jochen
29b4c02709
The image opens everything below each mount to every account on every start, so with the module root and lib at 0711 any account on the machine could read the document cache. The mounts now sit under a root-owned 0700 box the container never sees; the root stays 0711 for the converter. The old lib keeps its id so mesh-host closes it to 0700 (a new id there would be used as found, issue 339).
only-office
The only-office module of the mesh catalogue: runs the container image onlyoffice/documentserver.
Files it does not know
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
${dir:state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:box}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:logs}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:data}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:server-lib}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:lib}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:db}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:rabbitmq}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:redis}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:fonts}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
Where its directories live
Everything the container mounts sits in ${dir:box} (/var/lib/only-office/box), root-owned and 0700 (issue 1843).
The image opens what is below each mount to every account on every start (chmod -R 755), so the barrier is a
parent the container never sees. The module root stays root-owned 0711: the converter, which runs on the host
as only-office-converter, passes through it to its two secrets and nothing else.
${dir:lib} (/var/lib/only-office/lib) is the copy the container used before, no longer mounted, kept by the
mesh because it is not empty and closed to 0700. It keeps its id so mesh-host sets that mode: a new id at a path
the image owns would be used as found (issue 339). Its contents, and those of the old logs, data, db,
rabbitmq, redis and fonts beside it, are removed on the operator's word, and then lib leaves the manifest.