mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
30749911bd
Dockerfile.goreleaser now copies silo to /usr/bin/silo, defaults to CMD ["silo"], and labels the image as Silo. MINIO_UPDATE_MINISIGN_PUBKEY is removed from the image environment: with the updater permanently disabled it was dead weight, and leaving upstream's verification key in a Silo image implied a trust relationship that does not exist. The MINIO_* runtime environment variables, ports, volume and health endpoints are unchanged. The image keeps shipping mcli with an /usr/bin/mc symlink. That is the client, not a MinIO-branded alias for the server binary, and the Helm post-install job and existing container scripts call it by name. docker-entrypoint.sh translates a legacy first argument: `minio server /data` becomes `silo server /data`, so an existing `command: minio server ...` in compose or a Pod spec keeps working across the image swap. The translation is argv-level only - no file named minio is installed, and an explicitly overridden `entrypoint: /usr/bin/minio` still fails, which is the honest outcome since that path genuinely no longer exists. The entrypoint also fixes an unrelated startup hazard it was already carrying: when the image runs under an arbitrary UID, HOME points at an unreadable /root and the server probes its default config directory during initialization. It now falls back to /tmp when HOME is unset, /root, missing or unwritable. docker-entrypoint_test.sh pins all of it - empty argv, legacy minio, native silo, bare flags, and an explicit shell command that must stay explicit. It is wired into make rebrand-guard and into the go.yml, release.yml and test-release.yml gates, so removing the shim breaks CI rather than breaking users. Passing locally. download-static-curl.sh gains checksum verification for the curl it fetches into the build stage. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
49 lines
1.3 KiB
Bash
Executable File
49 lines
1.3 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
|
|
# Run Silo by default, while translating the legacy argv-level command name.
|
|
# An explicitly supplied shell or utility remains an explicit entrypoint command.
|
|
case "${1:-}" in
|
|
"")
|
|
set -- silo
|
|
;;
|
|
minio)
|
|
shift
|
|
set -- silo "$@"
|
|
;;
|
|
silo)
|
|
;;
|
|
-*|server|fmt-gen)
|
|
set -- silo "$@"
|
|
;;
|
|
esac
|
|
|
|
ensure_writable_home() {
|
|
# The image is commonly run with an arbitrary UID or with the legacy
|
|
# MINIO_USERNAME drop-user path. Do not leave those processes pointing at
|
|
# root's inaccessible home: Silo probes its default configuration directory
|
|
# during process initialization.
|
|
if [ -z "${HOME:-}" ] || [ "${HOME}" = /root ] || [ ! -d "${HOME}" ] || [ ! -w "${HOME}" ]; then
|
|
HOME=/tmp
|
|
export HOME
|
|
fi
|
|
}
|
|
|
|
docker_switch_user() {
|
|
ensure_writable_home
|
|
if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
|
|
if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
|
|
exec chroot --userspec="${MINIO_UID}:${MINIO_GID}" / "$@"
|
|
else
|
|
echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
|
|
echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
|
|
exec chroot --userspec="${MINIO_USERNAME}:${MINIO_GROUPNAME}" / "$@"
|
|
fi
|
|
else
|
|
exec "$@"
|
|
fi
|
|
}
|
|
|
|
## DEPRECATED and unsupported - switch to user if applicable.
|
|
docker_switch_user "$@"
|