External/mediamtx
1
0
Fork 1
mirror of https://github.com/bluenviron/mediamtx.git synced 2025-12-20 02:00:05 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

improve unsafe path handling (#3927)

Browse source 
* fix: improve unsafe path handling

Paths containing spaces or dashes were being interpreted as separate options, since the path handling lacked double quotes.

This fixes all unsafe instances of "PWD" and "HOME", along with all other unsafe paths in the scripts.

* readme: explicitly mount the configuration as read-only

This clearly shows users that the MediaMTX container will not modify the configuration file.
This commit is contained in:
Johnny Arcitec 2024-11-06 15:15:25 +01:00 • committed by GitHub
parent 716660217d
commit 426e6f89a2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 29 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -1260,7 +1260,7 @@ There are 3 ways to change the configuration:
* available in the root folder of the Docker image (`/mediamtx.yml`); it can be overridden in this way: * available in the root folder of the Docker image (`/mediamtx.yml`); it can be overridden in this way:
``` ```
docker run --rm -it --network=host -v $PWD/mediamtx.yml:/mediamtx.yml bluenviron/mediamtx docker run --rm -it --network=host -v "${PWD}/mediamtx.yml:/mediamtx.yml:ro" bluenviron/mediamtx
``` ```
The configuration can be changed dynamically when the server is running (hot reloading) by writing to the configuration file. Changes are detected and applied without disconnecting existing clients, whenever it's possible. The configuration can be changed dynamically when the server is running (hot reloading) by writing to the configuration file. Changes are detected and applied without disconnecting existing clients, whenever it's possible.

2
scripts/apidocs.mk
View file

@ -6,5 +6,5 @@ export DOCKERFILE_APIDOCS_GEN
apidocs: apidocs:
echo "$$DOCKERFILE_APIDOCS_GEN" | docker build . -f - -t temp echo "$$DOCKERFILE_APIDOCS_GEN" | docker build . -f - -t temp
docker run --rm -v $(PWD)/apidocs:/s -w /s temp \ docker run --rm -v "$(PWD)/apidocs:/s" -w /s temp \
sh -c "redoc-cli bundle openapi.yaml" sh -c "redoc-cli bundle openapi.yaml"

30
scripts/binaries.mk
View file

@ -15,38 +15,38 @@ RUN go generate ./...
FROM build-base AS build-windows-amd64 FROM build-base AS build-windows-amd64
ENV GOOS=windows GOARCH=amd64 ENV GOOS=windows GOARCH=amd64
RUN go build -o tmp/$(BINARY_NAME).exe RUN go build -o "tmp/$(BINARY_NAME).exe"
RUN cd tmp && zip -q ../binaries/$(BINARY_NAME)_$$(cat ../internal/core/VERSION)_windows_amd64.zip $(BINARY_NAME).exe mediamtx.yml LICENSE RUN cd tmp && zip -q "../binaries/$(BINARY_NAME)_$$(cat ../internal/core/VERSION)_windows_amd64.zip" "$(BINARY_NAME).exe" mediamtx.yml LICENSE
FROM build-base AS build-linux-amd64 FROM build-base AS build-linux-amd64
ENV GOOS=linux GOARCH=amd64 ENV GOOS=linux GOARCH=amd64
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_amd64.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_amd64.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM build-base AS build-darwin-amd64 FROM build-base AS build-darwin-amd64
ENV GOOS=darwin GOARCH=amd64 ENV GOOS=darwin GOARCH=amd64
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_darwin_amd64.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_darwin_amd64.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM build-base AS build-darwin-arm64 FROM build-base AS build-darwin-arm64
ENV GOOS=darwin GOARCH=arm64 ENV GOOS=darwin GOARCH=arm64
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_darwin_arm64.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_darwin_arm64.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM build-base AS build-linux-armv6 FROM build-base AS build-linux-armv6
ENV GOOS=linux GOARCH=arm GOARM=6 ENV GOOS=linux GOARCH=arm GOARM=6
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_armv6.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_armv6.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM build-base AS build-linux-armv7 FROM build-base AS build-linux-armv7
ENV GOOS=linux GOARCH=arm GOARM=7 ENV GOOS=linux GOARCH=arm GOARM=7
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_armv7.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_armv7.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM build-base AS build-linux-arm64 FROM build-base AS build-linux-arm64
ENV GOOS=linux GOARCH=arm64 ENV GOOS=linux GOARCH=arm64
RUN go build -o tmp/$(BINARY_NAME) RUN go build -o "tmp/$(BINARY_NAME)"
RUN tar -C tmp -czf binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_arm64v8.tar.gz --owner=0 --group=0 $(BINARY_NAME) mediamtx.yml LICENSE RUN tar -C tmp -czf "binaries/$(BINARY_NAME)_$$(cat internal/core/VERSION)_linux_arm64v8.tar.gz" --owner=0 --group=0 "$(BINARY_NAME)" mediamtx.yml LICENSE
FROM $(BASE_IMAGE) FROM $(BASE_IMAGE)
COPY --from=build-windows-amd64 /s/binaries /s/binaries COPY --from=build-windows-amd64 /s/binaries /s/binaries
@ -62,5 +62,5 @@ export DOCKERFILE_BINARIES
binaries: binaries:
echo "$$DOCKERFILE_BINARIES" | DOCKER_BUILDKIT=1 docker build . -f - \ echo "$$DOCKERFILE_BINARIES" | DOCKER_BUILDKIT=1 docker build . -f - \
-t temp -t temp
docker run --rm -v $(PWD):/out \ docker run --rm -v "$(PWD):/out" \
temp sh -c "rm -rf /out/binaries && cp -r /s/binaries /out/" temp sh -c "rm -rf /out/binaries && cp -r /s/binaries /out/"

8
scripts/dockerhub-legacy.mk
View file

@ -6,28 +6,28 @@ dockerhub-legacy:
docker login -u $(DOCKER_USER_LEGACY) -p $(DOCKER_PASSWORD_LEGACY) docker login -u $(DOCKER_USER_LEGACY) -p $(DOCKER_PASSWORD_LEGACY)
docker run --rm \ docker run --rm \
-v $(HOME)/.docker:/.docker:ro \ -v "$(HOME)/.docker:/.docker:ro" \
quay.io/skopeo/stable:latest copy --all \ quay.io/skopeo/stable:latest copy --all \
--authfile /.docker/config.json \ --authfile /.docker/config.json \
docker://docker.io/$(DOCKER_REPOSITORY):$(VERSION)-rpi \ docker://docker.io/$(DOCKER_REPOSITORY):$(VERSION)-rpi \
docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):v$(VERSION)-rpi docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):v$(VERSION)-rpi
docker run --rm \ docker run --rm \
-v $(HOME)/.docker:/.docker:ro \ -v "$(HOME)/.docker:/.docker:ro" \
quay.io/skopeo/stable:latest copy --all \ quay.io/skopeo/stable:latest copy --all \
--authfile /.docker/config.json \ --authfile /.docker/config.json \
docker://docker.io/$(DOCKER_REPOSITORY):latest-rpi \ docker://docker.io/$(DOCKER_REPOSITORY):latest-rpi \
docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):latest-rpi docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):latest-rpi
docker run --rm \ docker run --rm \
-v $(HOME)/.docker:/.docker:ro \ -v "$(HOME)/.docker:/.docker:ro" \
quay.io/skopeo/stable:latest copy --all \ quay.io/skopeo/stable:latest copy --all \
--authfile /.docker/config.json \ --authfile /.docker/config.json \
docker://docker.io/$(DOCKER_REPOSITORY):$(VERSION) \ docker://docker.io/$(DOCKER_REPOSITORY):$(VERSION) \
docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):v$(VERSION) docker://docker.io/$(DOCKER_REPOSITORY_LEGACY):v$(VERSION)
docker run --rm \ docker run --rm \
-v $(HOME)/.docker:/.docker:ro \ -v "$(HOME)/.docker:/.docker:ro" \
quay.io/skopeo/stable:latest copy --all \ quay.io/skopeo/stable:latest copy --all \
--authfile /.docker/config.json \ --authfile /.docker/config.json \
docker://docker.io/$(DOCKER_REPOSITORY):latest \ docker://docker.io/$(DOCKER_REPOSITORY):latest \

4
scripts/dockerhub.mk
View file

@ -60,7 +60,7 @@ dockerhub:
cp binaries/*linux_arm64v8.tar.gz tmp/binaries/linux/arm64.tar.gz cp binaries/*linux_arm64v8.tar.gz tmp/binaries/linux/arm64.tar.gz
docker buildx rm builder 2>/dev/null || true docker buildx rm builder 2>/dev/null || true
rm -rf $$HOME/.docker/manifests/* rm -rf "$$HOME/.docker/manifests"/*
docker buildx create --name=builder --use docker buildx create --name=builder --use
echo "$$DOCKERFILE_DOCKERHUB_RPI_BASE_32" | docker buildx build . -f - \ echo "$$DOCKERFILE_DOCKERHUB_RPI_BASE_32" | docker buildx build . -f - \
@ -103,4 +103,4 @@ dockerhub:
--push --push
docker buildx rm builder docker buildx rm builder
rm -rf $$HOME/.docker/manifests/* rm -rf "$$HOME/.docker/manifests"/*

2
scripts/format.mk
View file

@ -6,5 +6,5 @@ export DOCKERFILE_FORMAT
format: format:
echo "$$DOCKERFILE_FORMAT" | docker build -q . -f - -t temp echo "$$DOCKERFILE_FORMAT" | docker build -q . -f - -t temp
docker run --rm -it -v $(PWD):/s -w /s temp \ docker run --rm -it -v "$(PWD):/s" -w /s temp \
sh -c "gofumpt -l -w ." sh -c "gofumpt -l -w ."

4
scripts/lint.mk
View file

@ -5,7 +5,7 @@ endef
export DOCKERFILE_APIDOCS_LINT export DOCKERFILE_APIDOCS_LINT
lint-golangci: lint-golangci:
docker run --rm -v $(PWD):/app -w /app \ docker run --rm -v "$(PWD):/app" -w /app \
$(LINT_IMAGE) \ $(LINT_IMAGE) \
golangci-lint run -v golangci-lint run -v
@ -15,7 +15,7 @@ lint-mod-tidy:
lint-apidocs: lint-apidocs:
echo "$$DOCKERFILE_APIDOCS_LINT" | docker build . -f - -t temp echo "$$DOCKERFILE_APIDOCS_LINT" | docker build . -f - -t temp
docker run --rm -v $(PWD)/apidocs:/s -w /s temp \ docker run --rm -v "$(PWD)/apidocs:/s" -w /s temp \
sh -c "openapi lint openapi.yaml" sh -c "openapi lint openapi.yaml"
lint: lint-golangci lint-mod-tidy lint-apidocs lint: lint-golangci lint-mod-tidy lint-apidocs

2
scripts/mod-tidy.mk
View file

@ -1,3 +1,3 @@
mod-tidy: mod-tidy:
docker run --rm -it -v $(PWD):/s -w /s $(BASE_IMAGE) \ docker run --rm -it -v "$(PWD):/s" -w /s $(BASE_IMAGE) \
sh -c "apk add git && GOPROXY=direct go mod tidy" sh -c "apk add git && GOPROXY=direct go mod tidy"

4
scripts/test.mk
View file

@ -25,13 +25,13 @@ export DOCKERFILE_TEST
test: test:
echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=amd64 echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=amd64
docker run --rm \ docker run --rm \
-v $(PWD):/s \ -v "$(PWD):/s" \
temp \ temp \
make test-nodocker make test-nodocker
test32: test32:
echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=i386 echo "$$DOCKERFILE_TEST" | docker build -q . -f - -t temp --build-arg ARCH=i386
docker run --rm \ docker run --rm \
-v $(PWD):/s \ -v "$(PWD):/s" \
temp \ temp \
make test-nodocker make test-nodocker