diff options
| author | Jenkins <jenkins@review.openstack.org> | 2016-05-27 21:19:45 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2016-05-27 21:19:46 +0000 |
| commit | 162fa258297651bb4d6e7dcda241684ce6e40641 (patch) | |
| tree | e56f1cf6e7a3c7a19a4081503549f7b60c370f73 | |
| parent | cd4602819c954547c74e3dc6c2e13aae0e393460 (diff) | |
| parent | a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20 (diff) | |
| download | kolla-162fa258297651bb4d6e7dcda241684ce6e40641.tar.gz kolla-162fa258297651bb4d6e7dcda241684ce6e40641.zip | |
Merge "Run HAProxy in a chroot jail"
| -rw-r--r-- | ansible/roles/haproxy/templates/haproxy.cfg.j2 | 3 | ||||
| -rw-r--r-- | docker/haproxy/Dockerfile.j2 | 4 |
2 files changed, 7 insertions, 0 deletions
diff --git a/ansible/roles/haproxy/templates/haproxy.cfg.j2 b/ansible/roles/haproxy/templates/haproxy.cfg.j2 index 72c52cab7..a6507ed20 100644 --- a/ansible/roles/haproxy/templates/haproxy.cfg.j2 +++ b/ansible/roles/haproxy/templates/haproxy.cfg.j2 @@ -1,5 +1,8 @@ {% set tls_bind_info = 'ssl crt /etc/haproxy/haproxy.pem' if kolla_enable_tls_external | bool else '' %} global + chroot /var/lib/haproxy + user haproxy + group haproxy daemon log /var/lib/kolla/heka/log local0 maxconn 4000 diff --git a/docker/haproxy/Dockerfile.j2 b/docker/haproxy/Dockerfile.j2 index cade3b26c..922f52054 100644 --- a/docker/haproxy/Dockerfile.j2 +++ b/docker/haproxy/Dockerfile.j2 @@ -15,6 +15,10 @@ RUN apt-get -y install --no-install-recommends \ {% endif %} +RUN usermod -a -G kolla haproxy \ + && mkdir -p /var/lib/kolla/haproxy \ + && chown -R haproxy: /var/lib /run + COPY ensure_latest_config.sh /usr/local/bin/kolla_ensure_haproxy_latest_config RUN chmod 755 /usr/local/bin/kolla_ensure_haproxy_latest_config |