From ac2ca2b4e36fdb4f79a195129aa5b04ec51898d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E8=9A=82=E8=9A=81=E4=BA=91?=
 <xiaomayicloud@163.com>
Date: Fri, 11 Sep 2026 15:24:50 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0Dockerfile?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jenkins/Dockerfile | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.jenkins/Dockerfile b/.jenkins/Dockerfile
index e4acf42..b126825 100644
--- a/.jenkins/Dockerfile
+++ b/.jenkins/Dockerfile
@@ -15,6 +15,10 @@ ARG VAR_BASE_IMAGE
 # ============================================================
 FROM ${VAR_BASE_IMAGE} AS builder
 
+# 基础镜像末尾设置了 USER esxi，这里切回 root，
+# 否则下面的 yum install 会因权限不足而失败
+USER root
+
 # 镜像作者信息（仅元数据，不影响体积）
 LABEL MAINTAINER="djangoadmin@126.com"
 
@@ -84,6 +88,10 @@ RUN pip3 install --prefix=/install -r requirements.txt && \
 # ============================================================
 FROM ${VAR_BASE_IMAGE} AS runtime
 
+# 基础镜像末尾设置了 USER esxi，这里切回 root，
+# 否则下面的 yum install 会因权限不足而失败
+USER root
+
 # 镜像作者信息
 LABEL MAINTAINER="djangoadmin@126.com"
 
@@ -150,6 +158,17 @@ WORKDIR /opt/apps
 # ------------------------------------------------------------
 COPY ${VAR_PYFILE_PATH}/ ./
 
+# ------------------------------------------------------------
+# 修正工作目录属主，保证 esxi 用户可读写
+#   （root 身份 COPY 进来的文件属主是 root，需改回 esxi）
+# ------------------------------------------------------------
+RUN chown -R esxi:esxi /opt/apps
+
+# ------------------------------------------------------------
+# 切回非 root 用户运行应用（安全加固）
+# ------------------------------------------------------------
+USER esxi
+
 # ------------------------------------------------------------
 # 暴露端口（仅声明，实际映射由 docker run -p 决定）
 # ------------------------------------------------------------