Merge ~ubuntu-docker-images/ubuntu-docker-images/+git/postgresql:resync-20.04-with-21.04 into ~ubuntu-docker-images/ubuntu-docker-images/+git/postgresql:edge

[Bryce Harrington]

Resync with Dockerfile from the 21.04 branch

Note: Due to the glibc/runc issue we've not been able to successfully build/deploy
the 21.04 OCI image, so we lack positive confirmation on these changes.
So review carefully, but I think these changes should all be safe.

[Sergio Durigan Junior (sergiodj)]

Thanks.

I have carefully reviewed everything, and the changes seem fine. I also confirmed that the new Dockerfile builds and tests fine. I'm leaving two small comments to be addressed, but other than that this LGTM, so I'm approving it.

review: Approve

diff --git a/Dockerfile b/Dockerfile
index c576d7b..664227a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,56 +6,50 @@ ENV TZ UTC
 # explicitly set user/group IDs
 RUN set -eux; \
 	groupadd -r postgres --gid=999; \
+	groupadd -r ssl-cert --gid=998; \
 # https://salsa.debian.org/postgresql/postgresql-common/blob/997d842ee744687d99a2b2d95c1083a2615c79e8/debian/postgresql-common.postinst#L32-35
-	useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
+	useradd -r -g postgres -G ssl-cert --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
 # also create the postgres user's home directory with appropriate permissions
 # see https://github.com/docker-library/postgres/issues/274
 	mkdir -p /var/lib/postgresql; \
-	chown -R postgres:postgres /var/lib/postgresql
-
-RUN set -eux; \
-	apt-get update; \
-	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends gosu; \
-	rm -rf /var/lib/apt/lists/*; \
-	gosu nobody true
+	chown -R postgres:postgres /var/lib/postgresql;
 
 # make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default
 RUN set -eux; \
-	if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then \
-# if this file exists, we're likely in "debian:xxx-slim", and locales are thus being excluded so we need to remove that exclusion (since we need locales)
-		grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
-		sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; \
-		! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
-	fi; \
 	apt-get update; \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends locales tzdata; rm -rf /var/lib/apt/lists/*; \
-	localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
+	DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y; \
+	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+		locales \
+		tzdata \
+# Required by entrypoint script
+		gosu \
+		; \
+	localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8;
 ENV LANG en_US.utf8
 
 RUN mkdir /docker-entrypoint-initdb.d
 
 ENV PG_MAJOR 12
 
-RUN set -ex; \
-	\
-# see note below about "*.pyc" files
+RUN set -eux; \
+# installation
 	export PYTHONDONTWRITEBYTECODE=1; \
-    apt-get update; \
-	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends postgresql-common; \
+	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+		postgresql-common; \
 	sed -ri 's/#(create_main_cluster) .*$/\1 = false/' /etc/postgresql-common/createcluster.conf; \
 	DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
 		"postgresql-$PG_MAJOR" \
 		"postgresql-contrib-$PG_MAJOR" \
-	; \
-	\
+		; \
+	DEBIAN_FRONTEND=noninteractive apt-get remove --purge --auto-remove -y; \
 	rm -rf /var/lib/apt/lists/*; \
-	\
+# NOTE:
 # some of the steps above generate a lot of "*.pyc" files (and setting "PYTHONDONTWRITEBYTECODE" beforehand doesn't propagate properly for some reason), so we clean them up manually (as long as they aren't owned by a package)
 # XXX check
 	find /usr -name '*.pyc' -type f -exec bash -c 'for pyc; do dpkg -S "$pyc" &> /dev/null || rm -vf "$pyc"; done' -- '{}' +; \
 # create manifest
 	mkdir -p /usr/share/rocks; \
-	(echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && dpkg-query -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) > /usr/share/rocks/dpkg.query
+	(echo "# os-release" && cat /etc/os-release && echo "# dpkg-query" && dpkg-query -f '${db:Status-Abbrev},${binary:Package},${Version},${source:Package},${Source:Version}\n' -W) > /usr/share/rocks/dpkg.query;
 
 # make the sample config easier to munge (and "correct by default")
 # XXX check - divert? why?
@@ -64,15 +58,20 @@ RUN set -eux; \
 	cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; \
 	ln -sv ../postgresql.conf.sample "/usr/share/postgresql/$PG_MAJOR/"; \
 	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
-	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
+	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample;
 
-RUN mkdir -p /var/run/postgresql && chown -R postgres:postgres /var/run/postgresql && chmod 2777 /var/run/postgresql
+RUN set -eux; \
+	mkdir -p /var/run/postgresql; \
+	chown -R postgres:postgres /var/run/postgresql; \
+	chmod 2777 /var/run/postgresql;
 
 ENV PATH $PATH:/usr/lib/postgresql/$PG_MAJOR/bin
 ENV PGDATA /var/lib/postgresql/data
 # this 777 will be replaced by 700 at runtime (allows semi-arbitrary "--user" values)
 # XXX check
-RUN mkdir -p "$PGDATA" && chown -R postgres:postgres "$PGDATA" && chmod 777 "$PGDATA"
+RUN mkdir -p "$PGDATA"; \
+	chown -R postgres:postgres "$PGDATA"; \
+	chmod 777 "$PGDATA";
 VOLUME /var/lib/postgresql/data
 
 COPY docker-entrypoint.sh /usr/local/bin/