From 618e9df6ec0f642fef7df62a119125f26f990339 Mon Sep 17 00:00:00 2001
From: Endial Fang <endial@126.com>
Date: Tue, 21 Apr 2020 10:08:47 +0800
Subject: [PATCH] =?UTF-8?q?[feat:10]=20=E6=9B=B4=E6=96=B0Dockerfile?=
 =?UTF-8?q?=E6=96=87=E4=BB=B6=EF=BC=8C=E4=BC=98=E5=8C=96=E5=B1=82=E6=95=B0?=
 =?UTF-8?q?=E9=87=8F=EF=BC=9B=E6=9B=B4=E6=96=B0README=E6=96=87=E4=BB=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 10/Dockerfile    | 32 ++++++++++++-----------
 10/entrypoint.sh | 68 +++++++++++++++++++++++++-----------------------
 README.md        |  2 +-
 3 files changed, 53 insertions(+), 49 deletions(-)

diff --git a/10/Dockerfile b/10/Dockerfile
index 2068c2a..1e72938 100644
--- a/10/Dockerfile
+++ b/10/Dockerfile
@@ -1,25 +1,26 @@
 FROM endial/ubuntu:v18.04
 # --platform=$BUILDPLATFORM linux/amd64, linux/arm64, or windows/amd64
 
-LABEL \
-	"Version"="v10.12" \
-	"Description"="Docker image for PostgreSQL 10.12 based on Ubuntu 18.04." \
-	"Dockerfile"="https://github.com/endial/docker-postgres" \
-	"Vendor"="Endial Fang (endial@126.com)"
-
 ENV PG_MAJOR 		10
 ENV PG_VERSION 		10.12-2.pgdg18.04+1
-ENV PG_KEYS		B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
+ENV PG_KEYS			B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
 
 ENV PGDATA /srv/data/postgresql
 ENV PATH $PATH:/usr/lib/postgresql/${PG_MAJOR}/bin
 
+LABEL \
+	"Version"="v${PG_MAJOR}" \
+	"Description"="Docker image for PostgreSQL ${PG_MAJOR} based on Ubuntu 18.04." \
+	"Dockerfile"="https://github.com/endial/docker-postgres" \
+	"Vendor"="Endial Fang (endial@126.com)"
+
 RUN set -eux; \
-# add user after ningx docker
-	groupadd -r -g 502 postgres; \
-	useradd -r -g postgres -d /var/lib/postgresql -s /bin/bash -u 502 postgres; \
-	mkdir -p /var/lib/postgresql; \
-	chown -R postgres:postgres /var/lib/postgresql; \
+# 确保程序使用静默安装，而非交互模式
+	export DEBIAN_FRONTEND=noninteractive; \
+	groupadd -r postgres; \
+	useradd -r -g postgres -s /usr/sbin/nologin -d /var/lib/postgresql postgres; \
+	\
+	mkdir -p /var/lib/postgresql /srv/conf/postgresql ${PGDATA} /var/log/postgresql /var/run/postgresql; \
 	\
 	fetchDeps=" \
 		dirmngr \
@@ -39,9 +40,6 @@ RUN set -eux; \
 	echo "deb-src http://apt.postgresql.org/pub/repos/apt/ bionic-pgdg main ${PG_MAJOR}" >> /etc/apt/sources.list; \
 	apt update; \
 	\
-# set noninteractive for install tzdata
-	export DEBIAN_FRONTEND=noninteractive; \
-	\
 	apt install -y --no-install-recommends \
 		postgresql-${PG_MAJOR}=${PG_VERSION} \
 		postgresql-common \
@@ -54,6 +52,10 @@ RUN set -eux; \
 	ln -fs /usr/share/zoneinfo/Asia/Shanghai /etc/localtime; \
 	dpkg-reconfigure -f noninteractive tzdata; \
 	\
+	chown -Rf postgres:postgres /var/lib/postgresql /srv/conf/postgresql ${PGDATA} /var/log/postgresql /var/run/postgresql; \
+# this 777 will be replaced by 700 or 755 at runtime (allows semi-arbitrary "--user" values)
+	chmod 777 /var/lib/postgresql /srv/conf/postgresql ${PGDATA} /var/log/postgresql /var/run/postgresql; \
+	\
 	apt purge -y --auto-remove ${fetchDeps}; \
 	apt autoclean -y; \
 	rm -rf /var/lib/apt/lists/*; \
diff --git a/10/entrypoint.sh b/10/entrypoint.sh
index d059601..121be57 100755
--- a/10/entrypoint.sh
+++ b/10/entrypoint.sh
@@ -3,7 +3,22 @@
 
 set -Eeo pipefail
 
-echo "[i] Initial Container"
+LOG_RAW() {
+	local type="$1"; shift
+	printf '%s [%s] Entrypoint: %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$type" "$*"
+}
+LOG_I() {
+	LOG_RAW Note "$@"
+}
+LOG_W() {
+	LOG_RAW Warn "$@" >&2
+}
+LOG_E() {
+	LOG_RAW Error "$@" >&2
+	exit 1
+}
+
+LOG_I "Initial container for PostgreSQL"
 
 # allow the container to be started with `--user` or `-u`
 # if [ "$1" = 'app-name' -a "$(id -u)" = '0' ]; then
@@ -48,33 +63,16 @@ _is_sourced() {
 docker_create_db_directories() {
 	local user; user="$(id -u)"
 
-	# default value: /srv/data/postgresql
-	if [ ! -d "$PGDATA" ]; then
-		mkdir -p "$PGDATA"
-		chmod 755 "$PGDATA"
-	fi
+	LOG_I "Check directories used by postgres"
+	mkdir -p "/var/log/postgresql"
+	mkdir -p "/var/run/postgresql"
+	mkdir -p "${PGDATA}"
 
-	if [ ! -d /var/run/postgresql ]; then
-		mkdir -p /var/run/postgresql || :
-		chmod 755 /var/run/postgresql || :
-	fi
+	mkdir -p "/srv/conf/postgresql/initdb.d"
+	[ ! -e /srv/conf/postgresql/postgresql.conf ] && cp -rf /usr/share/postgresql/postgresql.conf.sample /srv/conf/postgresql/postgresql.conf
 
-	if [ ! -d /var/log/postgresql ]; then
-		mkdir -p /var/log/postgresql || :
-		chmod 755 /var/log/postgresql || :
-	fi
-
-	if [ ! -d /srv/conf/postgresql/initdb.d ]; then
-		mkdir -p /srv/conf/postgresql/initdb.d
-		chmod -R 755 /srv/conf/postgresql
-		cp -rf /usr/share/postgresql/postgresql.conf.sample /srv/conf/postgresql/postgresql.conf
-	fi
-
-	if [ ! -d /srv/conf/postgresql-common ]; then
-		mkdir -p /srv/conf/postgresql-common
-		chmod 755 /srv/conf/postgresql-common
-		cp -rf /etc/postgresql-common/createcluster.conf /srv/conf/postgresql-common/createcluster.conf
-	fi
+	mkdir -p "/srv/conf/postgresql-common"
+	[ ! -e /srv/conf/postgresql-common/createcluster.conf ] && cp -rf /etc/postgresql-common/createcluster.conf /srv/conf/postgresql-common/createcluster.conf
 
 	# 创建数据库日志存储目录，修改相应目录的所属用户信息
 	if [ -n "$POSTGRES_INITDB_WALDIR" ]; then
@@ -87,15 +85,19 @@ docker_create_db_directories() {
 
 	# 允许容器使用`--user`参数启动，修改相应目录的所属用户信息
 	if [ "$user" = '0' ]; then
-		find "$PGDATA" \! -user postgres -exec chown postgres '{}' +
+		find "${PGDATA}" \! -user postgres -exec chown postgres '{}' +
 		find /var/run/postgresql \! -user postgres -exec chown postgres '{}' +
 		find /var/log/postgresql \! -user postgres -exec chown postgres '{}' +
 		find /srv/conf/postgresql \! -user postgres -exec chown postgres '{}' +
 		find /srv/conf/postgresql-common \! -user postgres -exec chown postgres '{}' +
+		chmod 0755 /var/log/postgresql /var/run/postgresql /srv/conf/postgresql /srv/conf/postgresql-common
+		chmod 0700 ${PGDATA}
+		# 解决使用gosu后，nginx: [emerg] open() "/dev/stdout" failed (13: Permission denied)
+		chmod 0622 /dev/stdout /dev/stderr
 	fi
 }
 
-# 针对 PGDATA 目录为空时，使用'initdb'初始化数据目录；同时创建 POSTGRES_USER 定义的同名数据库用户
+# 针对 ${PGDATA} 目录为空时，使用'initdb'初始化数据目录；同时创建 POSTGRES_USER 定义的同名数据库用户
 # 用户需要传给`initdb`的参数，可通过环境变量 POSTGRES_INITDB_ARGS 传输，或直接使用命令行参数传输到当前函数
 # `initdb`会自动创建以下数据库："postgres", "template0", "template1" 
 docker_init_database_dir() {
@@ -104,7 +106,7 @@ docker_init_database_dir() {
 		export LD_PRELOAD='/usr/lib/libnss_wrapper.so'
 		export NSS_WRAPPER_PASSWD="$(mktemp)"
 		export NSS_WRAPPER_GROUP="$(mktemp)"
-		echo "postgres:x:$(id -u):$(id -g):PostgreSQL:$PGDATA:/bin/false" > "$NSS_WRAPPER_PASSWD"
+		echo "postgres:x:$(id -u):$(id -g):PostgreSQL:${PGDATA}:/bin/false" > "$NSS_WRAPPER_PASSWD"
 		echo "postgres:x:$(id -g):" > "$NSS_WRAPPER_GROUP"
 	fi
 
@@ -233,7 +235,7 @@ docker_setup_env() {
 
 	declare -g DATABASE_ALREADY_EXISTS
 	# look specifically for PG_VERSION, as it is expected in the DB dir
-	if [ -s "$PGDATA/PG_VERSION" ]; then
+	if [ -s "${PGDATA}/$PG_VERSION" ]; then
 		DATABASE_ALREADY_EXISTS='true'
 	fi
 }
@@ -247,7 +249,7 @@ pg_setup_hba_conf() {
 			echo '# see https://www.postgresql.org/docs/12/auth-trust.html'
 		fi
 		echo "host all all all $POSTGRES_HOST_AUTH_METHOD"
-	} >> "$PGDATA/pg_hba.conf"
+	} >> "${PGDATA}/pg_hba.conf"
 }
 
 # start socket-only postgresql server for setting up or running scripts
@@ -262,7 +264,7 @@ docker_temp_server_start() {
 	set -- "$@" -c listen_addresses='' -p "${PGPORT:-5432}"
 
 	PGUSER="${PGUSER:-$POSTGRES_USER}" \
-	pg_ctl -D "$PGDATA" \
+	pg_ctl -D "${PGDATA}" \
 		-o "$(printf '%q ' "$@")" \
 		-w start
 }
@@ -270,7 +272,7 @@ docker_temp_server_start() {
 # stop postgresql server after done setting up user and running scripts
 docker_temp_server_stop() {
 	PGUSER="${PGUSER:-postgres}" \
-	pg_ctl -D "$PGDATA" -m fast -w stop
+	pg_ctl -D "${PGDATA}" -m fast -w stop
 }
 
 # 检测可能导致postgres执行后直接退出的命令，如"--help"；如果存在，直接返回 0
diff --git a/README.md b/README.md
index 03a7197..eef3040 100644
--- a/README.md
+++ b/README.md
@@ -250,7 +250,7 @@ ENV LANG de_DE.utf8
 
 ## 变参 --user 说明
 
-本镜像允许使用变参`--user`指定运行时的用户信息。但需要注意的是，`postgres`可以允许使用任何UID执行（只需要需数据库目录所属账户一致），`initdb`需要确保该UID实际存在（用户需要在`/etc/passwd`文件中存在）：
+本镜像允许使用变参`--user`指定运行时的用户信息。但需要注意的是，`postgres`可以允许使用任何UID执行（只需要与数据库目录所属账户一致），`initdb`需要确保该UID实际存在（指定的用户需要在容器的`/etc/passwd`文件中存在）：
 
 ```shell
 $ docker run -it --rm --user www-data -e POSTGRES_PASSWORD=mysecretpassword endial/postgres-ubuntu:v10.12