cloud-node-container/scripts/entrypoint.sh

#!/usr/bin/env bash

if [ -z "$NODEVER" ]; then
  NODEVER="20";
fi

if [ -z "$environment" ]; then
  environment="PROD"
fi

# Create user with proper error handling
if ! id -u $user >/dev/null 2>&1; then
    echo "Creating user $user with UID $uid"
    adduser -u $uid -m -s /bin/bash $user || {
        echo "Failed to create user $user with UID $uid"
        exit 1
    }
else
    echo "User $user already exists"
fi

# ---- root never follows customer symlinks under /home/$user ----
# /home/$user is the customer's bind mount: they can plant symlinks in it, and
# root touching/chowning/writing through one (e.g. logs/nginx -> /etc) gives
# them that target. logs/ is WHP-owned and nginx opens files in it as root, so
# symlinks there are removed and logged; everything under /home/$user is created/written AS THE CUSTOMER.
as_user() {
  if command -v setpriv >/dev/null 2>&1; then
    setpriv --reuid="$uid" --regid="$uid" --init-groups -- "$@"
  else
    runuser -u "$user" -- "$@"
  fi
}
# Fail closed: refusing to start only hurts the customer who planted the path,
# which is preferred to root following it.
die() {
  echo "entrypoint: FATAL: $* - refusing to start" >&2
  exit 1
}
# Unlink AS THE CUSTOMER: rm on the final component never touches the link
# target, and if a parent dir is swapped for a symlink mid-way the customer can
# only delete what they already could. Still a symlink afterwards -> refuse to
# start (fail closed).
drop_symlink() {
  if [ -L "$1" ]; then
    echo "entrypoint: SECURITY: $1 was a symlink to '$(readlink "$1")' - removing" >&2
    as_user rm -f -- "$1"
    [ -L "$1" ] && die "could not remove symlink $1"
  fi
  return 0
}
if [ -L /home/$user ] || [ ! -d /home/$user ]; then
  die "/home/$user is not a real directory"
fi
chown -h $user:$user /home/$user
# app/ may legitimately be a symlink (releases/current deploys): it is left
# alone, and every root-side operation on it below runs as the customer.
drop_symlink /home/$user/logs
if [ -d /home/$user/logs ]; then
  # nginx opens its logs here as root. As the customer: find without -L never
  # follows symlinks, -delete unlinks the link itself, and a raced parent swap
  # can only reach what the customer could already delete. Re-checked
  # fail-closed immediately before nginx starts.
  as_user find /home/$user/logs -xdev -type l \
    -printf 'entrypoint: SECURITY: %p was a symlink to %l - removed\n' -delete >&2 || true
fi

as_user mkdir -p /home/$user/app /home/$user/logs/nginx /home/$user/logs/nodejs

# Link log directories
rm -rf /var/log/nginx
ln -s /home/$user/logs/nginx /var/log/nginx
ln -s /home/$user/logs/nodejs /var/log/nodejs

# Configure nginx for reverse proxy
/scripts/create-nginx-config.sh

# Set ownership and permissions. GNU chown -R defaults to -P: symlinks are
# lchown()ed, never followed.
chown -R $user:$user /home/$user
# Do NOT `chmod -R 755` here. /home/$user is the customer's bind-mounted
# directory; a recursive 755 on every start made every file (.env, app
# secrets) world-readable AND executable, and reverted any tighter
# permissions the customer had set. nginx workers run as `nginx` (not the
# customer) and serve /static/ straight from /home/$user/app/public/, so they
# only need to traverse directories. Normalise that and nothing else: open the
# home dir itself (adduser -m creates it 0700 when it does not exist yet), and
# add o+x to directories that lack it. Regular files are never touched.
# The find runs AS THE CUSTOMER: `-type d` without -L skips symlinks, and if a
# dir is swapped for a symlink before chmod runs, the customer can only reach
# what they already own.
chmod 755 /home/$user
as_user find /home/$user -type d ! -perm -o=x -exec chmod o+x {} + 2>/dev/null || true

# nginx opens its logs under /home/$user/logs as root: last fail-closed check
# immediately before it starts. logs/, logs/nginx, logs/nodejs must be real
# dirs and nothing under logs/ may be other than a regular file or directory.
for d in /home/$user/logs /home/$user/logs/nginx /home/$user/logs/nodejs; do
  [ -d "$d" ] && [ ! -L "$d" ] || die "$d is not a real directory"
done
bad=$(find /home/$user/logs -xdev ! -type f ! -type d -print -quit 2>&1)
[ -z "$bad" ] || die "unsafe entry under /home/$user/logs: $bad"

# Start nginx
nginx

if [[ $environment == 'DEV' ]]; then
  echo "Starting Dev Deployment"
  
  # Ensure microdnf is available for installing additional packages in DEV mode
  if ! command -v microdnf &> /dev/null; then
    echo "microdnf not found, installing with dnf..."
    dnf install -y microdnf && dnf clean all
  fi
  
  # Install Memcached for session storage in DEV mode with memory limit
  microdnf install -y memcached
  # Start memcached with 32MB memory limit
  nohup memcached -d -u $user -p 11211 -m 32
  
fi

# Start cron for log rotation and backups
/usr/sbin/crond

# Create app directory if it doesn't exist
if [ ! -d /home/$user/app ]; then
  echo "Creating app directory at /home/$user/app"
  as_user mkdir -p /home/$user/app
fi

# If app directory is empty, copy the simple-website example
if [ -z "$(ls -A /home/$user/app)" ]; then
  echo "App directory is empty, copying simple-website example..."
  as_user cp -r /examples/simple-website/. /home/$user/app/
  echo "Copied simple-website example to provide a working application"
fi

# Now there's always an app in the user directory (either user's or example)
cd /home/$user/app

# Verify user exists and show info
echo "Verifying user setup:"
id $user || { echo "ERROR: User $user does not exist!"; exit 1; }

# Install dependencies as the user
echo "Installing npm dependencies as user $user..."
su -c "npm install" $user

# Check if ecosystem.config.js exists, if not generate it
if [ ! -f /home/$user/app/ecosystem.config.js ]; then
  echo "No ecosystem.config.js found, generating from package.json..."
  # As the customer: it reads their package.json and writes into their app dir.
  drop_symlink /home/$user/app/ecosystem.config.js
  as_user /scripts/generate-ecosystem-config.sh "$user" "/home/$user/app"
fi

# Mirror logs to docker logs in the background.
# Use -F (capital) so logrotate-recreated files keep streaming.
tail -F /home/$user/logs/nginx/access.log \
        /home/$user/logs/nginx/error.log \
        /home/$user/logs/nodejs/app.log \
        /home/$user/logs/nodejs/out.log \
        /home/$user/logs/nodejs/error.log 2>/dev/null &

# Start PM2 under dumb-init so it becomes PID 1 (with proper signal forwarding
# and zombie reaping for nginx/crond/memcached children that reparent here).
# When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
# restart policy brings the container back.
# (dumb-init replaces tini, which is not packaged in EPEL 10.)
#
# --single-child is required for parity with tini. dumb-init defaults to
# setsid() plus forwarding signals to the whole process group, whereas tini
# without -g forwards only to its direct child. Without this flag a
# `docker stop` would signal the tenant's node process directly and at the
# same moment as pm2, bypassing pm2's kill_timeout shutdown sequencing.
echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
cd /home/$user/app
exec dumb-init --single-child -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"