Merge pull request hashicorp#37 from hashicorp/pr-24-slackpad

Allows for binding privileged ports as consul user.

Author: slackpad

0.6/Dockerfile

@@ -14,7 +14,7 @@ RUN addgroup consul && \
     adduser -S -G consul consul
 
 # Set up certificates, our base tools, and Consul.
-RUN apk add --no-cache ca-certificates curl gnupg openssl && \
+RUN apk add --no-cache ca-certificates curl gnupg libcap openssl && \
     gpg --recv-keys 91A6E7F85D05C65630BEF18951852D87348FFC4C && \
     mkdir -p /tmp/build && \
     cd /tmp/build && \

0.6/docker-entrypoint.sh

@@ -78,10 +78,17 @@ if [ "$1" = 'consul' ]; then
     # If the data or config dirs are bind mounted then chown them.
     # Note: This checks for root ownership as that's the most common case.
     if [ "$(stat -c %u /consul/data)" = '0' ]; then
-      chown consul:consul /consul/data
+        chown consul:consul /consul/data
     fi
     if [ "$(stat -c %u /consul/config)" = '0' ]; then
-      chown consul:consul /consul/config
+        chown consul:consul /consul/config
+    fi
+
+    # If requested, set the capability to bind to privileged ports before
+    # we drop to the non-root user. Note that this doesn't work with all
+    # storage drivers (it won't work with AUFS).
+    if [ ! -z ${CONSUL_ALLOW_PRIVILEGED_PORTS+x} ]; then
+        setcap "cap_net_bind_service=+ep" /bin/consul
     fi
 
     set -- gosu consul "$@"