From ec89c36ca0b04b2e82006402801f82d55c2cf2ea Mon Sep 17 00:00:00 2001
From: Mart124 <37041094+Mart124@users.noreply.github.com>
Date: Tue, 29 May 2018 23:18:48 +0200
Subject: [PATCH 1/2] Use user primary group if not root (#292)

* Use user primary group if not root

* Do not run getent on MacOS

* Simplify UID/GID management

* Create uid.env if it does not exist

* Populate uid.env if it's empty
---
 scripts/install.sh                   | 26 ++++-------
 scripts/run.sh                       | 67 +++++++++-------------------
 src/Admin/entrypoint.sh              | 57 +++++++----------------
 src/Api/entrypoint.sh                | 60 ++++++++-----------------
 src/Icons/entrypoint.sh              | 58 +++++++-----------------
 src/Identity/entrypoint.sh           | 57 +++++++----------------
 util/Attachments/entrypoint.sh       | 57 +++++++----------------
 util/MsSql/entrypoint.sh             | 60 ++++++++-----------------
 util/Nginx/entrypoint.sh             | 57 +++++++----------------
 util/Setup/EnvironmentFileBuilder.cs |  5 ++-
 util/Setup/entrypoint.sh             | 55 +++++++----------------
 11 files changed, 165 insertions(+), 394 deletions(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index f69fa54539..507e8330d5 100644
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -4,10 +4,11 @@ set -e
 CYAN='\033[0;36m'
 NC='\033[0m' # No Color
 
-OUTPUT_DIR="../."
+OUTPUT_DIR=".."
 if [ $# -gt 0 ]
 then
     OUTPUT_DIR=$1
+    mkdir -p $OUTPUT_DIR
 fi
 
 COREVERSION="latest"
@@ -22,16 +23,13 @@ then
     WEBVERSION=$3
 fi
 
-OS="lin"
-if [ "$(uname)" == "Darwin" ]
-then
-    OS="mac"
-fi
+ENV_DIR="$OUTPUT_DIR/env"
 
+# Save the installation UID/GID, they could also be manually changed later on if desired
 LUID="LOCAL_UID=`id -u $USER`"
-LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
-
-mkdir -p $OUTPUT_DIR
+LGID="LOCAL_GID=`id -g $USER`"
+mkdir -p $ENV_DIR
+(echo $LUID; echo $LGID) > $ENV_DIR/uid.env
 
 LETS_ENCRYPT="n"
 echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
@@ -64,14 +62,8 @@ then
 fi
 
 docker pull bitwarden/setup:$COREVERSION
-if [ $OS == "lin" ]
-then
-    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
-else
-    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
-fi
+docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+    dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
 
 echo ""
 echo "Setup complete"
diff --git a/scripts/run.sh b/scripts/run.sh
index 1dc2e3dad2..a393e03a2b 100644
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -5,7 +5,7 @@ set -e
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
-OUTPUT_DIR="../."
+OUTPUT_DIR=".."
 if [ $# -gt 1 ]
 then
     OUTPUT_DIR=$2
@@ -23,16 +23,17 @@ then
     WEBVERSION=$4
 fi
 
-OS="lin"
-if [ "$(uname)" == "Darwin" ]
-then
-    OS="mac"
-fi
-
-DOCKER_DIR="$OUTPUT_DIR/docker"
 ENV_DIR="$OUTPUT_DIR/env"
-LUID="LOCAL_UID=`id -u $USER`"
-LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
+DOCKER_DIR="$OUTPUT_DIR/docker"
+
+# As in install.sh, save the running UID/GID, they could not exist yet, during an update for example
+if ! grep -q "^LOCAL_UID=" $ENV_DIR/uid.env 2>/dev/null || ! grep -q "^LOCAL_GID=" $ENV_DIR/uid.env 2>/dev/null
+then
+    LUID="LOCAL_UID=`id -u $USER`"
+    LGID="LOCAL_GID=`id -g $USER`"
+    mkdir -p $ENV_DIR
+    (echo $LUID; echo $LGID) > $ENV_DIR/uid.env
+fi
 
 # Functions
 
@@ -79,58 +80,30 @@ function updateLetsEncrypt() {
 
 function updateDatabase() {
     pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup --network container:bitwarden-mssql \
-            -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup --network container:bitwarden-mssql \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup --network container:bitwarden-mssql \
+        -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
     echo "Database update complete"
 }
 
 function update() {
     pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
 }
 
 function printEnvironment() {
     pullSetup
-    if [ $OS == "lin" ]
-    then
-        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    else
-        docker run -i --rm --name setup \
-            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
-            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
-    fi
+    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
 }
 
 function restart() {
     dockerComposeDown
     dockerComposePull
     updateLetsEncrypt
-    
-    if [ $OS == "lin" ]
-    then
-        mkdir -p $ENV_DIR
-        (echo $LUID; echo $LGID) > $ENV_DIR/uid.env
-    fi
-    
     dockerComposeUp
     dockerPrune
     printEnvironment
diff --git a/src/Admin/entrypoint.sh b/src/Admin/entrypoint.sh
index 6de40e49bb..e45b8bdeb8 100644
--- a/src/Admin/entrypoint.sh
+++ b/src/Admin/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -63,4 +38,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
diff --git a/src/Api/entrypoint.sh b/src/Api/entrypoint.sh
index 44a6d26eb3..9292a3b74b 100644
--- a/src/Api/entrypoint.sh
+++ b/src/Api/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -63,10 +38,11 @@ mkdir -p /etc/bitwarden/logs
 mkdir -p /etc/bitwarden/ca-certificates
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 
-env >> /etc/environment
+# Sounds like gosu keeps env when switching, but of course cron does not
+env > /etc/environment
 cron
 
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
diff --git a/src/Icons/entrypoint.sh b/src/Icons/entrypoint.sh
index f1a4fa0ba0..5879381587 100644
--- a/src/Icons/entrypoint.sh
+++ b/src/Icons/entrypoint.sh
@@ -5,54 +5,30 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
 chown -R $USERNAME:$GROUPNAME /app
-gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
+
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
diff --git a/src/Identity/entrypoint.sh b/src/Identity/entrypoint.sh
index 2deac55178..bca8c0379c 100644
--- a/src/Identity/entrypoint.sh
+++ b/src/Identity/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -66,4 +41,4 @@ chown -R $USERNAME:$GROUPNAME /app
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
+exec gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
diff --git a/util/Attachments/entrypoint.sh b/util/Attachments/entrypoint.sh
index 6e6347c4ec..3b50472930 100644
--- a/util/Attachments/entrypoint.sh
+++ b/util/Attachments/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -58,5 +33,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server
 mkdir -p /etc/bitwarden/core/attachments
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 
-gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
+exec gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
     /contentRoot=/etc/bitwarden/core/attachments /webRoot=. /serveUnknown=true
diff --git a/util/MsSql/entrypoint.sh b/util/MsSql/entrypoint.sh
index c54e8637ba..fe17210417 100644
--- a/util/MsSql/entrypoint.sh
+++ b/util/MsSql/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -63,7 +38,8 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql
 chown $USERNAME:$GROUPNAME /backup-db.sh
 chown $USERNAME:$GROUPNAME /backup-db.sql
 
-env >> /etc/environment
+# Sounds like gosu keeps env when switching, but of course cron does not
+env > /etc/environment
 cron
 
-gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
+exec gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
diff --git a/util/Nginx/entrypoint.sh b/util/Nginx/entrypoint.sh
index b79973b7cf..af491a7e5e 100644
--- a/util/Nginx/entrypoint.sh
+++ b/util/Nginx/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 
@@ -65,4 +40,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid
 chown -R $USERNAME:$GROUPNAME /var/cache/nginx
 chown -R $USERNAME:$GROUPNAME /var/log/nginx
 
-gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
+exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
diff --git a/util/Setup/EnvironmentFileBuilder.cs b/util/Setup/EnvironmentFileBuilder.cs
index 1c15c13426..ea8aa9e095 100644
--- a/util/Setup/EnvironmentFileBuilder.cs
+++ b/util/Setup/EnvironmentFileBuilder.cs
@@ -172,7 +172,10 @@ SA_PASSWORD=SECRET
             Helpers.Exec("chmod 600 /bitwarden/env/mssql.override.env");
 
             // Empty uid env file. Only used on Linux hosts.
-            using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
+            if(!File.Exists("/bitwarden/env/uid.env"))
+            {
+                using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
+            }
         }
     }
 }
diff --git a/util/Setup/entrypoint.sh b/util/Setup/entrypoint.sh
index 5e3f205865..70944c3ffa 100644
--- a/util/Setup/entrypoint.sh
+++ b/util/Setup/entrypoint.sh
@@ -5,52 +5,27 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
-LGID=${LOCAL_GID:-999}
+LUID=${LOCAL_UID:-0}
+LGID=${LOCAL_GID:-0}
 
-NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
-LUID=${LOCAL_UID:-999}
+# Step down from host root to well-known nobody/nogroup user
 
-# Step down from host root
-
-if [ $LGID == 0 ]
+if [ $LUID -eq 0 ]
 then
-    LGID=999
+    LUID=65534
+fi
+if [ $LGID -eq 0 ]
+then
+    LGID=65534
 fi
 
-if [ $LUID == 0 ]
-then
-    LUID=999
-fi
+# Create user and group
 
-# Create group
-
-if [ $CURRENTGID ]
-then
-    if [ "$CURRENTGID" != "$LGID" ]
-    then
-        groupmod -g $LGID $GROUPNAME
-    fi
-else
-    groupadd -g $LGID $GROUPNAME
-fi
-
-# Create user and assign group
-
-if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
-then
-    usermod -u $LUID $USERNAME
-elif [ $NOUSER == 1 ]
-then
-    useradd -r -u $LUID -g $GROUPNAME $USERNAME
-fi
-
-# Make home directory for user
-
-if [ ! -d "/home/$USERNAME" ]
-then
-    mkhomedir_helper $USERNAME
-fi
+groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
+groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
+useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
+usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
+mkhomedir_helper $USERNAME
 
 # The rest...
 

From 0f675d8ccb30bfaac79670f9840a5dc527c11658 Mon Sep 17 00:00:00 2001
From: Kyle Spearrin <kyle.spearrin@gmail.com>
Date: Tue, 29 May 2018 19:17:48 -0400
Subject: [PATCH 2/2] Revert "Use user primary group if not root (#292)"

This reverts commit ec89c36ca0b04b2e82006402801f82d55c2cf2ea.
---
 scripts/install.sh                   | 26 +++++++----
 scripts/run.sh                       | 65 ++++++++++++++++++++--------
 src/Admin/entrypoint.sh              | 57 +++++++++++++++++-------
 src/Api/entrypoint.sh                | 60 +++++++++++++++++--------
 src/Icons/entrypoint.sh              | 58 +++++++++++++++++--------
 src/Identity/entrypoint.sh           | 57 +++++++++++++++++-------
 util/Attachments/entrypoint.sh       | 57 +++++++++++++++++-------
 util/MsSql/entrypoint.sh             | 60 +++++++++++++++++--------
 util/Nginx/entrypoint.sh             | 57 +++++++++++++++++-------
 util/Setup/EnvironmentFileBuilder.cs |  5 +--
 util/Setup/entrypoint.sh             | 55 ++++++++++++++++-------
 11 files changed, 393 insertions(+), 164 deletions(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index 507e8330d5..f69fa54539 100644
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -4,11 +4,10 @@ set -e
 CYAN='\033[0;36m'
 NC='\033[0m' # No Color
 
-OUTPUT_DIR=".."
+OUTPUT_DIR="../."
 if [ $# -gt 0 ]
 then
     OUTPUT_DIR=$1
-    mkdir -p $OUTPUT_DIR
 fi
 
 COREVERSION="latest"
@@ -23,13 +22,16 @@ then
     WEBVERSION=$3
 fi
 
-ENV_DIR="$OUTPUT_DIR/env"
+OS="lin"
+if [ "$(uname)" == "Darwin" ]
+then
+    OS="mac"
+fi
 
-# Save the installation UID/GID, they could also be manually changed later on if desired
 LUID="LOCAL_UID=`id -u $USER`"
-LGID="LOCAL_GID=`id -g $USER`"
-mkdir -p $ENV_DIR
-(echo $LUID; echo $LGID) > $ENV_DIR/uid.env
+LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
+
+mkdir -p $OUTPUT_DIR
 
 LETS_ENCRYPT="n"
 echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
@@ -62,8 +64,14 @@ then
 fi
 
 docker pull bitwarden/setup:$COREVERSION
-docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
-    dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
+if [ $OS == "lin" ]
+then
+    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
+else
+    docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
+        dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
+fi
 
 echo ""
 echo "Setup complete"
diff --git a/scripts/run.sh b/scripts/run.sh
index a393e03a2b..1dc2e3dad2 100644
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -5,7 +5,7 @@ set -e
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
-OUTPUT_DIR=".."
+OUTPUT_DIR="../."
 if [ $# -gt 1 ]
 then
     OUTPUT_DIR=$2
@@ -23,18 +23,17 @@ then
     WEBVERSION=$4
 fi
 
-ENV_DIR="$OUTPUT_DIR/env"
-DOCKER_DIR="$OUTPUT_DIR/docker"
-
-# As in install.sh, save the running UID/GID, they could not exist yet, during an update for example
-if ! grep -q "^LOCAL_UID=" $ENV_DIR/uid.env 2>/dev/null || ! grep -q "^LOCAL_GID=" $ENV_DIR/uid.env 2>/dev/null
+OS="lin"
+if [ "$(uname)" == "Darwin" ]
 then
-    LUID="LOCAL_UID=`id -u $USER`"
-    LGID="LOCAL_GID=`id -g $USER`"
-    mkdir -p $ENV_DIR
-    (echo $LUID; echo $LGID) > $ENV_DIR/uid.env
+    OS="mac"
 fi
 
+DOCKER_DIR="$OUTPUT_DIR/docker"
+ENV_DIR="$OUTPUT_DIR/env"
+LUID="LOCAL_UID=`id -u $USER`"
+LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
+
 # Functions
 
 function dockerComposeUp() {
@@ -80,30 +79,58 @@ function updateLetsEncrypt() {
 
 function updateDatabase() {
     pullSetup
-    docker run -i --rm --name setup --network container:bitwarden-mssql \
-        -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    if [ $OS == "lin" ]
+    then
+        docker run -i --rm --name setup --network container:bitwarden-mssql \
+            -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    else
+        docker run -i --rm --name setup --network container:bitwarden-mssql \
+            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    fi
     echo "Database update complete"
 }
 
 function update() {
     pullSetup
-    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    if [ $OS == "lin" ]
+    then
+        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    else
+        docker run -i --rm --name setup \
+            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    fi
 }
 
 function printEnvironment() {
     pullSetup
-    docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-        --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
-        dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    if [ $OS == "lin" ]
+    then
+        docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
+            -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    else
+        docker run -i --rm --name setup \
+            -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
+            dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
+    fi
 }
 
 function restart() {
     dockerComposeDown
     dockerComposePull
     updateLetsEncrypt
+    
+    if [ $OS == "lin" ]
+    then
+        mkdir -p $ENV_DIR
+        (echo $LUID; echo $LGID) > $ENV_DIR/uid.env
+    fi
+    
     dockerComposeUp
     dockerPrune
     printEnvironment
diff --git a/src/Admin/entrypoint.sh b/src/Admin/entrypoint.sh
index e45b8bdeb8..6de40e49bb 100644
--- a/src/Admin/entrypoint.sh
+++ b/src/Admin/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -38,4 +63,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-exec gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
+gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
diff --git a/src/Api/entrypoint.sh b/src/Api/entrypoint.sh
index 9292a3b74b..44a6d26eb3 100644
--- a/src/Api/entrypoint.sh
+++ b/src/Api/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -38,11 +63,10 @@ mkdir -p /etc/bitwarden/logs
 mkdir -p /etc/bitwarden/ca-certificates
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 
-# Sounds like gosu keeps env when switching, but of course cron does not
-env > /etc/environment
+env >> /etc/environment
 cron
 
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-exec gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
+gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
diff --git a/src/Icons/entrypoint.sh b/src/Icons/entrypoint.sh
index 5879381587..f1a4fa0ba0 100644
--- a/src/Icons/entrypoint.sh
+++ b/src/Icons/entrypoint.sh
@@ -5,30 +5,54 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
 chown -R $USERNAME:$GROUPNAME /app
-
-exec gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
+gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
diff --git a/src/Identity/entrypoint.sh b/src/Identity/entrypoint.sh
index bca8c0379c..2deac55178 100644
--- a/src/Identity/entrypoint.sh
+++ b/src/Identity/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -41,4 +66,4 @@ chown -R $USERNAME:$GROUPNAME /app
 cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
     && update-ca-certificates
 
-exec gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
+gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
diff --git a/util/Attachments/entrypoint.sh b/util/Attachments/entrypoint.sh
index 3b50472930..6e6347c4ec 100644
--- a/util/Attachments/entrypoint.sh
+++ b/util/Attachments/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -33,5 +58,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server
 mkdir -p /etc/bitwarden/core/attachments
 chown -R $USERNAME:$GROUPNAME /etc/bitwarden
 
-exec gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
+gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
     /contentRoot=/etc/bitwarden/core/attachments /webRoot=. /serveUnknown=true
diff --git a/util/MsSql/entrypoint.sh b/util/MsSql/entrypoint.sh
index fe17210417..c54e8637ba 100644
--- a/util/MsSql/entrypoint.sh
+++ b/util/MsSql/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -38,8 +63,7 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql
 chown $USERNAME:$GROUPNAME /backup-db.sh
 chown $USERNAME:$GROUPNAME /backup-db.sql
 
-# Sounds like gosu keeps env when switching, but of course cron does not
-env > /etc/environment
+env >> /etc/environment
 cron
 
-exec gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
+gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
diff --git a/util/Nginx/entrypoint.sh b/util/Nginx/entrypoint.sh
index af491a7e5e..b79973b7cf 100644
--- a/util/Nginx/entrypoint.sh
+++ b/util/Nginx/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...
 
@@ -40,4 +65,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid
 chown -R $USERNAME:$GROUPNAME /var/cache/nginx
 chown -R $USERNAME:$GROUPNAME /var/log/nginx
 
-exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
+gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
diff --git a/util/Setup/EnvironmentFileBuilder.cs b/util/Setup/EnvironmentFileBuilder.cs
index ea8aa9e095..1c15c13426 100644
--- a/util/Setup/EnvironmentFileBuilder.cs
+++ b/util/Setup/EnvironmentFileBuilder.cs
@@ -172,10 +172,7 @@ SA_PASSWORD=SECRET
             Helpers.Exec("chmod 600 /bitwarden/env/mssql.override.env");
 
             // Empty uid env file. Only used on Linux hosts.
-            if(!File.Exists("/bitwarden/env/uid.env"))
-            {
-                using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
-            }
+            using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
         }
     }
 }
diff --git a/util/Setup/entrypoint.sh b/util/Setup/entrypoint.sh
index 70944c3ffa..5e3f205865 100644
--- a/util/Setup/entrypoint.sh
+++ b/util/Setup/entrypoint.sh
@@ -5,27 +5,52 @@
 GROUPNAME="bitwarden"
 USERNAME="bitwarden"
 
-LUID=${LOCAL_UID:-0}
-LGID=${LOCAL_GID:-0}
+CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
+LGID=${LOCAL_GID:-999}
 
-# Step down from host root to well-known nobody/nogroup user
+NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
+LUID=${LOCAL_UID:-999}
 
-if [ $LUID -eq 0 ]
+# Step down from host root
+
+if [ $LGID == 0 ]
 then
-    LUID=65534
-fi
-if [ $LGID -eq 0 ]
-then
-    LGID=65534
+    LGID=999
 fi
 
-# Create user and group
+if [ $LUID == 0 ]
+then
+    LUID=999
+fi
 
-groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
-groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
-useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
-usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
-mkhomedir_helper $USERNAME
+# Create group
+
+if [ $CURRENTGID ]
+then
+    if [ "$CURRENTGID" != "$LGID" ]
+    then
+        groupmod -g $LGID $GROUPNAME
+    fi
+else
+    groupadd -g $LGID $GROUPNAME
+fi
+
+# Create user and assign group
+
+if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
+then
+    usermod -u $LUID $USERNAME
+elif [ $NOUSER == 1 ]
+then
+    useradd -r -u $LUID -g $GROUPNAME $USERNAME
+fi
+
+# Make home directory for user
+
+if [ ! -d "/home/$USERNAME" ]
+then
+    mkhomedir_helper $USERNAME
+fi
 
 # The rest...