Merge tag 'rel-0.9.18' into rasberrypi-0.9.18

image/Dockerfile

@@ -2,12 +2,11 @@
 FROM resin/rpi-raspbian:wheezy
 MAINTAINER Phusion <info@phusion.nl>
 
-ENV HOME /root
-ADD . /build
+ADD . /bd_build
 
-RUN /build/prepare.sh && \
-	/build/system_services.sh && \
-	/build/utilities.sh && \
-	/build/cleanup.sh
+RUN /bd_build/prepare.sh && \
+	/bd_build/system_services.sh && \
+	/bd_build/utilities.sh && \
+	/bd_build/cleanup.sh
 
 CMD ["/sbin/my_init"]

image/bin/my_init

@@ -9,6 +9,8 @@ LOG_LEVEL_WARN  = 1
 LOG_LEVEL_INFO  = 2
 LOG_LEVEL_DEBUG = 3
 
+SHENV_NAME_WHITELIST_REGEX = re.compile('[^\w\-_\.]')
+
 log_level = None
 
 terminated_child_processes = {}
@@ -57,6 +59,8 @@ def is_exe(path):
 		return False
 
 def import_envvars(clear_existing_environment = True, override_existing_environment = True):
+	if not os.path.exists("/etc/container_environment"):
+		return
 	new_env = {}
 	for envfile in listdir("/etc/container_environment"):
 		name = os.path.basename(envfile)
@@ -73,6 +77,8 @@ def import_envvars(clear_existing_environment = True, override_existing_environm
 			os.environ[name] = value
 
 def export_envvars(to_dir = True):
+	if not os.path.exists("/etc/container_environment"):
+		return
 	shell_dump = ""
 	for name, value in os.environ.items():
 		if name in ['HOME', 'USER', 'GROUP', 'UID', 'GID', 'SHELL']:
@@ -80,7 +86,7 @@ def export_envvars(to_dir = True):
 		if to_dir:
 			with open("/etc/container_environment/" + name, "w") as f:
 				f.write(value)
-		shell_dump += "export " + shquote(name) + "=" + shquote(value) + "\n"
+		shell_dump += "export " + sanitize_shenvname(name) + "=" + shquote(value) + "\n"
 	with open("/etc/container_environment.sh", "w") as f:
 		f.write(shell_dump)
 	with open("/etc/container_environment.json", "w") as f:
@@ -99,6 +105,9 @@ def shquote(s):
 	# the string $'b is then quoted as '$'"'"'b'
 	return "'" + s.replace("'", "'\"'\"'") + "'"
 
+def sanitize_shenvname(s):
+	return re.sub(SHENV_NAME_WHITELIST_REGEX, "_", s)
+
 # Waits for the child process with the given PID, while at the same time
 # reaping any other child processes that have exited (e.g. adopted child
 # processes that have terminated).
@@ -118,7 +127,10 @@ def waitpid_reap_other_children(pid):
 	status = None
 	while not done:
 		try:
-			this_pid, status = os.waitpid(-1, 0)
+			# https://github.com/phusion/baseimage-docker/issues/151#issuecomment-92660569
+			this_pid, status = os.waitpid(pid, os.WNOHANG)
+			if this_pid == 0:
+				this_pid, status = os.waitpid(-1, 0)
 			if this_pid == pid:
 				done = True
 			else:

image/buildconfig

@@ -1,3 +1,9 @@
 export LC_ALL=C
 export DEBIAN_FRONTEND=noninteractive
 minimal_apt_get_install='apt-get install -y --no-install-recommends'
+
+# Default services
+# Set 1 to the service you want to disable
+export DISABLE_SYSLOG=${DISABLE_SYSLOG:-0}
+export DISABLE_SSH=${DISABLE_SSH:-0}
+export DISABLE_CRON=${DISABLE_CRON:-0}

image/cleanup.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 set -e
-source /build/buildconfig
+source /bd_build/buildconfig
 set -x
 
 apt-get clean
-rm -rf /build
+rm -rf /bd_build
 rm -rf /tmp/* /var/tmp/*
 rm -rf /var/lib/apt/lists/*
 rm -f /etc/dpkg/dpkg.cfg.d/02apt-speedup

image/prepare.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 set -e
-source /build/buildconfig
+source /bd_build/buildconfig
 set -x
 
 ## Temporarily disable dpkg fsync to make building faster.

image/services/cron/cron.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -e
+source /bd_build/buildconfig
+set -x
+
+$minimal_apt_get_install cron
+mkdir /etc/service/cron
+chmod 600 /etc/crontab
+cp /bd_build/services/cron/cron.runit /etc/service/cron/run
+
+## Remove useless cron entries.
+# Checks for lost+found and scans for mtab.
+rm -f /etc/cron.daily/standard
+rm -f /etc/cron.daily/upstart
+rm -f /etc/cron.daily/dpkg
+rm -f /etc/cron.daily/password
+rm -f /etc/cron.weekly/fstrim

image/services/sshd/sshd.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -e
+source /bd_build/buildconfig
+set -x
+
+SSHD_BUILD_PATH=/bd_build/services/sshd
+
+## Install the SSH server.
+$minimal_apt_get_install openssh-server
+mkdir /var/run/sshd
+mkdir /etc/service/sshd
+touch /etc/service/sshd/down
+cp $SSHD_BUILD_PATH/sshd.runit /etc/service/sshd/run
+cp $SSHD_BUILD_PATH/sshd_config /etc/ssh/sshd_config
+cp $SSHD_BUILD_PATH/00_regen_ssh_host_keys.sh /etc/my_init.d/
+
+## Install default SSH key for root and app.
+mkdir -p /root/.ssh
+chmod 700 /root/.ssh
+chown root:root /root/.ssh
+cp $SSHD_BUILD_PATH/keys/insecure_key.pub /etc/insecure_key.pub
+cp $SSHD_BUILD_PATH/keys/insecure_key /etc/insecure_key
+chmod 644 /etc/insecure_key*
+chown root:root /etc/insecure_key*
+cp $SSHD_BUILD_PATH/enable_insecure_key /usr/sbin/

image/services/syslog-ng/syslog-ng.conf

@@ -0,0 +1,148 @@
+@version: 3.5
+@include "scl.conf"
+@include "`scl-root`/system/tty10.conf"
+
+# Syslog-ng configuration file, compatible with default Debian syslogd
+# installation.
+
+# First, set some global options.
+options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
+	  owner("root"); group("adm"); perm(0640); stats_freq(0);
+	  bad_hostname("^gconfd$");
+};
+
+########################
+# Sources
+########################
+# This is the default behavior of sysklogd package
+# Logs may come from unix stream, but not from another machine.
+#
+source s_src {
+       unix-stream("/dev/log");
+       internal();
+};
+
+# If you wish to get logs from remote machine you should uncomment
+# this and comment the above source line.
+#
+#source s_net { tcp(ip(127.0.0.1) port(1000)); };
+
+########################
+# Destinations
+########################
+# First some standard logfile
+#
+destination d_auth { file("/var/log/auth.log"); };
+destination d_cron { file("/var/log/cron.log"); };
+destination d_daemon { file("/var/log/daemon.log"); };
+destination d_kern { file("/var/log/kern.log"); };
+destination d_lpr { file("/var/log/lpr.log"); };
+destination d_mail { file("/var/log/mail.log"); };
+destination d_syslog { file("/var/log/syslog"); };
+destination d_user { file("/var/log/user.log"); };
+destination d_uucp { file("/var/log/uucp.log"); };
+
+# This files are the log come from the mail subsystem.
+#
+destination d_mailinfo { file("/var/log/mail.info"); };
+destination d_mailwarn { file("/var/log/mail.warn"); };
+destination d_mailerr { file("/var/log/mail.err"); };
+
+# Logging for INN news system
+#
+destination d_newscrit { file("/var/log/news/news.crit"); };
+destination d_newserr { file("/var/log/news/news.err"); };
+destination d_newsnotice { file("/var/log/news/news.notice"); };
+
+# Some `catch-all' logfiles.
+#
+destination d_debug { file("/var/log/debug"); };
+destination d_error { file("/var/log/error"); };
+destination d_messages { file("/var/log/messages"); };
+
+# The named pipe /dev/xconsole is for the nsole' utility.  To use it,
+# you must invoke nsole' with the -file' option:
+#
+#    $ xconsole -file /dev/xconsole [...]
+#
+destination d_xconsole { pipe("/dev/xconsole"); };
+
+# Send the messages to an other host
+#
+#destination d_net { tcp("127.0.0.1" port(1000) log_fifo_size(1000)); };
+
+# Debian only
+destination d_ppp { file("/var/log/ppp.log"); };
+
+########################
+# Filters
+########################
+# Here's come the filter options. With this rules, we can set which 
+# message go where.
+
+filter f_dbg { level(debug); };
+filter f_info { level(info); };
+filter f_notice { level(notice); };
+filter f_warn { level(warn); };
+filter f_err { level(err); };
+filter f_crit { level(crit .. emerg); };
+
+filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };
+filter f_error { level(err .. emerg) ; };
+filter f_messages { level(info,notice,warn) and 
+                    not facility(auth,authpriv,cron,daemon,mail,news); };
+
+filter f_auth { facility(auth, authpriv) and not filter(f_debug); };
+filter f_cron { facility(cron) and not filter(f_debug); };
+filter f_daemon { facility(daemon) and not filter(f_debug); };
+filter f_kern { facility(kern) and not filter(f_debug); };
+filter f_lpr { facility(lpr) and not filter(f_debug); };
+filter f_local { facility(local0, local1, local3, local4, local5,
+                        local6, local7) and not filter(f_debug); };
+filter f_mail { facility(mail) and not filter(f_debug); };
+filter f_news { facility(news) and not filter(f_debug); };
+filter f_syslog3 { not facility(auth, authpriv, mail) and not filter(f_debug); };
+filter f_user { facility(user) and not filter(f_debug); };
+filter f_uucp { facility(uucp) and not filter(f_debug); };
+
+filter f_cnews { level(notice, err, crit) and facility(news); };
+filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); };
+
+filter f_ppp { facility(local2) and not filter(f_debug); };
+filter f_console { level(warn .. emerg); };
+
+########################
+# Log paths
+########################
+log { source(s_src); filter(f_auth); destination(d_auth); };
+log { source(s_src); filter(f_cron); destination(d_cron); };
+log { source(s_src); filter(f_daemon); destination(d_daemon); };
+log { source(s_src); filter(f_kern); destination(d_kern); };
+log { source(s_src); filter(f_lpr); destination(d_lpr); };
+log { source(s_src); filter(f_syslog3); destination(d_syslog); };
+log { source(s_src); filter(f_user); destination(d_user); };
+log { source(s_src); filter(f_uucp); destination(d_uucp); };
+
+log { source(s_src); filter(f_mail); destination(d_mail); };
+#log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); };
+#log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); };
+#log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); };
+
+log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); };
+log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); };
+log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); };
+
+#log { source(s_src); filter(f_ppp); destination(d_ppp); };
+
+log { source(s_src); filter(f_debug); destination(d_debug); };
+log { source(s_src); filter(f_error); destination(d_error); };
+log { source(s_src); filter(f_messages); destination(d_messages); };
+
+# All messages send to a remote site
+#
+#log { source(s_src); destination(d_net); };
+
+###
+# Include all config files in /etc/syslog-ng/conf.d/
+###
+@include "/etc/syslog-ng/conf.d/*.conf"

image/services/syslog-ng/syslog-ng.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+source /bd_build/buildconfig
+set -x
+
+SYSLOG_NG_BUILD_PATH=/bd_build/services/syslog-ng
+
+## Install a syslog daemon.
+$minimal_apt_get_install syslog-ng-core
+mkdir /etc/service/syslog-ng
+cp $SYSLOG_NG_BUILD_PATH/syslog-ng.runit /etc/service/syslog-ng/run
+mkdir -p /var/lib/syslog-ng
+cp $SYSLOG_NG_BUILD_PATH/syslog_ng_default /etc/default/syslog-ng
+touch /var/log/syslog
+chmod u=rw,g=r,o= /var/log/syslog
+cp $SYSLOG_NG_BUILD_PATH/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
+
+## Install syslog to "docker logs" forwarder.
+mkdir /etc/service/syslog-forwarder
+cp $SYSLOG_NG_BUILD_PATH/syslog-forwarder.runit /etc/service/syslog-forwarder/run
+
+## Install logrotate.
+$minimal_apt_get_install logrotate
+cp $SYSLOG_NG_BUILD_PATH/logrotate_syslogng /etc/logrotate.d/syslog-ng

image/system_services.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 set -e
-source /build/buildconfig
+source /bd_build/buildconfig
 set -x
 
 ## Install init process.
-cp /build/bin/my_init /sbin/
+cp /bd_build/bin/my_init /sbin/
 mkdir -p /etc/my_init.d
 mkdir -p /etc/container_environment
 touch /etc/container_environment.sh
@@ -19,51 +19,11 @@ ln -s /etc/container_environment.sh /etc/profile.d/
 ## Install runit.
 $minimal_apt_get_install runit
 
-## Install a syslog daemon.
-$minimal_apt_get_install syslog-ng-core
-mkdir /etc/service/syslog-ng
-cp /build/runit/syslog-ng /etc/service/syslog-ng/run
-mkdir -p /var/lib/syslog-ng
-cp /build/config/syslog_ng_default /etc/default/syslog-ng
-touch /var/log/syslog
-chmod u=rw,g=r,o= /var/log/syslog
-# Replace the system() source because inside Docker we
-# can't access /proc/kmsg.
-sed -i -E 's/^(\s*)system\(\);/\1unix-stream("\/dev\/log");/' /etc/syslog-ng/syslog-ng.conf
-
-## Install syslog to "docker logs" forwarder.
-mkdir /etc/service/syslog-forwarder
-cp /build/runit/syslog-forwarder /etc/service/syslog-forwarder/run
-
-## Install logrotate.
-$minimal_apt_get_install logrotate
-cp /build/config/logrotate_syslogng /etc/logrotate.d/syslog-ng
+## Install a syslog daemon and logrotate.
+[ "$DISABLE_SYSLOG" -eq 0 ] && /bd_build/services/syslog-ng/syslog-ng.sh || true
 
 ## Install the SSH server.
-$minimal_apt_get_install openssh-server
-mkdir /var/run/sshd
-mkdir /etc/service/sshd
-touch /etc/service/sshd/down
-cp /build/runit/sshd /etc/service/sshd/run
-cp /build/config/sshd_config /etc/ssh/sshd_config
-cp /build/00_regen_ssh_host_keys.sh /etc/my_init.d/
-
-## Install default SSH key for root and app.
-mkdir -p /root/.ssh
-chmod 700 /root/.ssh
-chown root:root /root/.ssh
-cp /build/insecure_key.pub /etc/insecure_key.pub
-cp /build/insecure_key /etc/insecure_key
-chmod 644 /etc/insecure_key*
-chown root:root /etc/insecure_key*
-cp /build/bin/enable_insecure_key /usr/sbin/
+[ "$DISABLE_SSH" -eq 0 ] && /bd_build/services/sshd/sshd.sh || true
 
 ## Install cron daemon.
-$minimal_apt_get_install cron
-mkdir /etc/service/cron
-chmod 600 /etc/crontab
-cp /build/runit/cron /etc/service/cron/run
-
-## Remove useless cron entries.
-# Checks for lost+found and scans for mtab.
-rm -f /etc/cron.daily/standard
+[ "$DISABLE_CRON" -eq 0 ] && /bd_build/services/cron/cron.sh || true

image/utilities.sh

@@ -1,10 +1,11 @@
 #!/bin/bash
 set -e
-source /build/buildconfig
+source /bd_build/buildconfig
 set -x
 
 ## Often used tools.
-$minimal_apt_get_install curl less nano vim psmisc
+$minimal_apt_get_install curl less vim-tiny psmisc
+ln -s /usr/bin/vim.tiny /usr/bin/vim
 
 ## This tool runs a command as another user and sets $HOME.
-cp /build/bin/setuser /sbin/setuser
+cp /bd_build/bin/setuser /sbin/setuser