60 lines
2.0 KiB
Docker
60 lines
2.0 KiB
Docker
# Dev/test container for wp-engine.sh
|
|
#
|
|
# Provides the root + systemd + apt environment the script expects on a bare
|
|
# host. Must run --privileged (set in devcontainer.json) so UFW, Fail2ban and a
|
|
# nested Docker daemon behave like they would on real hardware.
|
|
#
|
|
# Manual (non-VS Code) usage:
|
|
# docker build -t wp-engine-dev .devcontainer
|
|
# docker run --rm -d --name wp-engine-dev --privileged \
|
|
# -p 80:80 -p 443:443 -p 81:81 -p 3000:3000 -p 48222:48222 \
|
|
# -v "$PWD":/workspaces/SecureServer wp-engine-dev
|
|
# docker exec -it wp-engine-dev bash
|
|
|
|
FROM ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
container=docker
|
|
|
|
# systemd as PID 1, plus tools the harness and the script's hardening path need.
|
|
# (ufw/fail2ban/docker are deliberately NOT preinstalled -- wp-engine.sh installs
|
|
# them itself during --bootstrap, which is exactly what we want to test.)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
systemd \
|
|
systemd-sysv \
|
|
openssh-server \
|
|
openssh-client \
|
|
sudo \
|
|
ca-certificates \
|
|
curl \
|
|
gnupg \
|
|
lsb-release \
|
|
apt-transport-https \
|
|
git \
|
|
jq \
|
|
shellcheck \
|
|
iproute2 \
|
|
procps \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& mkdir -p /run/sshd /run/lock
|
|
|
|
# Silence units that cannot work inside a container so boot completes cleanly.
|
|
RUN systemctl set-default multi-user.target \
|
|
&& systemctl mask --no-reload -- \
|
|
systemd-remount-fs.service \
|
|
getty.target \
|
|
systemd-logind.service \
|
|
dev-hugepages.mount \
|
|
sys-fs-fuse-connections.mount \
|
|
2>/dev/null || true
|
|
|
|
# Docker-in-Docker: Docker 29's default containerd snapshotter fails to mount
|
|
# nested overlay layers (EINVAL on overlay-on-overlay). The classic overlay2
|
|
# graphdriver (same as the official docker:dind image) works on kernels >= 5.11.
|
|
COPY daemon.json /etc/docker/daemon.json
|
|
|
|
# Container-friendly init: systemd wants SIGRTMIN+3 to shut down.
|
|
STOPSIGNAL SIGRTMIN+3
|
|
|
|
CMD ["/sbin/init"]
|