Make the entrypoint extensible

[inkblot]

Based on the techniques described at https://www.camptocamp.com/en/actualite/flexible-docker-entrypoints-scripts/

Enable downstream users of the image to mount additional entrypoint
functionality at runtime or optionally build derivative images with extended
functionality via the /docker-entrypoint.d directory

[jefferai]

@slackpad This is really more a question for the higher level HC containers as I don't want to do something in the Vault container and not elsewhere. Thoughts?

[inkblot]

What do you mean by "higher level HC containers"? The vault dockerfile starts from alpine

[jefferai]

Sorry, I meant https://github.com/hashicorp/docker-base

[inkblot]

Changes in the Hashicorp base image won't have any impact on the vault image, since the vault dockerfile says FROM alpine:3.6 not FROM hashicorp/docker-base

So yes, by all means, add the functionality to the base image. I am in favor of making all of the Hashicorp container entrypoints extensible, but I'm not in a rush either.

[jefferai]

docker-base isn't an image, it's a set of common files across containers. The point is that I don't want the Vault container deviating from the others.

[inkblot]

It looks like docker-base is just a mechanism for getting a couple of go executables into the image (sidebar: why aren't these delivered via an actual base image?). Are you suggesting that dumb-init should handle running any scripts found under /docker-entrypoint.d?

[jefferai]

They are not part of an actual base image because the people we worked with at Docker to make an official image had a preference for us to use Alpine and add versus make a derivative base image.

[isuftin]

@inkblot Any thoughts on when this might be merged in?

[jefferai]

I think it's just waiting on the conflicts to be resolved.

[inkblot]

It is resolved

[madmanmax]

@inkblot is it possible to solve the merge conflicts and get it merged it? it would be great to have this functionality!

[nsteinmetz]

Hi there,

Do we agree that this extensions does not allow to have scripts such as:

vault secrets enable -path=docker kv
vault write docker @/tmp/vault/secrets/docker.json status=ok

Due to the fact that vault will be really launch after scripts have been executed ?

[madmanmax]

@nsteinmetz I was a bit too excited about this. indeed, this extensions doesn't really solve the problem. this is more like pre-processing scripts (e.g. install a linux package or something), but we need something for post-processing scripts, after vault has been executed.

[hashicorp-cla]

All committers have signed the CLA.

[grigorov]

How many time is need for merge this PR?

[netsandbox]

@jefferai any news regarding this?