Rework service user (#299)

* Use user primary group if not root * Do not run getent on MacOS * Simplify UID/GID management * Make uid.env backward compatible in run.sh * Merge install.sh with run.sh to avoid duplicating code Especially the UID/GID management one * Generate correct OS name * Be sure to keep old behavior for backward compatiblilty * Get the colors back from install.sh
2025-04-04 20:50:21 -05:00 · 2018-05-31 18:05:26 +02:00 · 2018-05-31 18:05:26 +02:00 · 92b08e6cf1
commit 92b08e6cf1
parent 961c0c6749
12 changed files with 222 additions and 464 deletions
--- a/scripts/bitwarden.sh
+++ b/scripts/bitwarden.sh
@ -47,15 +47,6 @@ function downloadSelf() {
    chmod u+x $SCRIPT_PATH
 }

-function downloadInstall() {
-    if [ ! -d "$SCRIPTS_DIR" ]
-    then
-        mkdir $SCRIPTS_DIR
-    fi
-    curl -s -o $SCRIPTS_DIR/install.sh $GITHUB_BASE_URL/scripts/install.sh
-    chmod u+x $SCRIPTS_DIR/install.sh
-}
-
 function downloadRunFile() {
    if [ ! -d "$SCRIPTS_DIR" ]
    then
@ -63,6 +54,7 @@ function downloadRunFile() {
    fi
    curl -s -o $SCRIPTS_DIR/run.sh $GITHUB_BASE_URL/scripts/run.sh
    chmod u+x $SCRIPTS_DIR/run.sh
+    rm -f $SCRIPTS_DIR/install.sh
 }

 function checkOutputDirExists() {
@ -87,9 +79,8 @@ if [ "$1" == "install" ]
 then
    checkOutputDirNotExists
    mkdir $OUTPUT
-    downloadInstall
    downloadRunFile
-    $SCRIPTS_DIR/install.sh $OUTPUT $COREVERSION $WEBVERSION
+    $SCRIPTS_DIR/run.sh install $OUTPUT $COREVERSION $WEBVERSION
 elif [ "$1" == "start" -o "$1" == "restart" ]
 then
    checkOutputDirExists
--- a/scripts/install.sh
+++ b/scripts/install.sh
@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-OUTPUT_DIR="../."
-if [ $# -gt 0 ]
-then
-    OUTPUT_DIR=$1
-fi
-
-COREVERSION="latest"
-if [ $# -gt 1 ]
-then
-    COREVERSION=$2
-fi
-
-WEBVERSION="latest"
-if [ $# -gt 2 ]
-then
-    WEBVERSION=$3
-fi
-
-OS="lin"
-if [ "$(uname)" == "Darwin" ]
-then
-    OS="mac"
-fi
-
-LUID="LOCAL_UID=`id -u $USER`"
-LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
-
-mkdir -p $OUTPUT_DIR
-
-LETS_ENCRYPT="n"
-echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
-read DOMAIN
-echo ""
-
-if [ "$DOMAIN" == "" ]
-then
-    DOMAIN="localhost"
-fi
-
-if [ "$DOMAIN" != "localhost" ]
-then
-    echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
-    read LETS_ENCRYPT
-    echo ""
-
-    if [ "$LETS_ENCRYPT" == "y" ]
-    then
-        echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
-        read EMAIL
-        echo ""
-
-        mkdir -p $OUTPUT_DIR/letsencrypt
-        docker pull certbot/certbot
-        docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
-            certonly --standalone --noninteractive  --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
-            --logs-dir /etc/letsencrypt/logs
-    fi
-fi
-
-docker pull bitwarden/setup:$COREVERSION
-if [ $OS == "lin" ]
-then
-    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
-else
-    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
-fi
-
-echo ""
-echo "Setup complete"
-echo ""
--- a/scripts/run.sh
+++ b/scripts/run.sh
@ -3,9 +3,12 @@ set -e

 # Setup

+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

-OUTPUT_DIR="../."
+OUTPUT_DIR=".."
 if [ $# -gt 1 ]
 then
    OUTPUT_DIR=$2
@ -24,18 +27,79 @@ then
 fi

 OS="lin"
-if [ "$(uname)" == "Darwin" ]
+[ "$(uname)" == "Darwin" ] && OS="mac"
+ENV_DIR="$OUTPUT_DIR/env"
+DOCKER_DIR="$OUTPUT_DIR/docker"
+
+# Initialize UID/GID which will be used to run services identically over all the OS...
+if ! grep -q "^LOCAL_UID=" $ENV_DIR/uid.env 2>/dev/null || ! grep -q "^LOCAL_GID=" $ENV_DIR/uid.env 2>/dev/null
 then
-    OS="mac"
+    LUID="LOCAL_UID=`id -u $USER`"
+    [ "$LUID" == "LOCAL_UID=0" ] && LUID="LOCAL_UID=65534"
+    LGID="LOCAL_GID=`id -g $USER`"
+    [ "$LGID" == "LOCAL_GID=0" ] && LGID="LOCAL_GID=65534"
+    mkdir -p $ENV_DIR
+    echo $LUID >$ENV_DIR/uid.env
+    echo $LGID >>$ENV_DIR/uid.env
 fi

-DOCKER_DIR="$OUTPUT_DIR/docker"
-ENV_DIR="$OUTPUT_DIR/env"
-LUID="LOCAL_UID=`id -u $USER`"
-LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
+# ... but up to Core version 1.19.0, keep the old behavior for backward compatibility
+if [[ "$COREVERSION" == *.*.* ]] &&
+   echo -e "1.19.0\n$COREVERSION" | sort -t '.' -k 1,1 -k 2,2 -k 3,3 -n | awk 'END {if($0!="1.19.0") {exit 1}}'
+then
+    LUID="LOCAL_UID=`id -u $USER`"
+    LGID="LOCAL_GID=`awk -F: '$1=="docker" {print $3}' /etc/group`"
+    if [ "$OS" == "mac" ]
+    then
+        LUID="LOCAL_UID=999"
+        LGID="LOCAL_GID=999"
+    fi
+    echo $LUID >$ENV_DIR/uid.env
+    echo $LGID >>$ENV_DIR/uid.env
+fi

 # Functions

+function install() {
+    LETS_ENCRYPT="n"
+    echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
+    read DOMAIN
+    echo ""
+    
+    if [ "$DOMAIN" == "" ]
+    then
+        DOMAIN="localhost"
+    fi
+    
+    if [ "$DOMAIN" != "localhost" ]
+    then
+        echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
+        read LETS_ENCRYPT
+        echo ""
+    
+        if [ "$LETS_ENCRYPT" == "y" ]
+        then
+            echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
+            read EMAIL
+            echo ""
+    
+            mkdir -p $OUTPUT_DIR/letsencrypt
+            docker pull certbot/certbot
+            docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
+                certonly --standalone --noninteractive  --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
+                --logs-dir /etc/letsencrypt/logs
+        fi
+    fi
+    
+    pullSetup
+    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
+    
+    echo ""
+    echo "Setup complete"
+    echo ""
+}
+
 function dockerComposeUp() {
    if [ -f "${DOCKER_DIR}/docker-compose.override.yml" ]
    then
@ -79,58 +143,30 @@ function updateLetsEncrypt() {

 function updateDatabase() {
    pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup --network container:bitwarden-mssql \
-            -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup --network container:bitwarden-mssql \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup --network container:bitwarden-mssql \
+        -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
    echo "Database update complete"
 }

 function update() {
    pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
 }

 function printEnvironment() {
    pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
 }

 function restart() {
    dockerComposeDown
    dockerComposePull
    updateLetsEncrypt
-    
-    if [ $OS == "lin" ]
-    then
-        mkdir -p $ENV_DIR
-        (echo $LUID; echo $LGID) > $ENV_DIR/uid.env
-    fi
-    
    dockerComposeUp
    dockerPrune
    printEnvironment
@ -142,7 +178,10 @@ function pullSetup() {

 # Commands

-if [ "$1" == "start" -o "$1" == "restart" ]
+if [ "$1" == "install" ]
+then
+    install
+elif [ "$1" == "start" -o "$1" == "restart" ]
 then
    restart
 elif [ "$1" == "pull" ]
--- a/src/Admin/entrypoint.sh
+++ b/src/Admin/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -63,4 +38,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
    && update-ca-certificates

-gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
--- a/src/Api/entrypoint.sh
+++ b/src/Api/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -63,10 +38,11 @@ mkdir -p /etc/bitwarden/logs
 mkdir -p /etc/bitwarden/ca-certificates
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden

-env >> /etc/environment
+# Sounds like gosu keeps env when switching, but of course cron does not
+env > /etc/environment
 cron

 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
    && update-ca-certificates

-gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
--- a/src/Icons/entrypoint.sh
+++ b/src/Icons/entrypoint.sh
@ -5,54 +5,30 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

 chown -R $USERNAME:$GROUPNAME /app
-gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
+
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
--- a/src/Identity/entrypoint.sh
+++ b/src/Identity/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -66,4 +41,4 @@ chown -R $USERNAME:$GROUPNAME /app
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
    && update-ca-certificates

-gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
--- a/util/Attachments/entrypoint.sh
+++ b/util/Attachments/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -58,5 +33,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server
 mkdir -p /etc/bitwarden/core/attachments
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden

-gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
+exec gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
    /contentRoot=/etc/bitwarden/core/attachments /webRoot=. /serveUnknown=true
--- a/util/MsSql/entrypoint.sh
+++ b/util/MsSql/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -63,7 +38,8 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql
 chown $USERNAME:$GROUPNAME /backup-db.sh
 chown $USERNAME:$GROUPNAME /backup-db.sql

-env >> /etc/environment
+# Sounds like gosu keeps env when switching, but of course cron does not
+env > /etc/environment
 cron

-gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
+exec gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
--- a/util/Nginx/entrypoint.sh
+++ b/util/Nginx/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...

@ -65,4 +40,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid
 chown -R $USERNAME:$GROUPNAME /var/cache/nginx
 chown -R $USERNAME:$GROUPNAME /var/log/nginx

-gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
+exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
--- a/util/Setup/EnvironmentFileBuilder.cs
+++ b/util/Setup/EnvironmentFileBuilder.cs
@ -172,7 +172,10 @@ SA_PASSWORD=SECRET
            Helpers.Exec("chmod 600 /bitwarden/env/mssql.override.env");

            // Empty uid env file. Only used on Linux hosts.
-            using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
+            if(!File.Exists("/bitwarden/env/uid.env"))
+            {
+                using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
+            }
        }
    }
 }
--- a/util/Setup/entrypoint.sh
+++ b/util/Setup/entrypoint.sh
@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"

-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}

-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user

-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi

-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group

-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME

 # The rest...