Run as non-root by default via PUID/PGID

entrypoint.sh

@@ -4,6 +4,52 @@ set -e
 CYAN="\033[1;36m"
 NC="\033[0m"
 
+log()  { echo "$(date '+%Y-%m-%d %H:%M:%S') $*"; }
+fail() { echo "$(date '+%Y-%m-%d %H:%M:%S') [!] $*" >&2; exit 1; }
+
+print_banner() {
+    version=$(cat VERSION 2>/dev/null || echo "unknown")
+    title="Socat Proxy - Version ${version}"
+    lines="Source: https://git.djeex.fr/Djeex/socat-proxy
+Mirror: https://github.com/Djeex/socat-proxy"
+
+    width=${#title}
+    old_ifs=$IFS
+    IFS='
+'
+    for l in $lines; do
+        [ ${#l} -gt "$width" ] && width=${#l}
+    done
+    IFS=$old_ifs
+    width=$((width + 2))
+
+    border=""
+    i=0
+    while [ "$i" -lt "$width" ]; do
+        border="${border}─"
+        i=$((i + 1))
+    done
+    printf "${CYAN}╭%s╮${NC}\n" "$border"
+
+    total_pad=$((width - ${#title}))
+    left=$((total_pad / 2))
+    right=$((total_pad - left))
+    printf "${CYAN}│${NC}%*s%s%*s${CYAN}│${NC}\n" "$left" "" "$title" "$right" ""
+
+    printf "${CYAN}├%s┤${NC}\n" "$border"
+
+    IFS='
+'
+    for l in $lines; do
+        printf "${CYAN}│${NC} %-*s${CYAN}│${NC}\n" "$((width - 1))" "$l"
+    done
+    IFS=$old_ifs
+
+    printf "${CYAN}╰%s╯${NC}\n" "$border"
+}
+
+print_banner
+
 DEBUG_LEVEL=${DEBUG_LEVEL:-1}
 UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH%/}
 HOST_SOCKET_PATH=${HOST_SOCKET_PATH%/}
@@ -11,107 +57,116 @@ HOST_SOCKET_PATH=${HOST_SOCKET_PATH%/}
 FULL_HOST_SOCKET_PATH="$HOST_SOCKET_PATH/$UNIX_SOCKET_NAME"
 FULL_UNIX_SOCKET_PATH="$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME"
 
-VERSION=$(cat VERSION)
-
-echo -e "${CYAN}╭────────────────────────────────────────────────╮${NC}"
-echo -e "${CYAN}│${NC}            Socat-proxy - Version ${VERSION}${NC}         ${CYAN}│${NC}"
-echo -e "${CYAN}├────────────────────────────────────────────────┤${NC}"
-echo -e "${CYAN}│${NC} Source: https://git.djeex.fr/Djeex/socat-proxy ${CYAN}│${NC}"
-echo -e "${CYAN}│${NC} Mirror: https://github.com/Djeex/socat-proxy   ${CYAN}│${NC}"
-echo -e "${CYAN}╰────────────────────────────────────────────────╯${NC}"
-
-
 # Validate required environment variables
-if [ -z "$TARGET_HOST" ]; then
-    echo "[✗] TARGET_HOST environment variable is required"
-    exit 1
-fi
+[ -n "$TARGET_HOST" ] || fail "TARGET_HOST environment variable is required"
+[ -n "$TARGET_PORT" ] || fail "TARGET_PORT environment variable is required"
+[ -n "$UNIX_SOCKET_NAME" ] || fail "UNIX_SOCKET_NAME environment variable is required"
+[ -n "$UNIX_SOCKET_PATH" ] || fail "UNIX_SOCKET_PATH environment variable is required"
+[ -n "$HOST_SOCKET_PATH" ] || fail "HOST_SOCKET_PATH environment variable is required"
 
-if [ -z "$TARGET_PORT" ]; then
-    echo "[✗] TARGET_PORT environment variable is required"
-    exit 1
-fi
+PUID=${PUID:-911}
+PGID=${PGID:-911}
 
-if [ -z "$UNIX_SOCKET_NAME" ]; then
-    echo "[✗] UNIX_SOCKET_NAME environment variable is required"
-    exit 1
-fi
+case "$PGID" in
+    ''|*[!0-9]*) fail "PGID '$PGID' is not a valid numeric group id." ;;
+esac
+case "$PUID" in
+    ''|*[!0-9]*) fail "PUID '$PUID' is not a valid numeric user id." ;;
+esac
 
-if [ -z "$UNIX_SOCKET_PATH" ]; then
-    echo "[✗] UNIX_SOCKET_PATH environment variable is required"
-    exit 1
-fi
+log "[i] Requested PUID=$PUID, PGID=$PGID"
 
-if [ -z "$HOST_SOCKET_PATH" ]; then
-    echo "[✗] HOST_SOCKET_PATH environment variable is required"
-    exit 1
+log "[~] Checking group for GID $PGID..."
+GROUP_NAME=$(getent group "$PGID" | cut -d: -f1 || true)
+if [ -z "$GROUP_NAME" ]; then
+    log "[→] No existing group with GID $PGID, creating 'appgroup'."
+    addgroup -g "$PGID" appgroup || fail "Failed to create group with GID $PGID (addgroup exited $?)."
+    GROUP_NAME=appgroup
+else
+    log "[i] Reusing existing group '$GROUP_NAME' (GID $PGID)."
 fi
+log "[✓] Group ready: $GROUP_NAME"
 
-echo "[~] Starting socat proxy..."
-echo "[i] TCP target: $TARGET_HOST:$TARGET_PORT"
-echo "[i] HOST path: $HOST_SOCKET_PATH"
-echo "[i] Full host socket path: $FULL_HOST_SOCKET_PATH"
-echo "[i] Full socket path: $FULL_UNIX_SOCKET_PATH"
+log "[~] Checking user for UID $PUID..."
+USER_NAME=$(getent passwd "$PUID" | cut -d: -f1 || true)
+if [ -z "$USER_NAME" ]; then
+    log "[→] No existing user with UID $PUID, creating 'appuser'."
+    adduser -D -u "$PUID" -G "$GROUP_NAME" appuser || fail "Failed to create user with UID $PUID (adduser exited $?)."
+    USER_NAME=appuser
+else
+    log "[i] Reusing existing user '$USER_NAME' (UID $PUID)."
+fi
+log "[✓] User ready: $USER_NAME"
+
+log "[~] Starting socat proxy..."
+log "[i] TCP target: $TARGET_HOST:$TARGET_PORT"
+log "[i] HOST path: $HOST_SOCKET_PATH"
+log "[i] Full host socket path: $FULL_HOST_SOCKET_PATH"
+log "[i] Full socket path: $FULL_UNIX_SOCKET_PATH"
 
 # Check if socket file/folder exists and handle it
 if [ -e "$FULL_UNIX_SOCKET_PATH" ]; then
-    echo "[~] Socket file/folder $FULL_UNIX_SOCKET_PATH exists, removing it..."
+    log "[~] Socket file/folder $FULL_UNIX_SOCKET_PATH exists, removing it..."
     if rm -rf "$FULL_UNIX_SOCKET_PATH"; then
-        echo "[✓] Removed existing socket $FULL_UNIX_SOCKET_PATH"
+        log "[✓] Removed existing socket $FULL_UNIX_SOCKET_PATH"
     else
-        echo "[✗] Failed to remove existing socket $FULL_UNIX_SOCKET_PATH"
-        exit 1
+        fail "Failed to remove existing socket $FULL_UNIX_SOCKET_PATH"
     fi
 fi
 
-echo "[~] Creating socket directory structure..."
+log "[~] Creating socket directory structure..."
 # Create directory if needed
 if mkdir -p "$UNIX_SOCKET_PATH"; then
-    echo "[✓] Created directory $UNIX_SOCKET_PATH"
+    log "[✓] Created directory $UNIX_SOCKET_PATH"
 else
-    echo "[✗] Failed to create directory $UNIX_SOCKET_PATH"
-    exit 1
+    fail "Failed to create directory $UNIX_SOCKET_PATH"
 fi
 
-echo "[~] Creating socket with netcat..."
+# Grant the target user write access to the socket directory so the
+# su-exec'd socat process below can create the socket file in it.
+log "[~] Setting ownership of $UNIX_SOCKET_PATH to $USER_NAME:$GROUP_NAME..."
+chown "$USER_NAME:$GROUP_NAME" "$UNIX_SOCKET_PATH" || fail "chown on $UNIX_SOCKET_PATH failed — check that the host directory permissions allow it."
+log "[✓] Ownership set on $UNIX_SOCKET_PATH"
+
+log "[~] Preparing socket path..."
 # Create socket file by touching it, then remove it (this creates the path but leaves it clean for socat)
 touch "$FULL_UNIX_SOCKET_PATH"
 rm "$FULL_UNIX_SOCKET_PATH"
-echo "[✓] Socket path prepared at $FULL_UNIX_SOCKET_PATH"
+log "[✓] Socket path prepared at $FULL_UNIX_SOCKET_PATH"
 
 # Debug: Check if socket file exists and its permissions
 if [ -S "$FULL_UNIX_SOCKET_PATH" ]; then
-    echo "[✓] Socket file exists and is a socket"
+    log "[✓] Socket file exists and is a socket"
     ls -la "$FULL_UNIX_SOCKET_PATH"
 else
-    echo "[!] Socket file does not exist or is not a socket"
+    log "[!] Socket file does not exist or is not a socket"
     ls -la "$UNIX_SOCKET_PATH"
 fi
 
-echo "[~] Testing connection to target..."
+log "[~] Testing connection to target..."
 # Test if we can reach the target before starting socat
 if ! nc -z "$TARGET_HOST" "$TARGET_PORT" 2>/dev/null; then
-    echo "[!] Cannot connect to $TARGET_HOST:$TARGET_PORT - socat will retry automatically"
+    log "[!] Cannot connect to $TARGET_HOST:$TARGET_PORT - socat will retry automatically"
 else
-    echo "[✓] Connection to $TARGET_HOST:$TARGET_PORT is working"
+    log "[✓] Connection to $TARGET_HOST:$TARGET_PORT is working"
 fi
 
 # Signal handler for graceful shutdown
 cleanup() {
-    echo "[!] Received SIGTERM, shutting down gracefully..."
-    if [ ! -z "$SOCAT_PID" ]; then
-        echo "[~] Stopping socat process (PID: $SOCAT_PID)..."
+    log "[!] Received SIGTERM, shutting down gracefully..."
+    if [ -n "$SOCAT_PID" ]; then
+        log "[~] Stopping socat process (PID: $SOCAT_PID)..."
         kill "$SOCAT_PID" 2>/dev/null || true
         wait "$SOCAT_PID" 2>/dev/null || true
     fi
-    echo "[~] Cleanup completed, exiting..."
+    log "[~] Cleanup completed, exiting..."
     exit 0
 }
 
 # Set up signal trap
 trap cleanup SIGTERM SIGINT
 
-echo "[~] Starting socat proxy..."
+log "[~] Starting socat proxy..."
 # Start socat with configurable verbosity
 DEBUG_FLAGS=""
 if [ "$DEBUG_LEVEL" -eq 1 ]; then
@@ -122,25 +177,29 @@ elif [ "$DEBUG_LEVEL" -eq 3 ]; then
     DEBUG_FLAGS="-d -d -d"
 fi
 
-echo "[i] Using debug level: $DEBUG_LEVEL ($DEBUG_FLAGS)"
+log "[i] Using debug level: $DEBUG_LEVEL ($DEBUG_FLAGS)"
 
-if socat $DEBUG_FLAGS UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early TCP:$TARGET_HOST:$TARGET_PORT & then
+# mode=666 keeps the socket connectable from another container's UID
+# regardless of PUID/PGID here — see project notes on the socket
+# permission trade-off (this proxy's own threat model is the host/network
+# boundary, not multi-tenant isolation between containers on the same host).
+log "[→] Dropping privileges to $USER_NAME:$GROUP_NAME and starting socat"
+if su-exec "$USER_NAME:$GROUP_NAME" socat $DEBUG_FLAGS UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early,mode=666 TCP:$TARGET_HOST:$TARGET_PORT & then
     SOCAT_PID=$!
-    echo "[✓] Socat started with PID: $SOCAT_PID"
-    echo "[i] Socat command: socat -d -d UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early TCP:$TARGET_HOST:$TARGET_PORT"
-    echo "[~] Container is ready and running..."
-    
+    log "[✓] Socat started with PID: $SOCAT_PID"
+    log "[i] Socat command: socat $DEBUG_FLAGS UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early,mode=666 TCP:$TARGET_HOST:$TARGET_PORT"
+    log "[~] Container is ready and running..."
+
     # Debug: Check socket after socat starts
     sleep 2
     if [ -S "$FULL_UNIX_SOCKET_PATH" ]; then
-        echo "[✓] Socat socket is active"
+        log "[✓] Socat socket is active"
         ls -la "$FULL_UNIX_SOCKET_PATH"
     else
-        echo "[!] Socat socket not found"
+        log "[!] Socat socket not found"
     fi
 else
-    echo "[✗] Failed to start socat proxy"
-    exit 1
+    fail "Failed to start socat proxy"
 fi
 
 # Keep the script alive and wait for socat process
@@ -148,5 +207,4 @@ while kill -0 "$SOCAT_PID" 2>/dev/null; do
     sleep 1
 done
 
-echo "[✗] Socat process has stopped"
-exit 1
+fail "Socat process has stopped"