[ fix ] 사전 계정 정보 주입 후, entrypoint 실행 by dongmin0204 · Pull Request #27 · DGU-AILab/DECS

dongmin0204 · 2026-04-02T19:14:18Z

🌱 관련 이슈

close : [ fix ] 도커 이미지 내의 sudo 권한 관련 이슈 문제 해결 #26

🌱 작업 사항

컨테이너 시작 시 마운트된 계정 정보와 USER_ID, UID, GID가 일치하는지 검증하도록 수정.
Jupyter Lab이 root가 아닌 사용자 권한으로 실행되도록 변경
SSH 접속 사용자 허용 설정을 보강하고, 사용자 홈/Jupyter 설정 디렉토리 생성 로직을 정리

🌱 참고 사항

실행 시 USER_ID, TARGET_UID는 필수이며, 필요하면 USER_GROUP, TARGET_GID도 함께 맞춰서 넘겨야 합니다.
마운트된 /etc/passwd, /etc/group 정보와 전달한 UID/GID가 다르면 컨테이너가 즉시 종료됩니다. (db와 정합성이 잘 맞아야함)
Jupyter는 비-root 사용자 기준으로 실행되므로, 권한 문제를 줄이려면 마운트 디렉토리 소유자 정보가 실제 사용자와 일치해야 합니다.

Decs251023

[fix] #24 의도되지 않은 MOTD 출력 방지

Copilot

Pull request overview

컨테이너 시작 시 외부에서 마운트된 계정(/etc/passwd, /etc/group)과 전달된 UID/GID 정합성을 검증하고, Jupyter Lab을 비-root 사용자로 실행하도록 entrypoint 동작을 재구성하는 PR입니다(이슈 #26 흐름의 root/non-root 충돌 완화 목적).

Changes:

entrypoint.sh에서 USER/UID/GID 정합성 검증 로직 추가 및 Jupyter를 gosu로 비-root 실행하도록 변경
SSH AllowUsers 설정 보강 및 홈/Jupyter 설정 디렉토리 준비 로직 정리
Docker 이미지에 gosu 패키지 추가, README 이미지 태그 최신화

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
README.md	최신 이미지 태그를 `260403`로 갱신하고 변경사항 설명을 업데이트
entrypoint.sh	계정/권한 검증, SSH allowlist 보강, Jupyter 비-root 실행 및 관련 디렉토리 준비 로직으로 재작성
Dockerfile	entrypoint에서 사용하는 `gosu` 패키지 설치 추가

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-02T19:17:52Z

+apt-get update
+apt-get install -y auditd


apt-get update/apt-get install is being run at container startup. This makes startup slower and can fail in restricted/offline environments, and it also makes the runtime behavior depend on the state of apt repos at run time. Prefer installing auditd in the Dockerfile during image build (and remove these lines from the entrypoint).

Suggested change

apt-get update

apt-get install -y auditd

if ! command -v auditd >/dev/null 2>&1; then

echo "[ERROR] Required package 'auditd' is not installed in the image. Install it during image build instead of at container startup." >&2

exit 1

fi

Copilot · 2026-04-02T19:17:53Z

+# /etc/audit/audit.rules 파일에 줄 추가
+echo "-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid=$TARGET_UID -k rm_commands" >> /etc/audit/audit.rules

-# 사용자와 그룹이 모두 준비된 후, 소유권과 권한을 설정합니다.
-chown -R "$USER_ID:$USER_GROUP" "/home/$USER_ID"
-chmod 750 "/home/$USER_ID"
+# history 명령어 칠 때 명령어를 입력한 시간이 같이 나오게 하는 명령어
+echo 'HISTTIMEFORMAT="[%Y-%m-%d %H:%M:%S] "' >> /etc/profile
+echo 'export HISTTIMEFORMAT' >> /etc/profile


These echo >> writes are not idempotent: every container start will append another identical audit rule and another HISTTIMEFORMAT export to /etc/profile, causing unbounded duplication. Add a guard (e.g., grep -q for an existing line / key) before appending, or write the files in an overwrite/managed-block way.

Copilot · 2026-04-02T19:17:53Z

+    if ! getent passwd "$user_name" >/dev/null 2>&1; then
+        echo "[WARN] Skipping AllowUsers for missing account '$user_name'" >&2
+        return 0
+    fi
+    if ! grep -qxF "AllowUsers $user_name" /etc/ssh/sshd_config; then
+        printf '\nAllowUsers %s\n' "$user_name" >> /etc/ssh/sshd_config
+    fi


ensure_sshd_allow_user only checks for an exact line match (AllowUsers <user>). If sshd_config already has AllowUsers with multiple users/patterns on one line, this will append a duplicate directive and can lead to confusing/incorrect allowlists. Consider parsing/updating an existing AllowUsers line (or using a single consolidated directive) instead of only appending exact matches.

Suggested change

if ! getent passwd "$user_name" >/dev/null 2>&1; then

echo "[WARN] Skipping AllowUsers for missing account '$user_name'" >&2

return 0

fi

if ! grep -qxF "AllowUsers $user_name" /etc/ssh/sshd_config; then

printf '\nAllowUsers %s\n' "$user_name" >> /etc/ssh/sshd_config

fi

local sshd_config="/etc/ssh/sshd_config"

local tmp_config

if ! getent passwd "$user_name" >/dev/null 2>&1; then

echo "[WARN] Skipping AllowUsers for missing account '$user_name'" >&2

return 0

fi

if awk -v user="$user_name" '

/^[[:space:]]*#/ { next }

/^[[:space:]]*AllowUsers([[:space:]]|$)/ {

for (i = 2; i <= NF; i++) {

if ($i == user) {

found = 1

exit

}

}

}

END { exit(found ? 0 : 1) }

' "$sshd_config"; then

return 0

fi

if awk '

/^[[:space:]]*#/ { next }

/^[[:space:]]*AllowUsers([[:space:]]|$)/ { found = 1; exit }

END { exit(found ? 0 : 1) }

' "$sshd_config"; then

tmp_config="$(mktemp)"

awk -v user="$user_name" '

!updated && /^[[:space:]]*AllowUsers([[:space:]]|$)/ {

print $0 " " user

updated = 1

next

}

{ print }

' "$sshd_config" > "$tmp_config"

cat "$tmp_config" > "$sshd_config"

rm -f "$tmp_config"

else

printf '\nAllowUsers %s\n' "$user_name" >> "$sshd_config"

fi

Copilot · 2026-04-02T19:17:53Z

-echo "trying jupyter lab..."
-nohup /opt/anaconda3/bin/jupyter lab --NotebookApp.token=$TOKEN --config=/home/$USER_ID/.jupyter/jupyter_notebook_config.py >/dev/null 2>&1 &
-echo "jupyter lab listening!"
+sed -i "1i c.JupyterApp.config_file_name = 'jupyter_notebook_config.py'\nc.NotebookApp.allow_origin = '*'\nc.NotebookApp.ip = '0.0.0.0'\nc.NotebookApp.open_browser = False\nc.NotebookApp.allow_remote_access = True\nc.NotebookApp.allow_root = False\nc.NotebookApp.notebook_dir='$JUPYTER_DIR'" "$JUPYTER_CONFIG_FILE"


This sed -i "1i ..." prepends the same config block on every container start, even when the config file already exists, which will quickly corrupt the config with repeated duplicated settings. Make this update idempotent (e.g., check for a sentinel line before inserting, or manage the file via a template/overwrite approach).

Suggested change

sed -i "1i c.JupyterApp.config_file_name = 'jupyter_notebook_config.py'\nc.NotebookApp.allow_origin = '*'\nc.NotebookApp.ip = '0.0.0.0'\nc.NotebookApp.open_browser = False\nc.NotebookApp.allow_remote_access = True\nc.NotebookApp.allow_root = False\nc.NotebookApp.notebook_dir='$JUPYTER_DIR'" "$JUPYTER_CONFIG_FILE"

if ! grep -Fqx "c.JupyterApp.config_file_name = 'jupyter_notebook_config.py'" "$JUPYTER_CONFIG_FILE"; then

sed -i "1i c.JupyterApp.config_file_name = 'jupyter_notebook_config.py'\nc.NotebookApp.allow_origin = '*'\nc.NotebookApp.ip = '0.0.0.0'\nc.NotebookApp.open_browser = False\nc.NotebookApp.allow_remote_access = True\nc.NotebookApp.allow_root = False\nc.NotebookApp.notebook_dir='$JUPYTER_DIR'" "$JUPYTER_CONFIG_FILE"

else

echo "Jupyter config settings already present; skipping update."

fi

Copilot · 2026-04-02T19:17:53Z

 # ssh restart
 service ssh restart



The entrypoint restarts SSH but does not ensure host keys exist (e.g., via ssh-keygen -A) before restart. Given the prior failure mode (sshd: no hostkeys available -- exiting.), add a check/generation step before service ssh restart so SSH reliably comes up even if keys are missing.

Copilot · 2026-04-02T19:17:54Z

+ensure_account_matches_mounts



ensure_account_matches_mounts is invoked after apt-get update/install and other system mutations. To fail fast (and avoid doing network/package work when UID/GID mismatch will immediately exit), run the account/UID/GID validation as early as possible before any installs/file modifications.

aapdo and others added 10 commits January 28, 2026 00:07

Update README.md

111a3a2

Merge pull request #23 from DGU-AILab/decs251023

e6218c7

Decs251023

[fix] #24 의도되지 않은 MOTD 출력 방지

57552dd

Merge pull request #25 from DGU-AILab/decs260201

66eb231

[fix] #24 의도되지 않은 MOTD 출력 방지

Update README.md

61ec4e5

feat: gosu 추가

c96b127

feat: Jupyter와 컨테이너 유지 프로세스를 비-root로 실행 구현

296d5b7

fix: config-server주입으로 sudo 권한 축소

e2e8442

fix: 계정 보호 정책 강화

443aaae

feat: 260403추가

2a45f60

dongmin0204 linked an issue Apr 2, 2026 that may be closed by this pull request

[ fix ] 도커 이미지 내의 sudo 권한 관련 이슈 문제 해결 #26

Closed

5 tasks

dongmin0204 requested a review from Copilot April 2, 2026 19:14

dongmin0204 self-assigned this Apr 2, 2026

dongmin0204 added the feature label Apr 2, 2026

Copilot started reviewing on behalf of dongmin0204 April 2, 2026 19:14 View session

dongmin0204 changed the base branch from main to develop April 2, 2026 19:14

dongmin0204 merged commit 50d4a30 into develop Apr 2, 2026
5 checks passed

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ fix ] 사전 계정 정보 주입 후, entrypoint 실행#27

[ fix ] 사전 계정 정보 주입 후, entrypoint 실행#27
dongmin0204 merged 10 commits into
developfrom
decs260403

dongmin0204 commented Apr 2, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

-    if ! getent passwd "$user_name" >/dev/null 2>&1; then
-        echo "[WARN] Skipping AllowUsers for missing account '$user_name'" >&2
-        return 0
-    fi
-    if ! grep -qxF "AllowUsers $user_name" /etc/ssh/sshd_config; then
-        printf '\nAllowUsers %s\n' "$user_name" >> /etc/ssh/sshd_config
-    fi
+    local sshd_config="/etc/ssh/sshd_config"
+    local tmp_config
+    if ! getent passwd "$user_name" >/dev/null 2>&1; then
+        echo "[WARN] Skipping AllowUsers for missing account '$user_name'" >&2
+        return 0
+    fi
+    if awk -v user="$user_name" '
+        /^[[:space:]]*#/ { next }
+        /^[[:space:]]*AllowUsers([[:space:]]|$)/ {
+            for (i = 2; i <= NF; i++) {
+                if ($i == user) {
+                    found = 1
+                    exit
+                }
+            }
+        }
+        END { exit(found ? 0 : 1) }
+    ' "$sshd_config"; then
+        return 0
+    fi
+    if awk '
+        /^[[:space:]]*#/ { next }
+        /^[[:space:]]*AllowUsers([[:space:]]|$)/ { found = 1; exit }
+        END { exit(found ? 0 : 1) }
+    ' "$sshd_config"; then
+        tmp_config="$(mktemp)"
+        awk -v user="$user_name" '
+            !updated && /^[[:space:]]*AllowUsers([[:space:]]|$)/ {
+                print $0 " " user
+                updated = 1
+                next
+            }
+            { print }
+        ' "$sshd_config" > "$tmp_config"
+        cat "$tmp_config" > "$sshd_config"
+        rm -f "$tmp_config"
+    else
+        printf '\nAllowUsers %s\n' "$user_name" >> "$sshd_config"
+    fi

		ensure_account_matches_mounts

Conversation

dongmin0204 commented Apr 2, 2026

🌱 관련 이슈

🌱 작업 사항

🌱 참고 사항

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants