threshold/.release/docker/docker-entrypoint.sh

#!/usr/bin/dumb-init /bin/sh
# Copyright IBM Corp. 2020, 2026
# SPDX-License-Identifier: BUSL-1.1

set -e

# Note above that we run dumb-init as PID 1 in order to reap zombie processes
# as well as forward signals to all processes in its session. Normally, sh
# wouldn't do either of these functions so we'd leak zombies as well as do
# unclean termination of all our sub-processes.

# Prevent core dumps
ulimit -c 0

# Backwards compatibility: honor legacy BOUNDARY_* environment variables by
# mirroring them to their THRESHOLD_* equivalents when the latter are unset.
# (The Threshold CLI itself also falls back to BOUNDARY_* for CLI variables.)
for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
    new_name="THRESHOLD_${legacy_name#BOUNDARY_}"
    if [ -z "$(printenv "$new_name")" ]; then
        export "$new_name=$(printenv "$legacy_name")"
    fi
done

# Backwards compatibility: the legacy HashiCorp Boundary image kept its config
# in /boundary/config.hcl and ran the "boundary" binary. Accept both.
# (The *_TEST_* overrides exist only for .release/docker/test-entrypoint.sh.)
NEW_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_NEW:-/threshold/config.hcl}
LEGACY_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_LEGACY:-/boundary/config.hcl}
STOCK_CONFIG_COPY=${THRESHOLD_ENTRYPOINT_TEST_STOCK:-/usr/share/threshold/config.hcl.default}

legacy_warn() {
    >&2 echo "WARNING: $1 (deprecated Boundary-era path); please move to /threshold/config.hcl"
}

# Prints the config path that should actually be used for a requested -config
# path. Prefers /threshold/config.hcl, falling back to /boundary/config.hcl.
resolve_config_path() {
    case "$1" in
    "$NEW_CONFIG_PATH")
        # The image ships a stock demo config at /threshold/config.hcl. If it is
        # still the stock one and the user supplied their own legacy config
        # (for example by mounting it at /boundary/config.hcl on an image
        # where /boundary is a real directory), use theirs.
        if [ -f "$LEGACY_CONFIG_PATH" ] && ! [ "$LEGACY_CONFIG_PATH" -ef "$NEW_CONFIG_PATH" ] \
            && [ -f "$STOCK_CONFIG_COPY" ] && cmp -s "$NEW_CONFIG_PATH" "$STOCK_CONFIG_COPY"; then
            legacy_warn "using $LEGACY_CONFIG_PATH"
            echo "$LEGACY_CONFIG_PATH"
            return
        fi
        ;;
    "$LEGACY_CONFIG_PATH")
        if [ -f "$LEGACY_CONFIG_PATH" ]; then
            legacy_warn "using $LEGACY_CONFIG_PATH"
        elif [ -f "$NEW_CONFIG_PATH" ]; then
            legacy_warn "$LEGACY_CONFIG_PATH not found, falling back to $NEW_CONFIG_PATH"
            echo "$NEW_CONFIG_PATH"
            return
        fi
        ;;
    esac
    echo "$1"
}

# Accept the legacy command name: "docker run <image> boundary ..." (or an
# entrypoint/command override that invokes boundary) runs threshold.
if [ "$1" = 'boundary' ]; then
    >&2 echo "WARNING: the 'boundary' command is deprecated; use 'threshold' (running threshold)"
    shift
    set -- threshold "$@"
fi

# If the user is trying to run Threshold directly with some arguments, then
# pass them to Threshold.
if [ "${1:0:1}" = '-' ]; then
    set -- threshold "$@"
fi

if [ "$1" = 'server' ]; then
    shift
    set -- threshold server \
        "$@"
elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
    # We can't use the return code to check for the existence of a subcommand, so
    # we have to use grep to look for a pattern in the help output.
    set -- threshold "$@"
fi

# Rewrite -config arguments (see resolve_config_path).
if [ "$1" = 'threshold' ]; then
    _n=$#
    _prev=""
    while [ "$_n" -gt 0 ]; do
        _a=$1
        shift
        _n=$((_n - 1))
        case "$_prev" in
        -config | --config) _new=$(resolve_config_path "$_a") ;;
        *) _new=$_a ;;
        esac
        case "$_a" in
        -config=* | --config=*) _new="${_a%%=*}=$(resolve_config_path "${_a#*=}")" ;;
        esac
        _prev=$_a
        set -- "$@" "$_new"
    done
fi

# If we are running Threshold, make sure it executes as the proper user.
if [ "$1" = 'threshold' ]; then
	is_root=0
	if [ "$(id -u)" = '0' ]; then
		is_root=1
	fi

    if [ -z "$SKIP_CHOWN" ]; then
        if [ "$is_root" = '1' ]; then
            # If the config dir is bind mounted then chown it
            if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
                chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
            fi
            # Legacy config dir, when it is a real directory (not the symlink to /threshold)
            if [ -d /boundary ] && [ ! -L /boundary ] && [ "$(stat -c %u /boundary)" != "$(id -u threshold)" ]; then
                chown -R threshold:threshold /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
            fi
        else
            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
        fi
    fi

    if [ -z "$SKIP_SETCAP" ]; then
        if [ "$is_root" = '1' ]; then
            # Allow mlock to avoid swapping Threshold memory to disk
            setcap cap_ipc_lock=+ep $(readlink -f $(which threshold))

            # In the case Threshold has been started in a container without IPC_LOCK privileges
            if ! threshold -version 1>/dev/null 2>/dev/null; then
                >&2 echo "Couldn't start Threshold with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
                setcap cap_ipc_lock=-ep $(readlink -f $(which threshold))
            fi
        else
            >&2 echo "SKIP_SETCAP not set but running non-root; skipping setcap"
        fi
    fi

    if [ "$is_root" = '1' ]; then
      set -- su-exec threshold "$@"
    fi
fi

exec "$@"