#!/bin/bash
set -e
if [ ! -f /var/app/.initialized ]; then
######## First Time ########
echo "First run. Setting up ..."
mkdir -p /var/app
touch /var/app/.initialized
# ユーザーが存在しない場合のみ作成する
if id "${UNAME}" &>/dev/null; then
echo "User ${UNAME} already exists. Skipping creation."
else
# 同名グループが無ければ作成する
if ! getent group "${UNAME}" &>/dev/null; then
echo "Creating group ${UNAME} with GID=${GID}"
groupadd -g ${GID} ${UNAME}
else
echo "Group ${UNAME} already exists. Skipping group creation."
fi
echo "Creating user ${UNAME} with UID=${UID}, GID=${GID}"
useradd -m -u ${UID} -g ${GID} -s /bin/bash ${UNAME}
echo "${UNAME}:${PASS}" | chpasswd
usermod -aG sudo ${UNAME}
fi
# ホームディレクトリの Owner が root:root になることがあるので明示的に変更する。
chown -v ${UNAME}:${UNAME} /home/${UNAME}
# SSHD のポート番号を変更する
sed -i "s/^Port.*/Port ${SSHD_PORT}/" /etc/ssh/sshd_config
else
######## Second Time or Later ########
echo "Starting for the second time or later ..."
fi
# firewall
/usr/sbin/ufw enable
/usr/sbin/ufw allow from 0.0.0.0/0 to any port ${SSHD_PORT} proto tcp
/usr/sbin/ufw default deny incoming
# supervisord start (background)
/usr/bin/supervisord -c /etc/supervisor/supervisord.conf &
# Execute Commands in CMD
if [ "$#" -gt 0 ]; then
exec "$@"
else
echo "No command provided. Starting bash ..."
exec bash
fi
「アクセスしてきたクライアントの正しいipアドレスが container 上の httpdサーバ (apache2) に伝わる」ように
macvlan を使って「Container に物理 NIC と同じネットワークの独立した IP アドレスを与える」方法を採る。
これは、現時点(2025/12/10)では docker ホスト OS が Linux の場合にだけ使える手法である。
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
ebbd998b2086 bridge bridge local
17420af9f271 host host local
557533733a33 macvlan_net macvlan local
a3538f29efc6 none null local
$ docker network ls --no-trunc
NETWORK ID NAME DRIVER SCOPE
ebbd998b20868aea17c1e9f3cd85edb3c7c0ce9181edfe9b308284604275e136 bridge bridge local
17420af9f27199ef5081c56e85910d913c73ae8f3885e48e4ed0b09a06d48016 host host local
557533733a33e84ca9eb665736f6a273414778f30a3e744411596008728b0b2b macvlan_net macvlan local
a3538f29efc60166d3f639d42894eff9f902649036619190011c3a66b262a06a none null local
First run. Setting up ... ← 生成された Container 内で entrypoint.sh が実行される
Creating group www with GID=3000
Creating user www with UID=3000, GID=3000
info: Adding user `www' to group `sudo' ...
ownership of '/home/www' retained as www:www
No command provided. Starting bash ...
root@sshd_server:/# 2025-12-14 12:33:31,857 CRIT Supervisor is running as root. Privileges were not dropped because no user is specified in the config file. If you intend to run as root, you can set user=root in the config file to avoid this message.
2025-12-14 12:33:31,857 INFO Included extra file "/etc/supervisor/conf.d/supervisord.conf" during parsing
2025-12-14 12:33:31,860 INFO RPC interface 'supervisor' initialized
2025-12-14 12:33:31,860 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2025-12-14 12:33:31,860 INFO supervisord started with pid 38
2025-12-14 12:33:32,864 INFO spawned: 'rsyslog' with pid 41
2025-12-14 12:33:32,866 INFO spawned: 'fail2ban' with pid 42
2025-12-14 12:33:32,867 INFO spawned: 'sshd' with pid 43
2025-12-14 12:33:34,000 INFO success: rsyslog entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-12-14 12:33:34,000 INFO success: fail2ban entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-12-14 12:33:34,000 INFO success: sshd entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
# ← Container 内の対話環境 (root 権限の bash) が動く
(Container 内の root 権限で) ユーザ名を調べる。
# whoami
root
(Container 内の root 権限で) 直ちに ユーザ www のパスワードを変更する。
# passwd www
New password: 新しいパスワード ← 新しいパスワードを入力する(エコーバックされない)
Retype new password: 新しいパスワード ← もう一度新しいパスワードを入力する(エコーバックされない)
(Container 内の root 権限で) ufw を有効化する
# ufw enable
Status: active
# ufw allow from 0.0.0.0/0 to any port 22 proto tcp
Rule added
外部からのアクセスはデフォルトで禁止にする。
# ufw default deny incoming
ファイアウォールの設定状況を見る
# ufw status
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.11.0-25-generic x86_64)
...
To run a command as administrator (user "root"), use "sudo ".
See "man sudo_root" for details.
www $
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 6
| `- File list: /var/log/syslog
`- Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: 192.168.12.2
