blob: 85fd796e0f95277c3ff8a96e82ef8f244ed677fd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
#Use basic debian for git server and git daemon
FROM debian:latest
RUN apt-get -y update && apt-get -y install openssh-server git
# Key generation on the server
RUN ssh-keygen -A
WORKDIR /git-server/
# -D flag avoids password generation
# -s flag changes user's shell
RUN mkdir /git-server/keys \
&& adduser --disabled-password --shell /usr/bin/git-shell git \
# Set password to '*' to unlock the account for SSH key auth.
# adduser --disabled-password sets '!' which OpenSSH 10.0 treats as locked,
# rejecting even valid pubkey logins. '*' means "no password login possible"
# but the account is not locked.
&& usermod -p '*' -d /repos git \
# git-shell must be in /etc/shells or OpenSSH rejects login
&& echo /usr/bin/git-shell >> /etc/shells \
&& mkdir /home/git/.ssh
# This is a login shell for SSH accounts to provide restricted Git access.
# It permits execution only of server-side Git commands implementing the
# pull/push functionality, plus custom commands present in a subdirectory
# named git-shell-commands in the user’s home directory.
# More info: https://git-scm.com/docs/git-shell
COPY git-shell-commands /home/git/git-shell-commands
# sshd_config file is edited for enable access key and disable access password
COPY sshd_config /etc/ssh/sshd_config
COPY start.sh start.sh
#COPY git.service /etc/systemd/git.service
EXPOSE 22
EXPOSE 9418
CMD ["sh", "start.sh"]
|
