jeffre/cbs repository overview

⁠docker-cbs

docker image for AhsayCBS v8.5.2.70

⁠Clone repo and create docker image

git clone https://github.com/jeffre/docker-cbs.git
cd docker-cbs
make docker-image

⁠Create and run docker container

Quick and dirty:

docker run -p "80:80" -p "443:443" jeffre/cbs

Using bind mount for important volumes:

docker run \
    -p "80:80" \
    -p "443:443" \
    -v "$(pwd)/cbs/conf:/cbs/conf" \
    -v "$(pwd)/cbs/logs:/cbs/logs" \
    -v "$(pwd)/cbs/pns:/cbs/pns" \
    -v "$(pwd)/cbs/system:/cbs/system" \
    -v "$(pwd)/cbs/user:/cbs/user" \
    jeffre/cbs

⁠Stop running container

docker stop --time 60 CONTAINER_NAME

Note: use the --time n flag to prevent docker from prematurely resorting to SIGKILL after 10 seconds.

⁠Important paths

• /cbs/conf: configuration (including ssl certs and user profiles)
• /cbs/logs: access logs and context logs
• /cbs/pns: Push Notification Server database
• /cbs/system: policies, logs, agent installers, and temp path for agentless cloud backup
• /cbs/user: client data

⁠Environment variables

• TOMCAT_CONF_CLOBBER (): if set to true (case-insensitive) then tomcat-related config files in /cbs/conf will be overwritten with the latest defaults at each startup. This is helpful for staying inline with the frequently changing upstream. However, it can also be dangerous as it will wipe out intentional changes as well. Affected files include:
  • catalina.policy
  • catalina.properties
  • cbssvc.ini
  • context.xml
  • logging.properties
  • server.xml
  • tomcat-users.xml
  • web.xml
• MIGRATEV7 (): if set to false (case-insensitive) then bin/startup.sh will be prevented from calling bin/migrateV7.sh. This is useful for preserving an "SSLv2Hello" attribute in server.xml's "protocols" element which would otherwise be removed. If not set or set to anything besides false it will resume normal behavior (running migrateV7.sh on each startup)

⁠Docker build args

• APP_HOME (/cbs): path to install app
• uid (400): id of ahsay user
• gid (400): group id of ahsay user
• http_port (80): port to listen for http connections
• https_port (443): port to listen for https connections
• INSTALLER: URL of CBS installer tarball
• HOTFIXES: list of space-separated URLs to download hotfixes
• VERSION: string which will be written to the docker image label at "com.ahsay.product.version"

⁠Features and notes

• The application runs as the limited user "ahsay" (default 400:400).
• Catalina is started as a foreground process.
• Added support for SSLv2Hello allowing clients on versions less than v6.21.2.0 to connect.
• /cbs/conf will be populated with default files if files of the same name do not exist prior to the start of the container (entrypoint.sh uses cp --no-clobber).
• Ahsay licensing is sensitive to mac address changes. Consider using Docker's --mac-address flag to maintain sanity before deploying an updated container.

⁠Incorporating upstream version bumps

1. Update the following variables inside Makefile:
   • INSTALLER_VERSION: URL for cbs-nix.tar.gz (eg: "https://ahsay-dn.ahsay.com/v8/85262/cbs-nix.tar.gz⁠")
   • INSTALLER: Version string (eg: "8.5.2.62")
   • HOTFIX_VERSION: (Optional) URL for hotfix (eg: "https://download.ahsay.com/dev/hot-fixes/85/public/cbs-nix-v85270.zip⁠" or "")
   • HOTFIXES: (Optional) Version string for hotfix (eg: "8.5.2.70" or "")
2. Execute make bump. This will update 4 files:
   • .dockerignore
   • Dockerfile
   • Makefile
   • README.md