Better support running the Docker entrypoint code as a non-root user. (#15118)
* Better support running our Docker images without root in the container. Users can override what user ID is used inside of a container when creating the container. We don’t technically properly support this, but we should also ideally not _break_ such usage either as there are legitimate use-cases for it. This moves code that will only work when run as root inside the container inside a conditional in our entrypoint script so that it doesn’t break things otherwise. * Update Docker documentation. * Include all group manipulations in the EUID == 0 case.
Austin S. Hemmelgarn committed
Jan 19, 2024 at 07:00 UTC
12c986d745671582a606f7ac3aaf8eec15483679
2 files changed
+67
-54
packaging/docker/README.md
+10
@@ -12,6 +12,16 @@ import TabItem from '@theme/TabItem';
12
13
# Install Netdata with Docker
14
15
+## Limitations running the Agent in Docker
16
+
17
+We do not officially support running our Docker images with the Docker CLI `--user` option or the Docker Compose
18
+`user:` parameter. Such usage will usually still work, but some features will not be available when run this
19
+way. Note that the agent will drop privileges appropriately inside the container during startup, meaning that even
20
+when run without these options almost nothing in the container will actually run with an effective UID of 0.
21
+
22
+Our POWER8+ Docker images do not support our FreeIPMI collector. This is a technical limitation in FreeIPMI itself,
23
+and unfortunately not something we can realistically work around.
24
+
25
## Create a new Netdata Agent container
26
27
You can create a new Agent container using either `docker run` or `docker-compose`. After using any method, you can
packaging/docker/run.sh
+57
-54
@@ -14,38 +14,6 @@ if [ ! -w / ] && [ "${EUID}" -eq 0 ]; then
14
echo >&2 "WARNING: For more information, see https://learn.netdata.cloud/docs/agent/claim#known-issues-on-older-hosts-with-seccomp-enabled"
15
fi
16
17
-if [ ! "${DISABLE_TELEMETRY:-0}" -eq 0 ] ||
18
- [ -n "$DISABLE_TELEMETRY" ] ||
19
- [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] ||
20
- [ -n "$DO_NOT_TRACK" ]; then
21
- touch /etc/netdata/.opt-out-from-anonymous-statistics
22
-fi
23
-
24
-chmod o+rX / 2>/dev/null || echo "Unable to change permissions without errors."
25
-
26
-BALENA_PGID=$(stat -c %g /var/run/balena.sock 2>/dev/null || true)
27
-DOCKER_PGID=$(stat -c %g /var/run/docker.sock 2>/dev/null || true)
28
-
29
-re='^[0-9]+$'
30
-if [[ $BALENA_PGID =~ $re ]]; then
31
- echo "Netdata detected balena-engine.sock"
32
- DOCKER_HOST='/var/run/balena-engine.sock'
33
- PGID="$BALENA_PGID"
34
-elif [[ $DOCKER_PGID =~ $re ]]; then
35
- echo "Netdata detected docker.sock"
36
- DOCKER_HOST="/var/run/docker.sock"
37
- PGID="$DOCKER_PGID"
38
-fi
39
-export PGID
40
-export DOCKER_HOST
41
-
42
-if [ -n "${PGID}" ]; then
43
- echo "Creating docker group ${PGID}"
44
- addgroup --gid "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
45
- echo "Assign netdata user to docker group ${PGID}"
46
- usermod --append --groups "docker" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
47
-fi
48
-
17
# Needed to read Proxmox VMs and (LXC) containers configuration files (name resolution + CPU and memory limits)
18
function add_netdata_to_proxmox_conf_files_group() {
19
group_guid="$(stat -c %g /host/etc/pve 2>/dev/null || true)"
@@ -68,10 +36,65 @@ function add_netdata_to_proxmox_conf_files_group() {
36
fi
37
}
38
71
-if [ -d "/host/etc/pve" ]; then
72
- add_netdata_to_proxmox_conf_files_group || true
39
+if [ ! "${DISABLE_TELEMETRY:-0}" -eq 0 ] ||
40
+ [ -n "$DISABLE_TELEMETRY" ] ||
41
+ [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] ||
42
+ [ -n "$DO_NOT_TRACK" ]; then
43
+ touch /etc/netdata/.opt-out-from-anonymous-statistics
44
fi
45
46
+chmod o+rX / 2>/dev/null || echo "Unable to change permissions without errors."
47
+
48
+if [ "${EUID}" -eq 0 ]; then
49
+ if [ -n "${NETDATA_EXTRA_APK_PACKAGES}" ]; then
50
+ echo >&2 "WARNING: Netdata’s Docker images have switched from Alpine to Debian as a base platform. Supplementary package support is now handled through the NETDATA_EXTRA_DEB_PACKAGES variable instead of NETDATA_EXTRA_APK_PACKAGES."
51
+ echo >&2 "WARNING: The container will still run, but supplementary packages listed in NETDATA_EXTRA_APK_PACKAGES will not be installed."
52
+ echo >&2 "WARNING: To remove these messages, either undefine NETDATA_EXTRA_APK_PACKAGES, or define it to an empty string."
53
+ fi
54
+
55
+ if [ -n "${NETDATA_EXTRA_DEB_PACKAGES}" ]; then
56
+ echo "Fetching APT repository metadata."
57
+ if ! apt-get update; then
58
+ echo "Failed to fetch APT repository metadata."
59
+ else
60
+ echo "Installing supplementary packages."
61
+ export DEBIAN_FRONTEND="noninteractive"
62
+ # shellcheck disable=SC2086
63
+ if ! apt-get install -y --no-install-recommends ${NETDATA_EXTRA_DEB_PACKAGES}; then
64
+ echo "Failed to install supplementary packages."
65
+ fi
66
+ fi
67
+ fi
68
+
69
+ BALENA_PGID=$(stat -c %g /var/run/balena.sock 2>/dev/null || true)
70
+ DOCKER_PGID=$(stat -c %g /var/run/docker.sock 2>/dev/null || true)
71
+
72
+ re='^[0-9]+$'
73
+ if [[ $BALENA_PGID =~ $re ]]; then
74
+ echo "Netdata detected balena-engine.sock"
75
+ DOCKER_HOST='/var/run/balena-engine.sock'
76
+ PGID="$BALENA_PGID"
77
+ elif [[ $DOCKER_PGID =~ $re ]]; then
78
+ echo "Netdata detected docker.sock"
79
+ DOCKER_HOST="/var/run/docker.sock"
80
+ PGID="$DOCKER_PGID"
81
+ fi
82
+ export PGID
83
+ export DOCKER_HOST
84
+
85
+ if [ -n "${PGID}" ]; then
86
+ echo "Creating docker group ${PGID}"
87
+ addgroup --gid "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
88
+ echo "Assign netdata user to docker group ${PGID}"
89
+ usermod --append --groups "docker" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
90
+ fi
91
+
92
+ if [ -d "/host/etc/pve" ]; then
93
+ add_netdata_to_proxmox_conf_files_group || true
94
+ fi
95
+else
96
+ echo >&2 "WARNING: Entrypoint started as non-root user. This is not officially supported and some features may not be available."
97
+fi
98
99
if mountpoint -q /etc/netdata; then
100
echo "Copying stock configuration to /etc/netdata"
@@ -97,24 +120,4 @@ if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /v
120
-daemon-not-running
121
fi
122
100
-if [ -n "${NETDATA_EXTRA_APK_PACKAGES}" ]; then
101
- echo >&2 "WARNING: Netdata’s Docker images have switched from Alpine to Debian as a base platform. Supplementary package support is now handled through the NETDATA_EXTRA_DEB_PACKAGES variable instead of NETDATA_EXTRA_APK_PACKAGES."
102
- echo >&2 "WARNING: The container will still run, but supplementary packages listed in NETDATA_EXTRA_APK_PACKAGES will not be installed."
103
- echo >&2 "WARNING: To remove these messages, either undefine NETDATA_EXTRA_APK_PACKAGES, or define it to an empty string."
104
-fi
105
-
106
-if [ -n "${NETDATA_EXTRA_DEB_PACKAGES}" ]; then
107
- echo "Fetching APT repository metadata."
108
- if ! apt-get update; then
109
- echo "Failed to fetch APT repository metadata."
110
- else
111
- echo "Installing supplementary packages."
112
- export DEBIAN_FRONTEND="noninteractive"
113
- # shellcheck disable=SC2086
114
- if ! apt-get install -y --no-install-recommends ${NETDATA_EXTRA_DEB_PACKAGES}; then
115
- echo "Failed to install supplementary packages."
116
- fi
117
- fi
118
-fi
119
-
123
exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_LISTENER_PORT}" "$@"