Hey,
having in mind docker images for e.g. python, ruby, nodejs and some application written in those languages/frameworks already inside the docker (basically those where there is no specific user to be used like for daemons for example) -- the application may either run as root or non-root user (non-root should be preferred way, right?)
For cases we need such a user, this user must have expected HOME, UID and GID to be possible to match on host, so after inspiring in the openshift base image (but not copied everything), what about:
ENV HOME /home/default RUN mkdir -p ${HOME} && \ groupadd -r default -f -g 333 && \ useradd -u 333 -r -g default -d ${HOME} -s /sbin/nologin \ -c "Default Application User" default
Home directory is first problem. May it be something in /home? Or rather take that user similar to users for daemons and use something like /var/lib/container-home?
Then, what the UID and GID should be?
Picking one from <1000 would disable this user from some operations, that check MIN_UID explicitly to behave differently, but maybe it makes sense -- we can take that user as a special one, not ordinary one; personally the preferred way.
Picking one from >1000 could provide conflicts on host in case the same already exists there.
Any ideas?
Honza
We touched this problem on today's meeting, but not found the final solutions yet, the log may be worth reading though: http://meetbot.fedoraproject.org/fedora-meeting-2/2015-04-23/env-and-stacks....
Honza
On 04/22/2015 07:22 PM, Honza Horak wrote:
Hey,
having in mind docker images for e.g. python, ruby, nodejs and some application written in those languages/frameworks already inside the docker (basically those where there is no specific user to be used like for daemons for example) -- the application may either run as root or non-root user (non-root should be preferred way, right?)
For cases we need such a user, this user must have expected HOME, UID and GID to be possible to match on host, so after inspiring in the openshift base image (but not copied everything), what about:
ENV HOME /home/default RUN mkdir -p ${HOME} && \ groupadd -r default -f -g 333 && \ useradd -u 333 -r -g default -d ${HOME} -s /sbin/nologin \ -c "Default Application User" default
Home directory is first problem. May it be something in /home? Or rather take that user similar to users for daemons and use something like /var/lib/container-home?
Then, what the UID and GID should be?
Picking one from <1000 would disable this user from some operations, that check MIN_UID explicitly to behave differently, but maybe it makes sense -- we can take that user as a special one, not ordinary one; personally the preferred way.
Picking one from >1000 could provide conflicts on host in case the same already exists there.
Any ideas?
Honza _______________________________________________ env-and-stacks mailing list env-and-stacks@lists.fedoraproject.org https://lists.fedoraproject.org/mailman/listinfo/env-and-stacks
----- Original Message -----
From: "Honza Horak" hhorak@redhat.com To: env-and-stacks@lists.fedoraproject.org Sent: Thursday, April 23, 2015 11:10:26 AM Subject: Re: default user inside container?
We touched this problem on today's meeting, but not found the final solutions yet, the log may be worth reading though: http://meetbot.fedoraproject.org/fedora-meeting-2/2015-04-23/env-and-stacks....
Honza
On 04/22/2015 07:22 PM, Honza Horak wrote:
Hey,
having in mind docker images for e.g. python, ruby, nodejs and some application written in those languages/frameworks already inside the docker (basically those where there is no specific user to be used like for daemons for example) -- the application may either run as root or non-root user (non-root should be preferred way, right?)
For cases we need such a user, this user must have expected HOME, UID and GID to be possible to match on host, so after inspiring in the openshift base image (but not copied everything), what about:
ENV HOME /home/default RUN mkdir -p ${HOME} && \ groupadd -r default -f -g 333 && \ useradd -u 333 -r -g default -d ${HOME} -s /sbin/nologin \ -c "Default Application User" default
Home directory is first problem. May it be something in /home? Or rather take that user similar to users for daemons and use something like /var/lib/container-home?
Then, what the UID and GID should be?
Picking one from <1000 would disable this user from some operations, that check MIN_UID explicitly to behave differently, but maybe it makes sense -- we can take that user as a special one, not ordinary one; personally the preferred way.
Picking one from >1000 could provide conflicts on host in case the same already exists there.
For OpenShift we are planning to make the images we provide out of the box tolerate running as any uid. This is necessary to ensure that volume mounted filesystems (eg NFS mounts for persistent storage) can be setup with appropriate security while being read by the container that mounts them.
For now this means making certain paths either world RW, or assigning a particular group (of which everyone is a member) RW access.
You can see our first implementation for mysql here: https://github.com/csrwng/mysql/commit/ccefa0cb9f5398e3aae01c22ad970b26dcff3...
Any ideas?
Honza _______________________________________________ env-and-stacks mailing list env-and-stacks@lists.fedoraproject.org https://lists.fedoraproject.org/mailman/listinfo/env-and-stacks
env-and-stacks mailing list env-and-stacks@lists.fedoraproject.org https://lists.fedoraproject.org/mailman/listinfo/env-and-stacks
env-and-stacks@lists.fedoraproject.org