Skip to content

Add SHELL instruction to avoid JSONArgsRecommended warning#489

Merged
rbs-jacob merged 2 commits into
redballoonsecurity:masterfrom
Ivanov1ch:JSON-Args-Fix
Aug 16, 2024
Merged

Add SHELL instruction to avoid JSONArgsRecommended warning#489
rbs-jacob merged 2 commits into
redballoonsecurity:masterfrom
Ivanov1ch:JSON-Args-Fix

Conversation

@Ivanov1ch
Copy link
Copy Markdown
Contributor

One sentence summary of this PR (This should go in the CHANGELOG!)
Added SHELL instruction to image building script to ensure consistent OS signal behavior
Link to Related Issue(s)
N/A
Please describe the changes in your request.
As build_image.py stands now, building images with ENTRYPOINTs including &, &&, etc leads to the following warning in the build log for finish.Dockerfile:
WARN: JSONArgsRecommended: JSON arguments recommended for ENTRYPOINT to prevent unintended behavior related to OS signals

Eg, when running make tutorial-image:

...
 > importing cache manifest from redballoonsecurity/ofrak/tutorial-base:master:
------
[+] Building 0.5s (17/17) FINISHED                                                                                                                                                                  docker:default
 => [internal] load build definition from finish.Dockerfile                                                                                                                                                   0.0s
 => => transferring dockerfile: 1.88kB                                                                                                                                                                        0.0s
 => WARN: JSONArgsRecommended: JSON arguments recommended for ENTRYPOINT to prevent unintended behavior related to OS signals (line 46)                                                                       0.0s
...

Or when building ofrak-ghidra.yml (as it currently stands in master):

...
 > importing cache manifest from redballoonsecurity/ofrak/ghidra-base:master:
------
[+] Building 0.5s (15/15) FINISHED                                                                                                                                                                  docker:default
 => [internal] load build definition from finish.Dockerfile                                                                                                                                                   0.0s
 => => transferring dockerfile: 1.46kB                                                                                                                                                                        0.0s
 => WARN: JSONArgsRecommended: JSON arguments recommended for ENTRYPOINT to prevent unintended behavior related to OS signals (line 38)                                                                       0.0s
...

As per the docs for this warning, one way to fix it is to pass the ENTRYPOINT arguments in exec form, but this wouldn't work for our ofrak-ghidra, for example, because exec form would not allow &. The simpler way of fixing this warning be to explicitly define the shell to be /bin/bash, which this PR does by adding SHELL ["/bin/bash", "-c"] before the ENTRYPOINT.
Anyone you think should look at this, specifically?
N/A

@whyitfor whyitfor requested a review from jstrieb August 12, 2024 21:18
@alchzh
Copy link
Copy Markdown
Contributor

alchzh commented Aug 13, 2024

Bit of an XY problem here. Why is ENTRYPOINT being used at all here? None of the "entrypoints" in the yaml configs behave like ENTRYPOINTs should, they're more like CMDs.

@jstrieb jstrieb requested review from rbs-jacob and removed request for jstrieb August 13, 2024 14:51
@Ivanov1ch
Copy link
Copy Markdown
Contributor Author

Bit of an XY problem here. Why is ENTRYPOINT being used at all here? None of the "entrypoints" in the yaml configs behave like ENTRYPOINTs should, they're more like CMDs.

I feel that ENTRYPOINT remains more appropriate than CMD because we are often treating these containers as standalone executables, with maybe some extra args passed to enable CORS or import from some module. The docker blog agrees with using ENTRYPOINT for such a purpose.

@rbs-jacob rbs-jacob merged commit 6770041 into redballoonsecurity:master Aug 16, 2024
ANogin pushed a commit to ANogin/ofrak that referenced this pull request Aug 20, 2024
Add SHELL instruction to build_image.py to avoid JSONArgsRecommended warning
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants