root
/
open-webui
mirror of https://github.com/open-webui/open-webui.git
1
0
Fork 0
Code Issues Actions 11 Packages Projects Releases Wiki Activity

refac: conditional USE_PERMISSION_HARDENING

This commit is contained in:
Timothy Jaeryang Baek 2025-08-28 20:19:47 +04:00
parent be373e9fd4
commit 0ebe4f8f84
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Dockerfile
View File

@ -4,6 +4,7 @@
ARG USE_CUDA=false ARG USE_CUDA=false
ARG USE_OLLAMA=false ARG USE_OLLAMA=false
ARG USE_SLIM=false ARG USE_SLIM=false
ARG USE_PERMISSION_HARDENING=false
# Tested with cu117 for CUDA 11 and cu121 for CUDA 12 (default) # Tested with cu117 for CUDA 11 and cu121 for CUDA 12 (default)
ARG USE_CUDA_VER=cu128 ARG USE_CUDA_VER=cu128
# any sentence transformer model; models to use can be found at https://huggingface.co/models?library=sentence-transformers # any sentence transformer model; models to use can be found at https://huggingface.co/models?library=sentence-transformers
@ -25,6 +26,9 @@ ARG GID=0
FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS build FROM --platform=$BUILDPLATFORM node:22-alpine3.20 AS build
ARG BUILD_HASH ARG BUILD_HASH
# Set Node.js options (heap limit Allocation failed - JavaScript heap out of memory)
# ENV NODE_OPTIONS="--max-old-space-size=4096"
WORKDIR /app WORKDIR /app
# to store git revision in build # to store git revision in build
@ -45,6 +49,7 @@ ARG USE_CUDA
ARG USE_OLLAMA ARG USE_OLLAMA
ARG USE_CUDA_VER ARG USE_CUDA_VER
ARG USE_SLIM ARG USE_SLIM
ARG USE_PERMISSION_HARDENING
ARG USE_EMBEDDING_MODEL ARG USE_EMBEDDING_MODEL
ARG USE_RERANKING_MODEL ARG USE_RERANKING_MODEL
ARG UID ARG UID
@ -169,11 +174,13 @@ HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq
# Minimal, atomic permission hardening for OpenShift (arbitrary UID): # Minimal, atomic permission hardening for OpenShift (arbitrary UID):
# - Group 0 owns /app and /root # - Group 0 owns /app and /root
# - Directories are group-writable and have SGID so new files inherit GID 0 # - Directories are group-writable and have SGID so new files inherit GID 0
RUN set -eux; \ RUN if [ "$USE_PERMISSION_HARDENING" = "true" ]; then \
set -eux; \
chgrp -R 0 /app /root || true; \ chgrp -R 0 /app /root || true; \
chmod -R g+rwX /app /root || true; \ chmod -R g+rwX /app /root || true; \
find /app -type d -exec chmod g+s {} + || true; \ find /app -type d -exec chmod g+s {} + || true; \
find /root -type d -exec chmod g+s {} + || true find /root -type d -exec chmod g+s {} + || true; \
fi
USER $UID:$GID USER $UID:$GID