Installation as a Web Server for Linux

# Official ASP.NET 8.0 runtime base image
FROM mcr.microsoft.com/dotnet/aspnet:8.0
WORKDIR /opt/codesys-4

# The default port is 8080
EXPOSE 8080

# We have to be root to install the package, switch back to app after
USER root

# Install the Debian package for CODESYS 4.
# We set ACCEPT_CODESYS_EULA=true to skip the interactive prompt to accept the EULA during package installation.
# Building and executing this Dockerfile therefore means you accept the terms and condition of the CODESYS Engineering EULA!
RUN --mount=type=bind,source=output/,target=/tmp/output/ <<EOF
ACCEPT_CODESYS_EULA=true
dpkg -i /tmp/output/codesys-4*.deb
EOF

# The server should run with the unprivileged system user "app", see
# https://learn.microsoft.com/en-us/dotnet/core/compatibility/containers/8.0/app-user
# For security reasons, c4-server will refuse to start as root.
USER app:app
ENTRYPOINT ["/opt/codesys-4/c4-server"]

# This script is used to start our CODESYS 4 docker containers in our
# development and test environments (RasPi, WSL, Linux VM).
# It's not regarded as safe for production use!

# The name of our container
CONTAINER=codesys-4

# The repository to fetch the image from
URL="dockerhost.example.com:1234/codesys-images/codesys-4:develop"

# Stop and clean up any running container.
if docker inspect "$CONTAINER" > /dev/null 2>&1; then
  echo Trying to clean up
  docker stop "$CONTAINER"
  docker rm "$CONTAINER"
fi

# stop and rm may fail when the container does not exist,
# but from here on, we want to abort on first error
set -e

echo Downloading "$URL"...

docker pull "$URL"

echo starting image...

# Starting the docker image.
# We mount the /home folder. We listen on port 8080.
# The option "--add-host host.docker.internal:host-gateway" allows us to access
# a CODESYS gateway running on the host machine via the hostname
# "host.docker.internal" from within the container.

docker run --restart=unless-stopped --detach \
        --volume /home:/home \
        -p127.0.0.1:8080:8080 \
        -e CBE_PORT=8080 \
        --add-host host.docker.internal:host-gateway \
        --name "$CONTAINER" \
        "$URL"

# output the version and build info, with some newlines, so it's easier readable.
echo -e \\n CODESYS 4 image build info: $(docker exec codesys-4 cat /opt/codesys-4/dist/version.json) \\n

# Ensure we have a home directory the app user can use, to write the C4 log files.
# The base image already contains /home/app, but it's shadowed by mounting our
# /home into the container, so we need to create the folder if it doesn't exist.
# Strictly speaking, this is only necessary once on a given host (because /home
# has been mounted from the host), but if we run it always, we can be sure that
# this script will also work on fresh machines.
docker exec --user 0 "$CONTAINER" bash -c "mkdir -v -p /home/app ; chown -v app:app /home/app ; chmod -v og-rwx /home/app"

# Synchronize the actual users into the container. We use a very hackish approach
# here, not recommended for production use, it just works for the dev environment.
# WARNING: Synchronizing will only work when:
# 1) The users do not yet exist within the container
# 2) The numeric user and group IDs are not yet occupied within the container.
# Also, it's recommended to configure sudo so it caches the password using
# timestamp-timeout, or even NOPASSWD if you want to take the risk.
# Only the groups codesys-4 and the user personal group will be synchronized.

echo synchronizing group codesys-4
getent group codesys-4| docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/group"
sudo getent gshadow codesys-4| docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/gshadow"

# get all users in group codesys-4
C4_USERS=$(getent group codesys-4| awk -F':' '{print $4}' | tr ',' ' ')

for CURRENT in $C4_USERS ; do
  echo synchronizing user $CURRENT

  getent passwd $CURRENT | docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/passwd"
  sudo getent shadow $CURRENT | docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/shadow"

  # we also need to synchronize the user specific group
  getent group $CURRENT | docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/group"
  sudo getent gshadow $CURRENT | docker exec --user 0 -i "$CONTAINER" /bin/sh -c "cat >>/etc/gshadow"
done

echo finished.