From d27aa137cfb22f22ddaa87a7cf793143f5c69a91 Mon Sep 17 00:00:00 2001
From: Hugh Nimmo-Smith <hughns@element.io>
Date: Fri, 20 Jan 2023 13:31:14 +0000
Subject: [PATCH] Build a docker image using unprivileged nginx

BREAKING CHANGE the exposed port has changed from 80 to 8080
---
 Dockerfile               | 9 ++++++++-
 doc/docker.md            | 4 ++--
 docker/dynamic-config.sh | 7 +++++--
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4d8be56b..011c7f89 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,10 +10,17 @@ RUN yarn install
 COPY . /app
 RUN yarn build
 
-FROM --platform=${BUILDPLATFORM} docker.io/nginx:alpine
+# Because we will be running as an unprivileged user, we need to make sure that the config file is writable
+# So, we will copy the default config to the /tmp folder that will be writable at runtime
+RUN mv -f target/config.json /config.json.bundled \
+  && ln -sf /tmp/config.json target/config.json
+
+FROM --platform=${BUILDPLATFORM} docker.io/nginxinc/nginx-unprivileged:alpine
 
 # Copy the dynamic config script
 COPY ./docker/dynamic-config.sh /docker-entrypoint.d/99-dynamic-config.sh
+# And the bundled config file
+COPY --from=builder /config.json.bundled /config.json.bundled
 
 # Copy the built app from the first build stage
 COPY --from=builder /app/target /usr/share/nginx/html
diff --git a/doc/docker.md b/doc/docker.md
index 752c492f..336d658a 100644
--- a/doc/docker.md
+++ b/doc/docker.md
@@ -55,7 +55,7 @@ Then, start up a container from that image:
 ```
 docker run \
     --name hydrogen \
-    --publish 80:80 \
+    --publish 8080:8080 \
     hydrogen
 ```
 
@@ -64,7 +64,7 @@ You can override the default `config.json` using the `CONFIG_OVERRIDE` environme
 ```
 docker run \
     --name hydrogen \
-    --publish 80:80 \
+    --publish 8080:8080 \
     --env CONFIG_OVERRIDE='{
   "push": {
     "appId": "io.element.hydrogen.web",
diff --git a/docker/dynamic-config.sh b/docker/dynamic-config.sh
index 952cb969..99858a27 100755
--- a/docker/dynamic-config.sh
+++ b/docker/dynamic-config.sh
@@ -2,7 +2,10 @@
 
 set -eux
 
-# Use config override environment variable if set
 if [ -n "${CONFIG_OVERRIDE:-}" ]; then
-    echo "$CONFIG_OVERRIDE" > /usr/share/nginx/html/config.json
+    # Use config override environment variable if set
+    echo "$CONFIG_OVERRIDE" > /tmp/config.json
+else
+    # Otherwise, use the default config that was bundled in the image
+    cp /config.json.bundled /tmp/config.json
 fi