dra*_*oth 5 escaping docker dockerfile
strace 表明,与 shell 形式相比,我使用的转义可能会导致问题(shell 形式与 exec 形式请参阅https://docs.docker.com/engine/reference/builder/)
带有 [/* 3 vars */] 的 exec 形式 - 中断/制造麻烦
ENTRYPOINT ["strace", "hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""]
execve("hugo", ["hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""], [/* 3 vars */]) = 0
Run Code Online (Sandbox Code Playgroud)
带有 [/* 4 vars */] 的 shell 形式 - 工作正常
ENTRYPOINT strace hugo server --watch=true --bind=0.0.0.0 --source=""/src"" --destination=""/output""
execve("hugo", ["hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=/src", "--destination=/output"], [/* 4 vars */]) = 0"
Run Code Online (Sandbox Code Playgroud)
Dockerfile:(使用 ubuntu,因为我无法使用 alpine:latest 运行 strace。)
# escape=\
# first line can be removed and doesn't change the behavior of the described issue
FROM ubuntu:latest
RUN apt-get update && apt-get install hugo strace
RUN hugo new site src
WORKDIR /src
ENTRYPOINT ["strace", "hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""]
EXPOSE 1313
Run Code Online (Sandbox Code Playgroud)
运行并保存输出的命令:
sudo docker run --security-opt seccomp:unconfined docker-hugo &> docker-hugo.strace
Run Code Online (Sandbox Code Playgroud)
(有关 --security-opt 的信息,请参阅https://github.com/moby/moby/issues/20064#issuecomment-291095117 )
可能场景概述:
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| | No Entrypoint | Entrypoint (JSON-form) | Entrypoint (shell-form) |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| No CMD | HostConfig.Config.cmd=/bin/bash is called | breaks | ok |
| | (assumption as of docker inspect) | | |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| CMD (JSON-form) | breaks | breaks | breaks |
| | | | (other issue; not handled here |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| CMD (shell-form) | ok | ok | Breaks [seems to work as designed] |
| | | | (both are called with a shell concatinated) |
| | | | Example: /bin/sh -c <ENTRYPOINT> /bin/sh -c <CMD> |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
Run Code Online (Sandbox Code Playgroud)
所以我的问题是:我是否没有正确转义 JSON 数组?
| 归档时间: |
|
| 查看次数: |
1586 次 |
| 最近记录: |