80 lines
2.8 KiB
Bash
Executable File
80 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/dumb-init /bin/sh
|
|
# Copyright IBM Corp. 2020, 2026
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
set -e
|
|
|
|
# Note above that we run dumb-init as PID 1 in order to reap zombie processes
|
|
# as well as forward signals to all processes in its session. Normally, sh
|
|
# wouldn't do either of these functions so we'd leak zombies as well as do
|
|
# unclean termination of all our sub-processes.
|
|
|
|
# Prevent core dumps
|
|
ulimit -c 0
|
|
|
|
# Backwards compatibility: honor legacy BOUNDARY_* environment variables by
|
|
# mirroring them to their THRESHOLD_* equivalents when the latter are unset.
|
|
# (The Threshold CLI itself also falls back to BOUNDARY_* for CLI variables.)
|
|
for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
|
|
new_name="THRESHOLD_${legacy_name#BOUNDARY_}"
|
|
if [ -z "$(printenv "$new_name")" ]; then
|
|
export "$new_name=$(printenv "$legacy_name")"
|
|
fi
|
|
done
|
|
|
|
# If the user is trying to run Threshold directly with some arguments, then
|
|
# pass them to Threshold.
|
|
if [ "${1:0:1}" = '-' ]; then
|
|
set -- threshold "$@"
|
|
fi
|
|
|
|
if [ "$1" = 'server' ]; then
|
|
shift
|
|
set -- threshold server \
|
|
"$@"
|
|
elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
|
|
# We can't use the return code to check for the existence of a subcommand, so
|
|
# we have to use grep to look for a pattern in the help output.
|
|
set -- threshold "$@"
|
|
fi
|
|
|
|
# If we are running Threshold, make sure it executes as the proper user.
|
|
if [ "$1" = 'threshold' ]; then
|
|
is_root=0
|
|
if [ "$(id -u)" = '0' ]; then
|
|
is_root=1
|
|
fi
|
|
|
|
if [ -z "$SKIP_CHOWN" ]; then
|
|
if [ "$is_root" = '1' ]; then
|
|
# If the config dir is bind mounted then chown it
|
|
if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
|
|
chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
|
|
fi
|
|
else
|
|
>&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
|
|
fi
|
|
fi
|
|
|
|
if [ -z "$SKIP_SETCAP" ]; then
|
|
if [ "$is_root" = '1' ]; then
|
|
# Allow mlock to avoid swapping Threshold memory to disk
|
|
setcap cap_ipc_lock=+ep $(readlink -f $(which threshold))
|
|
|
|
# In the case Threshold has been started in a container without IPC_LOCK privileges
|
|
if ! threshold -version 1>/dev/null 2>/dev/null; then
|
|
>&2 echo "Couldn't start Threshold with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
|
|
setcap cap_ipc_lock=-ep $(readlink -f $(which threshold))
|
|
fi
|
|
else
|
|
>&2 echo "SKIP_SETCAP not set but running non-root; skipping setcap"
|
|
fi
|
|
fi
|
|
|
|
if [ "$is_root" = '1' ]; then
|
|
set -- su-exec threshold "$@"
|
|
fi
|
|
fi
|
|
|
|
exec "$@"
|