$ show atmoz/sftp
atmoz/sftp is a Docker image that provides a production-ready SFTP server built on OpenSSH. At runtime, the container starts sshd with a chroot jail, forcing every user into their own home directory and restricting access to SFTP only. User accounts are provisioned from three sources: command-line arguments, the SFTP_USERS environment variable, and a mounted users.conf file. The entrypoint merges these definitions on first run, generates unique SSH host keys if none are mounted, and optionally executes custom scripts from /etc/sftp.d before launching sshd or passing through arbitrary commands. The core logic lives in two well-crafted Bash scripts. files/create-sftp-user parses compact user specifications (user:pass[:e][:uid[:gid[:dir1,dir2]]]), validates them with POSIX regexes, creates system users with optional UID/GID, sets plain or encrypted passwords, aggregates SSH public keys from .ssh/keys into a deduplicated authorized_keys file, and creates writable subdirectories. files/entrypoint handles configuration merging, first-run initialization, host key generation, and command passthrough. The sshd_config enforces secure defaults: no root login, no TCP forwarding, no X11, and internal-sftp with ChrootDirectory %h. The project includes a solid integration test suite (tests/run) using shunit2 that works with both Docker and Podman, exercising real SFTP sessions, key-based login, directory creation, custom UID/GID, and legacy config paths. CI workflows rebuild images daily to pick up OpenSSH security updates and run ShellCheck plus signature verification. The codebase is small, focused, and well-maintained, with no significant technical debt or security debt. It is a strong example of a purpose-built infrastructure container with clean shell scripting and meaningful test coverage.
The LLM identified 3 files worth highlighting for reuse:
Self-contained Bash script that parses compact user specs (user:pass[:e][:uid[:gid[:dir1,dir2]]]), validates each field against POSIX regexes, creates system users with optional UID/GID, sets plain or encrypted passwords, disables password login when none is given, aggregates SSH public keys from .ssh/keys into a deduplicated authorized_keys file with correct permissions, and creates writable subdirectories. It depends only on standard Unix tools and can be extracted into any container image needing chrooted SFTP user bootstrap.
Container entrypoint that merges user definitions from a mounted config file, CLI arguments, and the SFTP_USERS environment variable into a final config on first run, generates unique SSH host keys when absent, executes custom scripts from /etc/sftp.d, and either execs sshd or passes through arbitrary commands. Demonstrates a clean first-run initialization pattern with backward compatibility for legacy config paths and robust error trapping.
Self-contained integration test harness for container images using shunit2, supporting both Docker and Podman. It generates ephemeral SSH keys, waits for port availability, runs real SFTP command batches against the container, and asserts filesystem and user state. This is a reusable pattern for black-box testing any SSH/SFTP container image, not just a project-specific fixture.