Add decription on how you can customize image entrypoint

[potiuk]

---

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.

[yan-hic]

I still believe there is an use case for executing stuff BEFORE the entrypoint. In our case, we override the DB pointer dynamically, depending on some values in the ENV -> can only be set at runtime. Hence must run before the entrypoint as the latter (entrypoint_prod) performs a DB check, which we want (+ create user).

Our way around it: build an image with our my_entrypoint.sh as entrypoint, which will do all ENV settings, and then exec the base entrypoint passing on any argument.

[potiuk]

Our way around it: build an image with our my_entrypoint.sh as entrypoint, which will do all ENV settings, and then exec the base entrypoint passing on any argument.

Good point. I added this option to the PR with documentation : #18915

There are a few things that you have to be aware of (read the docs) in this case:

• never add any secrets this way (either via image variables, scripts, or arguments of image call)
• make sure you use dumb-init in the entrypoint (otherwise your signal propagation will be broken)

ENTRYPOINT ["/usr/bin/dumb-init", "--", "/your_entrypoint.sh"]

• always use exec /entrypoint "${@}" as last command in your custom entrypoint.

I explained that all in the PR #18915

[potiuk]

I also added code explaining that "before" executing Airflow's entrypoint, certain functionality is not be available (updated the PR)

Also be aware that code executed before Airflow's entrypoint should not create any files or
directories inside the image and not everything might work the same way as after it is executed.
Before Airflow entrypoint is executed, the following functionalities are not available:

• umask is not set properly to allow "group" write access
• user is not yet created in /etc/passwd in case aribitrary user is used to run the image
• the database and brokers might not be available yet

[yan-hic]

@potiuk great ! Thanks so much for the detailed documentation. I am all set ! Btw, your PR pretty much closes #14346 in my mind.

[potiuk]

Cool. Now I need just an approve from another committer :). Anyone?

[jedcunningham]

Overall looks good, it makes sense as it is written now 👍

[github-actions]

The PR is likely ready to be merged. No tests are needed as no important environment files, nor python files were modified by it. However, committers might decide that full test matrix is needed and add the 'full tests needed' label. Then you should rebase it to the latest main or amend the last commit of the PR, and push it with --force-with-lease.

[github-actions]

The PR is likely ready to be merged. No tests are needed as no important environment files, nor python files were modified by it. However, committers might decide that full test matrix is needed and add the 'full tests needed' label. Then you should rebase it to the latest main or amend the last commit of the PR, and push it with --force-with-lease.