feat: Rootless containers

base-java/Dockerfile

@@ -2,12 +2,20 @@ ARG JITSI_REPO=jitsi
 ARG BASE_TAG=latest
 FROM ${JITSI_REPO}/base:${BASE_TAG}
 
-RUN mkdir -p /usr/share/man/man1 && \
-    mkdir -p /etc/apt/keyrings/ && \
-    apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y unzip ca-certificates curl gnupg && \
-    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
-    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \
-    apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y nodejs openjdk-17-jre-headless openjdk-17-jdk-headless && \
-    apt-cleanup
+USER root
+
+COPY rootfs /
+
+RUN \
+  wget -qO - https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | \
+    gpg --dearmour > /usr/share/keyrings/nodesource.gpg && \
+\
+  apt-dpkg-wrap apt-get update && \
+  apt-dpkg-wrap apt-get install -y \
+    nodejs \
+    openjdk-17-jdk-headless \
+    openjdk-17-jre-headless \
+    && \
+  apt-cleanup
+
+USER s6

base-java/rootfs/etc/apt/sources.list.d/nodejs.sources

@@ -0,0 +1,5 @@
+Types: deb
+URIs: https://deb.nodesource.com/node_20.x
+Suites: nodistro
+Components: main
+Signed-By: /usr/share/keyrings/nodesource.gpg

base/Dockerfile

@@ -1,40 +1,73 @@
 FROM docker.io/library/debian:bookworm-slim
 
 ARG JITSI_RELEASE=stable
+ARG S6_OVERLAY_VERSION=v3.2.0.2
+ARG S6_OVERLAY_DOWNLOAD=https://github.com/just-containers/s6-overlay/releases/download/${S6_OVERLAY_VERSION}
+ARG TPL_VERSION=v1.4.0
+ARG TPL_DOWNLOAD=https://github.com/jitsi/tpl/releases/download/${TPL_VERSION}
+
 ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 COPY rootfs /
 
 RUN \
-    dpkgArch="$(dpkg --print-architecture)" && \
-    case "${dpkgArch##*-}" in \
-        "amd64") TPL_ARCH=amd64; S6_ARCH=amd64 ;; \
-        "arm64") TPL_ARCH=arm64; S6_ARCH=aarch64 ;; \
-        *) echo "unsupported architecture"; exit 1 ;; \
-    esac && \
-    apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget curl && \
-    wget -qO /usr/bin/tpl https://github.com/jitsi/tpl/releases/download/v1.4.0/tpl-linux-${TPL_ARCH} && \
-    # Workaround S6 bug when /bin is a symlink
-    wget -qO /tmp/s6.tar.gz https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-${S6_ARCH}.tar.gz && \
-    mkdir /tmp/s6 && \
-    tar xfz /tmp/s6.tar.gz -C /tmp/s6 && \
-    tar hxfz /tmp/s6.tar.gz -C / && \
-    rm -f /usr/bin/execlineb && \
-    cp /tmp/s6/bin/execlineb /usr/bin/ && \
-    rm -rf /tmp/s6* && \
-    wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmour > /etc/apt/trusted.gpg.d/jitsi.gpg && \
-    echo "deb https://download.jitsi.org $JITSI_RELEASE/" > /etc/apt/sources.list.d/jitsi.list && \
-    echo "deb http://ftp.debian.org/debian bookworm-backports main" > /etc/apt/sources.list.d/backports.list && \
-    apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get dist-upgrade -y && \
-    apt-cleanup && \
-    chmod +x /usr/bin/tpl
+  dpkgArch="$(dpkg --print-architecture)" && \
+  case "${dpkgArch##*-}" in \
+    "amd64") TPL_ARCH=amd64; S6_ARCH=x86_64 ;; \
+    "arm64") TPL_ARCH=arm64; S6_ARCH=aarch64 ;; \
+    *) echo "unsupported architecture"; exit 1 ;; \
+  esac && \
+\
+  apt-dpkg-wrap apt-get update && \
+  apt-dpkg-wrap apt-get install -y \
+    apt-utils \
+    ca-certificates \
+    curl \
+    gnupg \
+    wget \
+    && \
+  apt-dpkg-wrap apt-get install -y \
+    xz-utils \
+    && \
+\
+  wget -qO /usr/bin/tpl ${TPL_DOWNLOAD}/tpl-linux-${TPL_ARCH} && \
+  chmod +x /usr/bin/tpl && \
+  mkdir /tmp/s6 && \
+  wget -qO /tmp/s6/s6-overlay-noarch.tar.xz \
+    ${S6_OVERLAY_DOWNLOAD}/s6-overlay-noarch.tar.xz && \
+  wget -qO /tmp/s6/s6-overlay-${S6_ARCH}.tar.xz \
+    ${S6_OVERLAY_DOWNLOAD}/s6-overlay-${S6_ARCH}.tar.xz && \
+  tar -C / -Jxpf /tmp/s6/s6-overlay-noarch.tar.xz && \
+  tar -C / -Jxpf /tmp/s6/s6-overlay-${S6_ARCH}.tar.xz && \
+  rm -rf /tmp/s6 && \
+\
+  wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | \
+    gpg --dearmour > /usr/share/keyrings/jitsi.gpg && \
+  sed -i "s/stable/${JITSI_RELEASE}/" /etc/apt/sources.list.d/jitsi.sources && \
+\
+  apt-dpkg-wrap apt-get update && \
+  apt-dpkg-wrap apt-get dist-upgrade -y && \
+  apt-get purge -y \
+    xz-utils \
+    && \
+  apt-cleanup && \
+\
+  adduser --disabled-password --gecos "" s6
 
-RUN [ "$JITSI_RELEASE" = "unstable" ] && \
+RUN \
+  [ "${JITSI_RELEASE}" = "unstable" ] && \
     apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y jq procps curl vim iputils-ping net-tools && \
-    apt-cleanup || \
+    apt-dpkg-wrap apt-get install -y \
+      jq \
+      iputils-ping \
+      net-tools \
+      procps \
+      vim \
+      && \
+    apt-cleanup \
+  || \
     true
 
+USER s6
+
 ENTRYPOINT [ "/init" ]

base/rootfs/etc/apt/sources.list.d/backports.sources

@@ -0,0 +1,5 @@
+Types: deb
+URIs: https://deb.debian.org/debian
+Suites: bookworm-backports
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

base/rootfs/etc/apt/sources.list.d/jitsi.sources

@@ -0,0 +1,5 @@
+Types: deb
+URIs: https://download.jitsi.org
+Suites: stable/
+Components:
+Signed-By: /usr/share/keyrings/jitsi.gpg

base/rootfs/usr/bin/apt-cleanup

@@ -1,3 +1,6 @@
 #!/bin/sh
 
+apt-get autopurge -y
+apt-get clean
+
 rm -rf /var/lib/apt/lists/

docker-compose.yml

@@ -10,9 +10,9 @@ services:
             - '${HTTPS_PORT}:443'
         volumes:
             - ${CONFIG}/web:/config:Z
-            - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
-            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
-            - ${CONFIG}/web/load-test:/usr/share/jitsi-meet/load-test:Z
+            - ${CONFIG}/storage/transcripts:/usr/share/jitsi-meet/transcripts:ro,z
+            - ${CONFIG}/tmp/web-crontabs:/var/spool/cron/crontabs:Z
+            - ${CONFIG}/tmp/web-load-test:/usr/share/jitsi-meet/load-test:Z
         labels:
             service: "jitsi-web"
         environment:
@@ -203,6 +203,7 @@ services:
         volumes:
             - ${CONFIG}/prosody/config:/config:Z
             - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
+            - ${CONFIG}/storage/prosody:/var/lib/prosody:Z
         environment:
             - AUTH_TYPE
             - DISABLE_POLLS
@@ -383,6 +384,7 @@ services:
             - JICOFO_CONF_STRIP_SIMULCAST
             - JICOFO_CONF_SSRC_REWRITING
             - JICOFO_ENABLE_HEALTH_CHECKS
+            - JICOFO_ENABLE_ICE_FAILURE_DETECTION
             - JICOFO_ENABLE_REST
             - JICOFO_HEALTH_CHECKS_USE_PRESENCE
             - JICOFO_MAX_MEMORY

jibri.yml

@@ -6,9 +6,8 @@ services:
         restart: ${RESTART_POLICY:-unless-stopped}
         volumes:
             - ${CONFIG}/jibri:/config:Z
+            - ${CONFIG}/storage/jibri:/storage:Z
         shm_size: '2gb'
-        cap_add:
-            - SYS_ADMIN
         environment:
             - AUTOSCALER_SIDECAR_KEY_FILE
             - AUTOSCALER_SIDECAR_KEY_ID

jibri/Dockerfile

@@ -2,6 +2,8 @@ ARG JITSI_REPO=jitsi
 ARG BASE_TAG=latest
 FROM ${JITSI_REPO}/base-java:${BASE_TAG}
 
+USER root
+
 LABEL org.opencontainers.image.title="Jitsi Broadcasting Infrastructure (jibri)"
 LABEL org.opencontainers.image.description="Components for recording and/or streaming a conference."
 LABEL org.opencontainers.image.url="https://github.com/jitsi/jibri"
@@ -15,32 +17,49 @@ ARG CHROME_RELEASE=130.0.6723.116
 
 COPY rootfs/ /
 
-RUN apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
-        jibri \
-        libgl1-mesa-dri \
-        procps \
-        jitsi-upload-integrations \
-        jitsi-autoscaler-sidecar \
-        jq \
-        pulseaudio \
-        dbus \
-        dbus-x11 \
-        rtkit \
-        unzip \
-        fonts-noto \
-        fonts-noto-cjk \
-        libcap2-bin && \
-    /usr/bin/install-chrome.sh && \
-    apt-cleanup && \
-    adduser jibri rtkit && \
-    dpkgArch="$(dpkg --print-architecture)" && \
-    case "${dpkgArch##*-}" in \
-        "amd64") SC_ARCH=x86_64 ;; \
-        "arm64") SC_ARCH=aarch64 ;; \
-        *) echo "unsupported architecture"; exit 1 ;; \
-    esac && \
-    wget -qO /usr/bin/shm-check https://github.com/saghul/shm-check/releases/download/v1.0.0/shm-check-${SC_ARCH} && \
-    chmod +x /usr/bin/shm-check
+RUN \
+  apt-dpkg-wrap apt-get update && \
+  apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
+    dbus \
+    dbus-x11 \
+    fonts-noto \
+    fonts-noto-cjk \
+    jibri \
+    jitsi-autoscaler-sidecar \
+    jitsi-upload-integrations \
+    jq \
+    libcap2-bin \
+    libgl1-mesa-dri \
+    procps \
+    pulseaudio \
+    rtkit \
+    unzip \
+    && \
+  /usr/bin/install-chrome.sh && \
+  apt-get purge -y \
+    unzip \
+    && \
+  apt-cleanup && \
+\
+  rm -rf /etc/jitsi/jibri && \
+  ln -s /run/jibri/config /etc/jitsi/jibri && \
+\
+  usermod -a -G audio,jibri,jitsi,rtkit,video s6 && \
+  cp -r /home/jibri/. /home/s6 && \
+  rm -rf /home/jibri && \
+  ln -s /run/tmp/s6-config /home/s6/.config && \
+  ln -s /run/tmp/s6-local /home/s6/.local && \
+  chown s6:s6 /home/s6 -R && \
+\
+  dpkgArch="$(dpkg --print-architecture)" && \
+  case "${dpkgArch##*-}" in \
+    "amd64") SC_ARCH=x86_64 ;; \
+    "arm64") SC_ARCH=aarch64 ;; \
+    *) echo "unsupported architecture"; exit 1 ;; \
+  esac && \
+  wget -qO /usr/bin/shm-check https://github.com/saghul/shm-check/releases/download/v1.0.0/shm-check-${SC_ARCH} && \
+  chmod +x /usr/bin/shm-check
 
 VOLUME /config
+
+USER s6

jibri/rootfs/defaults/jibri.conf

@@ -32,7 +32,7 @@ jibri {
       {{ end -}}
     }
     recording {
-      recordings-directory = "{{ .Env.JIBRI_RECORDING_DIR | default "/config/recordings" }}"
+      recordings-directory = "{{ .Env.JIBRI_RECORDING_DIR | default "/storage/recordings" }}"
       {{ if .Env.JIBRI_FINALIZE_RECORDING_SCRIPT_PATH -}}
       finalize-script = "{{ .Env.JIBRI_FINALIZE_RECORDING_SCRIPT_PATH }}"
       {{ end -}}
@@ -73,6 +73,7 @@ jibri {
         "--kiosk",
         "--enabled",
         "--autoplay-policy=no-user-gesture-required",
+        "--no-sandbox",
         "--ignore-certificate-errors"
       ]
     }

jibri/rootfs/defaults/logging.properties

@@ -3,25 +3,25 @@ handlers = java.util.logging.FileHandler, java.util.logging.ConsoleHandler
 org.jitsi.utils.logging2.JitsiLogFormatter.programname=Jibri
 
 java.util.logging.FileHandler.level = FINE
-java.util.logging.FileHandler.pattern   = /config/logs/log.%g.txt
+java.util.logging.FileHandler.pattern   = /storage/logs/log.%g.txt
 java.util.logging.FileHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
 java.util.logging.FileHandler.count = 10
 java.util.logging.FileHandler.limit = 10000000
 
 org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.level = FINE
-org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.pattern   = /config/logs/ffmpeg.%g.txt
+org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.pattern   = /storage/logs/ffmpeg.%g.txt
 org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
 org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.count = 10
 org.jitsi.jibri.capture.ffmpeg.util.FfmpegFileHandler.limit = 10000000
 
 org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.level = FINE
-org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.pattern   = /config/logs/pjsua.%g.txt
+org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.pattern   = /storage/logs/pjsua.%g.txt
 org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
 org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.count = 10
 org.jitsi.jibri.sipgateway.pjsua.util.PjsuaFileHandler.limit = 10000000
 
 org.jitsi.jibri.selenium.util.BrowserFileHandler.level = FINE
-org.jitsi.jibri.selenium.util.BrowserFileHandler.pattern   = /config/logs/browser.%g.txt
+org.jitsi.jibri.selenium.util.BrowserFileHandler.pattern   = /storage/logs/browser.%g.txt
 org.jitsi.jibri.selenium.util.BrowserFileHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
 org.jitsi.jibri.selenium.util.BrowserFileHandler.count = 10
 org.jitsi.jibri.selenium.util.BrowserFileHandler.limit = 10000000

jibri/rootfs/etc/s6-overlay/s6-rc.d/01-config/type

@@ -0,0 +1 @@
+oneshot

jibri/rootfs/etc/s6-overlay/s6-rc.d/01-config/up

@@ -0,0 +1 @@
+/etc/s6-overlay/scripts/config

jibri/rootfs/etc/s6-overlay/s6-rc.d/10-xorg/run

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/xorg

jibri/rootfs/etc/s6-overlay/s6-rc.d/10-xorg/type

@@ -0,0 +1 @@
+longrun

jibri/rootfs/etc/s6-overlay/s6-rc.d/20-icewm/run

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/icewm

jibri/rootfs/etc/s6-overlay/s6-rc.d/20-icewm/type

@@ -0,0 +1 @@
+longrun

jibri/rootfs/etc/s6-overlay/s6-rc.d/30-pulse/run

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/pulse

jibri/rootfs/etc/s6-overlay/s6-rc.d/30-pulse/type

@@ -0,0 +1 @@
+longrun

jibri/rootfs/etc/s6-overlay/s6-rc.d/40-jibri/finish

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/jibri-finish

jibri/rootfs/etc/s6-overlay/s6-rc.d/40-jibri/run

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/jibri

jibri/rootfs/etc/s6-overlay/s6-rc.d/40-jibri/type

@@ -0,0 +1 @@
+longrun

jibri/rootfs/etc/s6-overlay/s6-rc.d/50-autoscaler-sidecar/run

@@ -0,0 +1,3 @@
+#!/command/execlineb -P
+
+/etc/s6-overlay/scripts/autoscaler-sidecar

jibri/rootfs/etc/s6-overlay/s6-rc.d/50-autoscaler-sidecar/type

@@ -0,0 +1 @@
+longrun

jibri/rootfs/etc/s6-overlay/scripts/autoscaler-sidecar

@@ -0,0 +1,10 @@
+#!/command/with-contenv bash
+
+if [[ -n "$AUTOSCALER_URL" ]] && [[ -f "/run/autoscaler-sidecar/config" ]]; then
+    DAEMON="/usr/bin/node /usr/share/jitsi-autoscaler-sidecar/app.js"
+    exec /bin/bash -c ". /run/autoscaler-sidecar/config && exec $DAEMON"
+else
+    # if autoscaler-sidecar should not be started,
+    # prevent s6 from restarting this script again and again
+    s6-svc -O /run/service/50-autoscaler-sidecar
+fi