Skip to content

build(self-hosted): Run sentry image as non-root and drop gosu #125848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oioki merged 2 commits into from
Sep 29, 2026
Merged

build(self-hosted): Run sentry image as non-root and drop gosu #125848

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c4c91b
build(self-hosted): Run sentry image as non-root and drop gosu
oioki Sep 29, 2026
cccdd1c
build(self-hosted): Use named sentry user in USER instruction
oioki Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion self-hosted/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ RUN groupadd -r sentry --gid 999 && useradd -r -m -g sentry --uid 999 sentry
RUN : \
&& apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
gosu \
libexpat1 \
tini \
&& apt-get clean \
Expand Down Expand Up @@ -91,6 +90,12 @@ RUN : double-check some built files are available \
&& test -f /usr/src/sentry/src/sentry/static/sentry/dist/entrypoints/app.js \
&& sentry help

# Pre-create /data owned by sentry so fresh named volumes are initialized
# with the right ownership. This must happen before the VOLUME instruction.
RUN mkdir -p /data/files && chown -R sentry:sentry /data

USER sentry

EXPOSE 9000
VOLUME /data

Expand Down
8 changes: 0 additions & 8 deletions self-hosted/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,6 @@ fi

if [ "$1" = 'sentry' ]; then
set -- tini -- "$@"
if [ "$(id -u)" = '0' ]; then
mkdir -p /data/files
sentry_uid=$(id -u sentry)
if [ "$(stat -c %u /data)" != "$sentry_uid" ] || [ "$(stat -c %u /data/files)" != "$sentry_uid" ]; then
find /data ! -user sentry -exec chown sentry {} \;
fi
set -- gosu sentry "$@"
fi
fi

exec "$@"
Comment thread
oioki marked this conversation as resolved.
Loading