From ef016e67da4f54691eb6d5dc89d8008410a861b7 Mon Sep 17 00:00:00 2001 From: Conan Scott Date: Mon, 2 Feb 2026 00:36:37 +0000 Subject: [PATCH] Update Dockerfile for OpenShift compatibility (Port 2222, Permissions) --- Dockerfile | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index a8cdaa2..128253a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,23 +9,30 @@ RUN apt-get update && apt-get install -y curl wget git jq un # Install yq (binary release for latest version) RUN wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq && chmod +x /usr/bin/yq -# Setup SSH directory -RUN mkdir /var/run/sshd +# Setup SSH directory & Config for OpenShift (Random UID support) +RUN mkdir -p /var/run/sshd && mkdir -p /etc/ssh/host_keys && chmod 775 /var/run/sshd && chmod 775 /etc/ssh/host_keys + +# Custom sshd_config for non-root usage +RUN echo "Port 2222\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nPidFile /var/run/sshd/sshd.pid\nHostKey /etc/ssh/host_keys/ssh_host_rsa_key\nHostKey /etc/ssh/host_keys/ssh_host_ecdsa_key\nHostKey /etc/ssh/host_keys/ssh_host_ed25519_key\nAuthorizedKeysFile .ssh/authorized_keys\nChallengeResponseAuthentication no\nUsePAM yes\nSubsystem sftp /usr/lib/openssh/sftp-server" > /etc/ssh/sshd_config # Create a user 'claw' with sudo access # Passwordless sudo allowed for friction-free automation -RUN useradd -m -s /bin/bash claw && echo "claw ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers +# OpenShift runs as random UID, but 'claw' gives us a named user for direct exec if needed +RUN useradd -m -s /bin/bash claw && echo "claw ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && # Allow group (0) write access for OpenShift random UID + chmod -R g+rwX /home/claw # Prepare volume mount point # Mount persistent storage here VOLUME /data -RUN chown claw:claw /data +RUN mkdir -p /data && chown claw:claw /data && # Critical for OpenShift: Allow root group (gid 0) to write to /data + chmod 775 /data # Set working directory to the persistent volume WORKDIR /data -# Expose SSH port -EXPOSE 22 +# Expose SSH port (non-privileged) +EXPOSE 2222 # Start SSH daemon -CMD ["/usr/sbin/sshd", "-D"] \ No newline at end of file +# Generate host keys on startup if missing (for ephemeral pods) +CMD ["/bin/bash", "-c", "ssh-keygen -A && /usr/sbin/sshd -D -f /etc/ssh/sshd_config"] \ No newline at end of file