bryanhong/docker-aptly

Dockerfile and support scripts to run aptly in a container backed by nginx

docker-aptly's Issues

building debian dockerfile has problems

Hello,

The key has expired in this line:

RUN apt-key adv --keyserver keys.gnupg.net --recv-keys 9E3E53F19C7DE460

aptly-dev/aptly#717 has the new key:

RUN apt-key adv --keyserver keys.gnupg.net --recv-keys ED75B5A4483DA07C

Also the Aptly Bash completions fails. I didn't bother debugging and just commented it out to continue.

converted 'https://github.com/smira/aptly/raw/master/bash_completion.d/aptly' (ANSI_X3.4-1968) -> 'https://github.com/smira/aptly/raw/master/bash_completion.d/aptly' (UTF-8)                                                                     
--2020-07-18 02:52:16--  https://github.com/smira/aptly/raw/master/bash_completion.d/aptly                                                                                                                                                        
Resolving github.com (github.com)... 140.82.113.3                                                                                                                                                                                                 
Connecting to github.com (github.com)|140.82.113.3|:443... connected.                                                                                                                                                                             
HTTP request sent, awaiting response... 301 Moved Permanently                                                                                                                                                                                     
Location: https://github.com/smira/aptly-fork/raw/master/bash_completion.d/aptly [following]                                                                                                                                                      
converted 'https://github.com/smira/aptly-fork/raw/master/bash_completion.d/aptly' (ANSI_X3.4-1968) -> 'https://github.com/smira/aptly-fork/raw/master/bash_completion.d/aptly' (UTF-8)                                                           
--2020-07-18 02:52:16--  https://github.com/smira/aptly-fork/raw/master/bash_completion.d/aptly                                                                                                                                                   
Reusing existing connection to github.com:443.                                                                                                                                                                                                    
HTTP request sent, awaiting response... 404 Not Found                                                                                                                                                                                             
2020-07-18 02:52:16 ERROR 404: Not Found.                                                                                                                                                                                                         

aptly container fails when "/" filesystem is mounted read-only

Regarding the docker-aptly container: To implement the Docker CIS security benchmark (item 5.12 in the benchmark) we need to be able to run the aptly container with read-only "/" filesystem. However, it appears aptly requires "/" to be mounted rw on container startup, or else it fails as follows:

Aug 15 14:43:41 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: IOError: [Errno 2] No usable temporary directory found in ['/tmp', '/var/tmp', '/usr/tmp', '/']
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: gpg: fatal: can't create directory `/root/.gnupg': Read-only file system
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: secmem usage: 0/0 bytes in 0/0 blocks of pool 0/65536
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: gpg: fatal: can't create directory `/root/.gnupg': Read-only file system
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: secmem usage: 0/0 bytes in 0/0 blocks of pool 0/65536
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: gpg: fatal: can't create directory `/root/.gnupg': Read-only file system
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: secmem usage: 0/0 bytes in 0/0 blocks of pool 0/65536
Aug 15 14:43:48 tfvm docker.05b9adcea05e/bryanhong/aptly:latest[18739]: ln: failed to create symbolic link '/root/.gnupg/secring.gpg': No such file or directory

The container is run as follows:

docker run --read-only --detach=true --log-driver=syslog --name="aptly" --restart=always --env FULL_NAME="First Last" --env EMAIL_ADDRESS="[email protected]" --env GPG_PASSWORD="PickAPassword" --env HOSTNAME=tfvm --volume /var/aptly:/opt/aptly --publish 8880:80 bryanhong/aptly:latest

a) Can the aptly docker container be configured to work with read-only "/" (i.e docker run with --read-only) flag?
b) If not, what are the technical reasons for this (which can be used to justify it under a security analysis)?

update script has GPG signing prompt

Hi, I've got a prompt asking for my gpg password when aptly wants to sign my repository.
Maybe "--batch" mode has to be added ?