Merge pull request #45 from exaco/v2

exaco · Oct 5, 2023 · da0da32 · da0da32
2 parents 0d8ea45 + 52e1bf5
commit da0da32
Show file tree

Hide file tree

Showing 8 changed files with 51 additions and 48 deletions.
diff --git a/.github/workflows/roadrunner-test.yml b/.github/workflows/roadrunner-test.yml
@@ -70,4 +70,7 @@ jobs:
         run: sleep 10s
 
       - name: Check application health
-        run: curl -f -s -o /dev/null -w "%{http_code}" http://localhost:9000
+        run: |
+          curl -f -s -o /dev/null -w "%{http_code}" http://localhost:9000
+          php artisan tinker --execute="logger('test');"
+        working-directory: /var/www/app
diff --git a/.github/workflows/swoole-test.yml b/.github/workflows/swoole-test.yml
@@ -70,4 +70,7 @@ jobs:
         run: sleep 10s
 
       - name: Check application health
-        run: curl -f -s -o /dev/null -w "%{http_code}" http://localhost:9000
+        run: |
+          curl -f -s -o /dev/null -w "%{http_code}" http://localhost:9000
+          php artisan tinker --execute="logger('test');"
+        working-directory: /var/www/app
diff --git a/Dockerfile b/Dockerfile
@@ -7,7 +7,7 @@ ARG COMPOSER_VERSION=latest
 ARG OCTANE_SERVER="swoole"
 
 ###########################################
-# Build frontend assets with NPM
+# Build frontend assets with PNPM
 ###########################################
 
 ARG NODE_VERSION=18-bullseye-slim
@@ -18,23 +18,23 @@ ENV ROOT=/var/www/html
 
 WORKDIR $ROOT
 
-RUN npm config set update-notifier false && npm set progress=false
+RUN npm install -g pnpm
 
-COPY package*.json ./
+COPY package.json pnpm-lock.yaml* ./
 
-RUN if [ -f $ROOT/package-lock.json ]; \
+RUN if [ -f $ROOT/pnpm-lock.yaml ]; \
   then \
-  npm ci --no-optional --loglevel=error --no-audit; \
+  pnpm install --frozen-lockfile --no-optional --prefer-offline; \
   elif [ -f $ROOT/package.json ]; \
   then \
-  npm install --no-optional --loglevel=error --no-audit; \
+  pnpm install --no-optional --prefer-offline; \
   fi
 
 COPY . .
 
-RUN if [ -f $ROOT/package.json ] || [ -f $ROOT/package-lock.json ]; \
+RUN if [ -f $ROOT/package.json ] || [ -f $ROOT/pnpm-lock.yaml ]; \
   then \
-  npm run build; \
+  pnpm run build; \
   fi
 
 ###########################################
@@ -90,7 +90,8 @@ ENV DEBIAN_FRONTEND=noninteractive \
   CONTAINER_MODE=${CONTAINER_MODE} \
   APP_WITH_HORIZON=${APP_WITH_HORIZON} \
   APP_WITH_SCHEDULER=${APP_WITH_SCHEDULER} \
-  OCTANE_SERVER=${OCTANE_SERVER}
+  OCTANE_SERVER=${OCTANE_SERVER} \
+  NON_ROOT_USER=octane
 
 ENV ROOT=/var/www/html
 WORKDIR $ROOT
@@ -233,7 +234,7 @@ ARG SERVER=swoole
 
 RUN if [ ${OCTANE_SERVER} = "swoole" ]; then \
   apt-get install -yqq --no-install-recommends --show-progress libc-ares-dev \
-  && pecl -q install -o -f -D 'enable-openssl="yes" enable-http2="yes" enable-swoole-curl="yes" enable-mysqlnd="yes" enable-cares="yes"' ${SERVER} \
+  && printf "\n" | pecl -q install -o -f -D 'enable-openssl="yes" enable-http2="yes" enable-swoole-curl="yes" enable-mysqlnd="yes" enable-cares="yes"' ${SERVER} \
   && docker-php-ext-enable ${SERVER}; \
   fi
 
@@ -323,43 +324,48 @@ RUN if [ ${CONTAINER_MODE} = 'scheduler' ] || [ ${APP_WITH_SCHEDULER} = true ];
 
 ###########################################
 
-RUN groupadd --force -g $WWWGROUP octane \
-  && useradd -ms /bin/bash --no-log-init --no-user-group -g $WWWGROUP -u $WWWUSER octane
-
 RUN apt-get clean \
   && docker-php-source delete \
   && pecl clear-cache \
   && rm -R /tmp/pear \
   && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
   && rm /var/log/lastlog /var/log/faillog
 
-COPY . .
-COPY --from=build ${ROOT}/public public
-COPY --from=vendor ${ROOT}/vendor vendor
-COPY --from=vendor ${ROOT}/rr* ${ROOT}/composer.json ./
+RUN groupadd --force -g $WWWGROUP $NON_ROOT_USER \
+  && useradd -ms /bin/bash --no-log-init --no-user-group -g $WWWGROUP -u $WWWUSER $NON_ROOT_USER
+
+RUN chown -R $NON_ROOT_USER:$NON_ROOT_USER $ROOT /var/log/
+
+RUN chmod -R ug+rw /var/log/
+
+USER $NON_ROOT_USER
+
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER . .
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER --from=build ${ROOT}/public public
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER --from=vendor ${ROOT}/vendor vendor
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER --from=vendor ${ROOT}/rr* ${ROOT}/composer.json ./
 
 RUN mkdir -p \
   storage/framework/{sessions,views,cache} \
   storage/logs \
-  bootstrap/cache \
-  && chown -R octane:octane \
-  storage \
-  bootstrap/cache \
-  && chmod -R ug+rwx storage bootstrap/cache
+  bootstrap/cache
 
-COPY deployment/octane/supervisord* /etc/supervisor/conf.d/
-COPY deployment/octane/php.ini /usr/local/etc/php/conf.d/octane.ini
-COPY deployment/octane/.rr.prod.yaml ./.rr.yaml
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER deployment/octane/supervisord* /etc/supervisor/conf.d/
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER deployment/octane/php.ini /usr/local/etc/php/conf.d/99-octane.ini
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER deployment/octane/.rr.prod.yaml ./.rr.yaml
+COPY --chown=$NON_ROOT_USER:$NON_ROOT_USER deployment/octane/start-container /usr/local/bin/start-container
+
+RUN chmod +x /usr/local/bin/start-container
 
-RUN chmod +x deployment/octane/entrypoint.sh
 RUN if [ -f "rr" ]; then \
   chmod +x rr; \
   fi
+
 RUN cat deployment/octane/utilities.sh >> ~/.bashrc
 
 EXPOSE 9000
 EXPOSE 6001
 
-ENTRYPOINT ["deployment/octane/entrypoint.sh"]
+ENTRYPOINT ["start-container"]
 
 HEALTHCHECK --start-period=5s --interval=2s --timeout=5s --retries=8 CMD php artisan octane:status || exit 1
diff --git a/deployment/octane/entrypoint.sh → deployment/octane/start-container b/deployment/octane/entrypoint.sh → deployment/octane/start-container
@@ -5,10 +5,6 @@ container_mode=${CONTAINER_MODE:-app}
 octane_server=${OCTANE_SERVER:-swoole}
 echo "Container mode: $container_mode"
 
-php() {
-  su octane -c "php $*"
-}
-
 initialStuff() {
     php artisan optimize:clear; \
     php artisan package:discover --ansi; \

diff --git a/deployment/octane/supervisord.app.conf b/deployment/octane/supervisord.app.conf
@@ -1,13 +1,13 @@
 [supervisord]
 nodaemon=true
-user=root
+user=%(ENV_NON_ROOT_USER)s
 logfile=/var/log/supervisor/supervisord.log
 pidfile=/var/run/supervisord.pid
 
 [program:octane]
 process_name=%(program_name)s_%(process_num)02d
 command=php /var/www/html/artisan octane:start --server=swoole --host=0.0.0.0 --port=9000 --workers=auto --task-workers=auto --max-requests=500
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=true
 autorestart=true
 environment=LARAVEL_OCTANE="1"
@@ -19,7 +19,7 @@ stderr_logfile_maxbytes=0
 [program:horizon]
 process_name=%(program_name)s_%(process_num)02d
 command=php /var/www/html/artisan horizon
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=%(ENV_APP_WITH_HORIZON)s
 autorestart=true
 stdout_logfile=/var/www/html/horizon.log
@@ -28,7 +28,7 @@ stopwaitsecs=3600
 [program:scheduler]
 process_name=%(program_name)s_%(process_num)02d
 command=supercronic /etc/supercronic/laravel
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=%(ENV_APP_WITH_SCHEDULER)s
 autorestart=true
 stdout_logfile=/var/www/html/scheduler.log
diff --git a/deployment/octane/supervisord.app.roadrunner.conf b/deployment/octane/supervisord.app.roadrunner.conf
@@ -1,13 +1,13 @@
 [supervisord]
 nodaemon=true
-user=root
+user=%(ENV_NON_ROOT_USER)s
 logfile=/var/log/supervisor/supervisord.log
 pidfile=/var/run/supervisord.pid
 
 [program:octane]
 process_name=%(program_name)s_%(process_num)02d
 command=php /var/www/html/artisan octane:start --server=roadrunner --host=0.0.0.0 --port=9000 --rpc-port=6001 --workers=auto --max-requests=500 --rr-config=/var/www/html/.rr.yaml
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=true
 autorestart=true
 environment=LARAVEL_OCTANE="1"
@@ -19,7 +19,7 @@ stderr_logfile_maxbytes=0
 [program:horizon]
 process_name=%(program_name)s_%(process_num)02d
 command=php /var/www/html/artisan horizon
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=%(ENV_APP_WITH_HORIZON)s
 autorestart=true
 stdout_logfile=/var/www/html/horizon.log
@@ -28,7 +28,7 @@ stopwaitsecs=3600
 [program:scheduler]
 process_name=%(program_name)s_%(process_num)02d
 command=supercronic /etc/supercronic/laravel
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=%(ENV_APP_WITH_SCHEDULER)s
 autorestart=true
 stdout_logfile=/var/www/html/scheduler.log
diff --git a/deployment/octane/supervisord.horizon.conf b/deployment/octane/supervisord.horizon.conf
@@ -1,13 +1,13 @@
 [supervisord]
 nodaemon=true
-user=root
+user=%(ENV_NON_ROOT_USER)s
 logfile=/var/log/supervisor/supervisord.log
 pidfile=/var/run/supervisord.pid
 
 [program:horizon]
 process_name=%(program_name)s_%(process_num)02d
 command=php /var/www/html/artisan horizon
-user=octane
+user=%(ENV_NON_ROOT_USER)s
 autostart=true
 autorestart=true
 stdout_logfile=/dev/stdout

diff --git a/deployment/octane/utilities.sh b/deployment/octane/utilities.sh
@@ -1,8 +1,3 @@
-php() {
-  echo "Running PHP as octane user ..."
-  su octane -c "php $*"
-}
-
 tinker() {
   if [ -z "$1" ]; then
     php artisan tinker