Update Dockerfile #618
Update Dockerfile #618
Conversation
Running programs as root that don't require it is a big security risk. Docker is only containerization and not virtualization. Instead of using the user "nobody" a custom user may be created, but as shadowsocks-rust only uses networking and only reads the config file I see it as unnecessary. If the server is intended to bind on a privileged port (<1024) Docker's port mapping may be used or a program such as nftables or setcap may be used.
|
@kallydev The latest builds were failed somehow. |
|
@zonyitoo I tried the Dockerfile on my Server (linux, amd64) before creating the PR and it appeared to have worked. |
|
https://github.com/shadowsocks/shadowsocks-rust/actions/runs/1203348443 Check this Action. |
The reason for the error is that Docker tried to build the image based on a commit that does not exist in the master branch. The hash value of that commit is a0d91b5. This is probably because there was a forced push while GitHub Actions was building, and now we just need to rerun workflow. |
Rerun the workflow doesn't seem to solve the problem, because it has been bound to the corresponding commit. If necessary, you can fork a local backup branch from master, then force master back to 58381e5 and remove Finally, merge the backup branch to the local master, and repush the tag and commits to trigger the correct workflow. |
Running programs as root that don't require it is a big security risk. Docker is only containerization and not virtualization. Instead of using the user "nobody" a custom user may be created, but as shadowsocks-rust only uses networking and only reads the config file I see it as unnecessary. If the server is intended to bind on a privileged port (<1024) Docker's port mapping may be used or a program such as nftables or setcap may be used.
Running programs as root that don't require it is a big security risk. Docker is only containerization and not virtualization.
Instead of using the user "nobody" a custom user may be created, but as shadowsocks-rust only uses networking and only reads the config file I see it as unnecessary.
If the server is intended to bind on a privileged port (<1024) Docker's port mapping may be used or a program such as nftables or setcap may be used.