEFAULT_PROFILE}" \ - "${existing_config_arg[@]}" \ --sites-subdir="${DRUPAL_DEFAULT_SUBDIR}" \ --site-name="${DRUPAL_DEFAULT_NAME}" \ --site-mail="${DRUPAL_DEFAULT_EMAIL}" \ --account-name="${DRUPAL_DEFAULT_ACCOUNT_NAME}" \ --account-mail="${DRUPAL_DEFAULT_ACCOUNT_EMAIL}" \ --locale="${DRUPAL_DEFAULT_LOCALE}" + + if [[ "${DRUPAL_DEFAULT_INSTALL_EXISTING_CONFIG}" == "true" ]]; then + local source_uuid + source_uuid="$(yq -r '.uuid // ""' "${DRUPAL_DEFAULT_CONFIGDIR}/system.site.yml")" + if [[ -z "${source_uuid}" ]]; then + echo "Existing configuration has no site UUID" >&2 + return 1 + fi + drush -n -r /var/www/drupal/web config:set system.site uuid \ + "${source_uuid}" --uri="$(drush_uri)" --yes + drush -n -r /var/www/drupal/web config:import \ + --source="${DRUPAL_DEFAULT_CONFIGDIR}" \ + --uri="$(drush_uri)" \ + --yes + fi } function run_install_hooks {