Really run as non-root user in docker container
As of now, $ docker pull ipfs/go-ipfs Using default tag: latest latest: Pulling from ipfs/go-ipfs Digest: sha256:31cc5713ef3e3e81bf868cbb56c19de2d15d661743d8b6077804dee26e929ac5 Status: Image is up to date for ipfs/go-ipfs:latest ipfs daemon will start as root user: $ docker run --rm --entrypoint=/bin/sh ipfs/go-ipfs -c whoami root but later on will drop priviledges: $ docker logs ipfs/go-ipfs |head -n 1 Changing user to ipfs With this change applied, ipfs daemon starts as ipfs user right from the begining: $ docker run --rm --entrypoint=/bin/sh ipfs/go-ipfs -c whoami ipfs License: MIT Signed-off-by: Mykola Nikishov <mn@mn.com.ua>
Mykola Nikishov committed
May 30, 2018 at 15:12 UTC
5b2e305fef32896570aa017bbe0ed356a312f3c6
2 files changed
+9
-2
Dockerfile
+4
-1
@@ -60,12 +60,15 @@ EXPOSE 8080
60
# Swarm Websockets; must be exposed publicly when the node is listening using the websocket transport (/ipX/.../tcp/8081/ws).
61
EXPOSE 8081
62
63
-# Create the fs-repo directory and switch to a non-privileged user.
63
+# Create the fs-repo directory
64
ENV IPFS_PATH /data/ipfs
65
RUN mkdir -p $IPFS_PATH \
66
&& adduser -D -h $IPFS_PATH -u 1000 -G users ipfs \
67
&& chown ipfs:users $IPFS_PATH
68
69
+# Switch to a non-privileged user
70
+USER ipfs
71
+
72
# Expose the fs-repo as a volume.
73
# start_ipfs initializes an fs-repo if none is mounted.
74
# Important this happens after the USER directive so permission are correct.
Dockerfile.fast
+5
-1
@@ -53,14 +53,18 @@ EXPOSE 5001
53
EXPOSE 8080
54
EXPOSE 8081
55
56
-# Create the fs-repo directory and switch to a non-privileged user.
56
+# Create the fs-repo directory
57
ENV IPFS_PATH /data/ipfs
58
RUN mkdir -p $IPFS_PATH \
59
&& useradd -s /usr/sbin/nologin -d $IPFS_PATH -u 1000 -G users ipfs \
60
&& chown ipfs:users $IPFS_PATH
61
62
+# Switch to a non-privileged user
63
+USER ipfs
64
+
65
# Expose the fs-repo as a volume.
66
# start_ipfs initializes an fs-repo if none is mounted.
67
+# Important this happens after the USER directive so permission are correct.
68
VOLUME $IPFS_PATH
69
70
# The default logging level