docker-baseimage-ubuntu/root/docker-mods

#!/usr/bin/with-contenv bash

# Set executable bit on cont-init and services built into the image
set_legacy_executable_bits() {
  mkdir -p /etc/{cont-init.d,services.d}
  chmod +x \
    /etc/cont-init.d/* \
    /etc/services.d/*/* 2> /dev/null || true
}
set_legacy_executable_bits

SERVICES_DIR_OLD="/config/custom-services.d"
SERVICES_DIR="/custom-services.d"

# Remove all existing custom services before continuing to ensure
# we aren't running anything the user may have removed
if [[ -n "$(/bin/ls -A /etc/s6-overlay/s6-rc.d/custom-svc-* 2>/dev/null)" ]]; then
    echo "[custom-init] removing existing custom services..."
    rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-*
fi

if [[ -z "$(/bin/ls -A ${SERVICES_DIR} 2>/dev/null)" ]] &&
    [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then
    echo "[custom-init] no custom services found, skipping..."
else
# Make sure custom service directory exists and has files in it
if [[ -e "${SERVICES_DIR}" ]] && [[ -n "$(/bin/ls -A ${SERVICES_DIR} 2>/dev/null)" ]]; then
    echo "[custom-init] service files found in ${SERVICES_DIR}"
    for SERVICE in "${SERVICES_DIR}"/*; do
        NAME="$(basename "${SERVICE}")"
        if [[ -f "${SERVICE}" ]]; then
            echo "[custom-init] ${NAME}: service detected, copying..."
            mkdir -p /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/
            cp "${SERVICE}" /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
            chmod +x /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
            echo "longrun" >/etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/type
            touch /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/init-services
            echo "[custom-init] ${NAME}: copied"
        elif [[ ! -f "${SERVICE}" ]]; then
            echo "[custom-init] ${NAME}: is not a file"
        fi
    done
fi

if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then
    echo "[custom-init] service files found in ${SERVICES_DIR_OLD}"
    for SERVICE in "${SERVICES_DIR_OLD}"/*; do
        NAME="$(basename "${SERVICE}")"
        if [[ -f "${SERVICE}" ]]; then
            echo "[custom-init] ${NAME}: service detected, copying..."
            mkdir -p /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/
            cp "${SERVICE}" /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
            chmod +x /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
            echo "longrun" >/etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/type
            touch /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/init-services
            echo "[custom-init] ${NAME}: copied"
        elif [[ ! -f "${SERVICE}" ]]; then
            echo "[custom-init] ${NAME}: is not a file"
        fi
    done
fi
fi

# Exit if mods is not set
if [ -z ${DOCKER_MODS+x} ]; then
  exit 0
fi

# Check for curl
if [ ! -f /usr/bin/curl ] || [ ! -f /usr/bin/jq ]; then
  echo "[mod-init] Curl/JQ was not found on this system for Docker mods installing"
  if [ -f /usr/bin/apt ]; then
    ## Ubuntu
    apt-get update
    apt-get install --no-install-recommends -y \
      curl \
      jq
  elif [ -f /sbin/apk ]; then
    # Alpine
    apk add --no-cache \
      curl \
      jq
  fi
fi

## Functions

# Use different filtering depending on URL
get_blob_sha () {
  if [[ $1 == "ghcr" ]]; then
    curl -f --retry 10 --retry-max-time 60 --retry-connrefused \
      --silent \
      --location \
      --request GET \
      --header "Authorization: Bearer $2" \
      $3 | jq -r '.layers[0].digest'
  else
    curl -f --retry 10 --retry-max-time 60 --retry-connrefused \
      --silent \
      --location \
      --request GET \
      --header "Authorization: Bearer $2" \
      $3 | jq -r '.fsLayers[0].blobSum'
  fi
}

# Main run logic
echo "[mod-init] Attempting to run Docker Modification Logic"
IFS='|'
DOCKER_MODS=(${DOCKER_MODS})
for DOCKER_MOD in "${DOCKER_MODS[@]}"; do
  # Support alternative endpoints
  if [[ ${DOCKER_MOD} == ghcr.io/* ]] || [[ ${DOCKER_MOD} == linuxserver/* ]]; then
    DOCKER_MOD="${DOCKER_MOD#ghcr.io/*}"
    ENDPOINT="${DOCKER_MOD%%:*}"
    USERNAME="${DOCKER_MOD%%/*}"
    REPO="${ENDPOINT#*/}"
    TAG="${DOCKER_MOD#*:}"
    if [[ ${TAG} == "${DOCKER_MOD}" ]]; then
      TAG="latest"
    fi
    FILENAME="${USERNAME}.${REPO}.${TAG}"
    AUTH_URL="https://ghcr.io/token?scope=repository%3A${USERNAME}%2F${REPO}%3Apull"
    MANIFEST_URL="https://ghcr.io/v2/${ENDPOINT}/manifests/${TAG}"
    BLOB_URL="https://ghcr.io/v2/${ENDPOINT}/blobs/"
    MODE="ghcr"
  else
    ENDPOINT="${DOCKER_MOD%%:*}"
    USERNAME="${DOCKER_MOD%%/*}"
    REPO="${ENDPOINT#*/}"
    TAG="${DOCKER_MOD#*:}"
    if [[ ${TAG} == "${DOCKER_MOD}" ]]; then
      TAG="latest"
    fi
    FILENAME="${USERNAME}.${REPO}.${TAG}"
    AUTH_URL="https://auth.docker.io/token?service=registry.docker.io&scope=repository:${ENDPOINT}:pull"
    MANIFEST_URL="https://registry-1.docker.io/v2/${ENDPOINT}/manifests/${TAG}"
    BLOB_URL="https://registry-1.docker.io/v2/${ENDPOINT}/blobs/"
    MODE="dockerhub"
  fi
  # Kill off modification logic if any of the usernames are banned
  BLACKLIST=$(curl -s https://raw.githubusercontent.com/linuxserver/docker-mods/master/blacklist.txt)
  IFS=$'\n'
  BLACKLIST=(${BLACKLIST})
  for BANNED in "${BLACKLIST[@]}"; do
    if [ "${BANNED}" == "${USERNAME,,}" ]; then
      if [ -z ${RUN_BANNED_MODS+x} ]; then
        echo "[mod-init] ${DOCKER_MOD} is banned from use due to reported abuse aborting mod logic"
        exit 0
      else
        echo "[mod-init] You have chosen to run banned mods ${DOCKER_MOD} will be applied"
      fi
    fi
  done
  echo "[mod-init] Applying ${DOCKER_MOD} files to container"
  # Get Dockerhub token for api operations
  TOKEN=\
"$(curl -f --retry 10 --retry-max-time 60 --retry-connrefused \
    --silent \
    --header 'GET' \
    "${AUTH_URL}" \
    | jq -r '.token' \
  )"
  # Determine first and only layer of image
  SHALAYER=$(get_blob_sha "${MODE}" "${TOKEN}" "${MANIFEST_URL}")
  # Check if we have allready applied this layer
  if [ -f "/${FILENAME}" ] && [ "${SHALAYER}" == "$(cat /${FILENAME})" ]; then
    echo "[mod-init] ${DOCKER_MOD} at ${SHALAYER} has been previously applied skipping"
  else
    # Download and extract layer to /
    curl -f --retry 10 --retry-max-time 60 --retry-all-errors \
      --silent \
      --location \
      --request GET \
      --header "Authorization: Bearer ${TOKEN}" \
      "${BLOB_URL}${SHALAYER}" -o \
      /modtarball.tar.xz
    mkdir -p /tmp/mod
    tar xzf /modtarball.tar.xz -C /tmp/mod
    if [ -d /tmp/mod/etc/s6-overlay ]; then
      if [ -d /tmp/mod/etc/cont-init.d ]; then
        rm -rf /tmp/mod/etc/cont-init.d
      fi
      if [ -d /tmp/mod/etc/services.d ]; then
        rm -rf /tmp/mod/etc/services.d
      fi
    fi
    shopt -s dotglob
    cp -R /tmp/mod/* /
    shopt -u dotglob
    rm -rf /tmp/mod
    rm -rf /modtarball.tar.xz
    echo ${SHALAYER} > "/${FILENAME}"
    echo "[mod-init] ${DOCKER_MOD} applied to container"
  fi
done

# Set executable bit on cont-init and services that may have been unpacked by mods
set_legacy_executable_bits