转义双引号会导致 3 个而不是 4 个参数

dra*_*oth 5 escaping docker dockerfile

strace 表明,与 shell 形式相比,我使用的转义可能会导致问题(shell 形式与 exec 形式请参阅https://docs.docker.com/engine/reference/builder/

带有 [/* 3 vars */] 的 exec 形式 - 中断/制造麻烦

ENTRYPOINT ["strace", "hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""]
execve("hugo", ["hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""], [/* 3 vars */]) = 0
Run Code Online (Sandbox Code Playgroud)

带有 [/* 4 vars */] 的 shell 形式 - 工作正常

ENTRYPOINT strace hugo server --watch=true --bind=0.0.0.0 --source=""/src"" --destination=""/output""
execve("hugo", ["hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=/src", "--destination=/output"], [/* 4 vars */]) = 0"
Run Code Online (Sandbox Code Playgroud)

Dockerfile:(使用 ubuntu,因为我无法使用 alpine:latest 运行 strace。)

# escape=\
# first line can be removed and doesn't change the behavior of the described issue
FROM ubuntu:latest
RUN apt-get update && apt-get install hugo strace
RUN hugo new site src
WORKDIR /src
ENTRYPOINT ["strace", "hugo", "server", "--watch=true", "--bind=0.0.0.0", "--source=\"/src\"", "--destination=\"/output\""]
EXPOSE 1313
Run Code Online (Sandbox Code Playgroud)

运行并保存输出的命令:

 sudo docker run --security-opt seccomp:unconfined docker-hugo &> docker-hugo.strace
Run Code Online (Sandbox Code Playgroud)

(有关 --security-opt 的信息,请参阅https://github.com/moby/moby/issues/20064#issuecomment-291095117 )

可能场景概述:

+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
|                  | No Entrypoint                             | Entrypoint (JSON-form) | Entrypoint (shell-form)                           |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| No CMD           | HostConfig.Config.cmd=/bin/bash is called | breaks                 | ok                                                |
|                  | (assumption as of docker inspect)         |                        |                                                   |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| CMD (JSON-form)  | breaks                                    | breaks                 | breaks                                            |
|                  |                                           |                        | (other issue; not handled here                    |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
| CMD (shell-form) | ok                                        | ok                     | Breaks [seems to work as designed]                |
|                  |                                           |                        | (both are called with a shell concatinated)       |
|                  |                                           |                        | Example: /bin/sh -c <ENTRYPOINT> /bin/sh -c <CMD> |
+------------------+-------------------------------------------+------------------------+---------------------------------------------------+
Run Code Online (Sandbox Code Playgroud)

所以我的问题是:我是否没有正确转义 JSON 数组?