Dynamically change UID and GID of PHP-FPM process

5.2/php/Dockerfile

@@ -11,11 +11,23 @@ WORKDIR /var/www
 ENV COMPOSER_ALLOW_SUPERUSER 1
 ENV COMPOSER_HOME /tmp
 
+# Update the user/group in "php-fpm.conf" and "entrypoint-php.sh"
+# if PHP_FPM_USER or PHP_FPM_GROUP is changed
+ARG PHP_FPM_USER wp_php
+ARG	PHP_FPM_GROUP wp_php
+ENV	PHP_FPM_UID 1000
+ENV	PHP_FPM_GID 1000
+
 
 
 COPY entrypoint.sh /entrypoint.sh
+COPY docker-entrypoint.d /docker-entrypoint.d
+COPY php-fpm.conf /usr/local/etc/php-fpm.d/zz-wordpress.conf
 
-RUN chmod +x /entrypoint.sh
+RUN chmod +x /entrypoint.sh && \
+    chmod +x /docker-entrypoint.d/*.sh && \
+    groupadd -g ${PHP_FPM_GID} -r ${PHP_FPM_GROUP} && \
+    useradd -M -u ${PHP_FPM_UID} -s /bin/bash -g ${PHP_FPM_GROUP} ${PHP_FPM_USER}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
 

5.2/php/entrypoint.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 set -e
 
+source /docker-entrypoint.d/100-uid-gid.sh
+
 # If LOCAL_PHP_XDEBUG=true xdebug extension will be enabled
 if [ "$LOCAL_PHP_XDEBUG" = true ]; then
 	docker-php-ext-enable xdebug
@@ -17,5 +19,10 @@ else
 	rm -f /usr/local/etc/php/conf.d/docker-php-ext-memcached.ini
 fi
 
+
+### Change UID/GID
+set_gid "${PHP_FPM_GID}" "wp_php"
+set_uid "${PHP_FPM_UID}" "wp_php" "wp_php"
+
 # Execute CMD
 exec "$@"

5.2/php/php-fpm.conf

@@ -0,0 +1,3 @@
+[www]
+user  = wp_php
+group = wp_php

5.3/php/Dockerfile

@@ -11,6 +11,13 @@ WORKDIR /var/www
 ENV COMPOSER_ALLOW_SUPERUSER 1
 ENV COMPOSER_HOME /tmp
 
+# Update the user/group in "php-fpm.conf" and "entrypoint-php.sh"
+# if PHP_FPM_USER or PHP_FPM_GROUP is changed
+ARG PHP_FPM_USER wp_php
+ARG	PHP_FPM_GROUP wp_php
+ENV	PHP_FPM_UID 1000
+ENV	PHP_FPM_GID 1000
+
 # install the PHP extensions we need
 RUN set -ex; \
 	\
@@ -34,8 +41,13 @@ RUN set -ex; \
 	rm -f /tmp/installer.php /tmp/installer.sig;
 
 COPY entrypoint.sh /entrypoint.sh
+COPY docker-entrypoint.d /docker-entrypoint.d
+COPY php-fpm.conf /usr/local/etc/php-fpm.d/zz-wordpress.conf
 
-RUN chmod +x /entrypoint.sh
+RUN chmod +x /entrypoint.sh && \
+    chmod +x /docker-entrypoint.d/*.sh && \
+    groupadd -g ${PHP_FPM_GID} -r ${PHP_FPM_GROUP} && \
+    useradd -M -u ${PHP_FPM_UID} -s /bin/bash -g ${PHP_FPM_GROUP} ${PHP_FPM_USER}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
 

5.3/php/docker-entrypoint.d/100-uid-gid.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -e
+
+
+############################################################
+# Functions
+############################################################
+
+###
+### Log to stdout/stderr
+###
+log() {
+    local type="${1}"     # ok, warn or err
+    local message="${2}"  # msg to print
+
+    local clr_ok="\033[0;32m"
+    local clr_info="\033[0;34m"
+    local clr_warn="\033[0;33m"
+    local clr_err="\033[0;31m"
+    local clr_rst="\033[0m"
+
+    if [ "${type}" = "warn" ]; then
+        printf "${clr_warn}[WARN] %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    elif [ "${type}" = "err" ]; then
+        printf "${clr_err}[ERR]  %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    else
+        printf "${clr_err}[???]  %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    fi
+}
+
+###
+### Is argument a positive integer?
+###
+isint() {
+	test -n "${1##*[!0-9]*}"
+}
+
+###
+### Helper
+###
+_get_username_by_uid() {
+    if getent="$( getent passwd "${1}" )"; then
+        echo "${getent//:*}"
+        return 0
+    fi
+    return 1
+}
+_get_groupname_by_gid() {
+    if getent="$( getent group "${1}" )"; then
+        echo "${getent//:*}"
+        return 0
+    fi
+    return 1
+}
+
+
+###
+### Change UID
+###
+set_uid() {
+    local uid="${1}"
+    local username="${2}"
+    local groupname="${3}"
+
+    # spare UID to change another user to
+    local spare_uid=9876
+
+    if ! isint "${uid}"; then
+        log "err" "${uid} is not a valid UID"
+        exit 1
+    else
+        # Username with this UID already exists
+        if target_username="$( _get_username_by_uid "${uid}" )"; then
+            # It is not our user, so we need to change their UID to something else first
+            if [ "${target_username}" != "${username}" ]; then
+                log "warn" "User with ${uid} already exists: ${target_username}"
+                usermod -u "${spare_uid}" "${target_username}"
+            fi
+        # UID not found, let's create a new user
+        else
+            useradd -M -u "${uid}" -s /bin/bash -g "${groupname}" "${username}"
+            return 0
+        fi
+        usermod -u "${uid}" "${username}"
+    fi
+}
+
+
+###
+### Change GID
+###
+set_gid() {
+    local gid="${1}"
+    local groupname="${2}"
+
+    # spare GID to change another group to
+    local spare_gid=9876
+
+    if ! isint "${gid}"; then
+        log "err" "${gid} is not a valid GID"
+        exit 1
+    else
+        # Groupname with this GID already exists
+        if target_groupname="$( _get_groupname_by_gid "${gid}" )"; then
+            # It is not our group, so we need to change their GID to something else first
+            if [ "${target_groupname}" != "${groupname}" ]; then
+                log "warn" "Group with ${gid} already exists: ${target_groupname}"
+                groupmod -g "${spare_gid}" "${target_groupname}"
+            fi
+        # GID not found, let's create a new group
+        else
+            groupadd -g "${gid}" -r "${groupname}"
+            return 0
+        fi
+        groupmod -g "${gid}" "${groupname}"
+    fi
+}

5.3/php/entrypoint.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 set -e
 
+source /docker-entrypoint.d/100-uid-gid.sh
+
 # If LOCAL_PHP_XDEBUG=true xdebug extension will be enabled
 if [ "$LOCAL_PHP_XDEBUG" = true ]; then
 	docker-php-ext-enable xdebug
@@ -17,5 +19,10 @@ else
 	rm -f /usr/local/etc/php/conf.d/docker-php-ext-memcached.ini
 fi
 
+
+### Change UID/GID
+set_gid "${PHP_FPM_GID}" "wp_php"
+set_uid "${PHP_FPM_UID}" "wp_php" "wp_php"
+
 # Execute CMD
 exec "$@"

5.3/php/php-fpm.conf

@@ -0,0 +1,3 @@
+[www]
+user  = wp_php
+group = wp_php

5.4/php/Dockerfile

@@ -11,6 +11,13 @@ WORKDIR /var/www
 ENV COMPOSER_ALLOW_SUPERUSER 1
 ENV COMPOSER_HOME /tmp
 
+# Update the user/group in "php-fpm.conf" and "entrypoint-php.sh"
+# if PHP_FPM_USER or PHP_FPM_GROUP is changed
+ARG PHP_FPM_USER wp_php
+ARG	PHP_FPM_GROUP wp_php
+ENV	PHP_FPM_UID 1000
+ENV	PHP_FPM_GID 1000
+
 # install the PHP extensions we need
 RUN set -ex; \
 	\
@@ -45,8 +52,13 @@ RUN set -ex; \
 	rm -f /tmp/installer.php /tmp/installer.sig;
 
 COPY entrypoint.sh /entrypoint.sh
+COPY docker-entrypoint.d /docker-entrypoint.d
+COPY php-fpm.conf /usr/local/etc/php-fpm.d/zz-wordpress.conf
 
-RUN chmod +x /entrypoint.sh
+RUN chmod +x /entrypoint.sh && \
+    chmod +x /docker-entrypoint.d/*.sh && \
+    groupadd -g ${PHP_FPM_GID} -r ${PHP_FPM_GROUP} && \
+    useradd -M -u ${PHP_FPM_UID} -s /bin/bash -g ${PHP_FPM_GROUP} ${PHP_FPM_USER}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
 

5.4/php/docker-entrypoint.d/100-uid-gid.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -e
+
+
+############################################################
+# Functions
+############################################################
+
+###
+### Log to stdout/stderr
+###
+log() {
+    local type="${1}"     # ok, warn or err
+    local message="${2}"  # msg to print
+
+    local clr_ok="\033[0;32m"
+    local clr_info="\033[0;34m"
+    local clr_warn="\033[0;33m"
+    local clr_err="\033[0;31m"
+    local clr_rst="\033[0m"
+
+    if [ "${type}" = "warn" ]; then
+        printf "${clr_warn}[WARN] %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    elif [ "${type}" = "err" ]; then
+        printf "${clr_err}[ERR]  %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    else
+        printf "${clr_err}[???]  %s${clr_rst}\n" "${message}" 1>&2	# stdout -> stderr
+    fi
+}
+
+###
+### Is argument a positive integer?
+###
+isint() {
+	test -n "${1##*[!0-9]*}"
+}
+
+###
+### Helper
+###
+_get_username_by_uid() {
+    if getent="$( getent passwd "${1}" )"; then
+        echo "${getent//:*}"
+        return 0
+    fi
+    return 1
+}
+_get_groupname_by_gid() {
+    if getent="$( getent group "${1}" )"; then
+        echo "${getent//:*}"
+        return 0
+    fi
+    return 1
+}
+
+
+###
+### Change UID
+###
+set_uid() {
+    local uid="${1}"
+    local username="${2}"
+    local groupname="${3}"
+
+    # spare UID to change another user to
+    local spare_uid=9876
+
+    if ! isint "${uid}"; then
+        log "err" "${uid} is not a valid UID"
+        exit 1
+    else
+        # Username with this UID already exists
+        if target_username="$( _get_username_by_uid "${uid}" )"; then
+            # It is not our user, so we need to change their UID to something else first
+            if [ "${target_username}" != "${username}" ]; then
+                log "warn" "User with ${uid} already exists: ${target_username}"
+                usermod -u "${spare_uid}" "${target_username}"
+            fi
+        # UID not found, let's create a new user
+        else
+            useradd -M -u "${uid}" -s /bin/bash -g "${groupname}" "${username}"
+            return 0
+        fi
+        usermod -u "${uid}" "${username}"
+    fi
+}
+
+
+###
+### Change GID
+###
+set_gid() {
+    local gid="${1}"
+    local groupname="${2}"
+
+    # spare GID to change another group to
+    local spare_gid=9876
+
+    if ! isint "${gid}"; then
+        log "err" "${gid} is not a valid GID"
+        exit 1
+    else
+        # Groupname with this GID already exists
+        if target_groupname="$( _get_groupname_by_gid "${gid}" )"; then
+            # It is not our group, so we need to change their GID to something else first
+            if [ "${target_groupname}" != "${groupname}" ]; then
+                log "warn" "Group with ${gid} already exists: ${target_groupname}"
+                groupmod -g "${spare_gid}" "${target_groupname}"
+            fi
+        # GID not found, let's create a new group
+        else
+            groupadd -g "${gid}" -r "${groupname}"
+            return 0
+        fi
+        groupmod -g "${gid}" "${groupname}"
+    fi
+}

5.4/php/entrypoint.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 set -e
 
+source /docker-entrypoint.d/100-uid-gid.sh
+
 # If LOCAL_PHP_XDEBUG=true xdebug extension will be enabled
 if [ "$LOCAL_PHP_XDEBUG" = true ]; then
 	docker-php-ext-enable xdebug
@@ -17,5 +19,10 @@ else
 	rm -f /usr/local/etc/php/conf.d/docker-php-ext-memcached.ini
 fi
 
+
+### Change UID/GID
+set_gid "${PHP_FPM_GID}" "wp_php"
+set_uid "${PHP_FPM_UID}" "wp_php" "wp_php"
+
 # Execute CMD
 exec "$@"

5.4/php/php-fpm.conf

@@ -0,0 +1,3 @@
+[www]
+user  = wp_php
+group = wp_php