Add support for runtime configuration of UID/GID for Netdata user. (#10683)
* Add support for runtime configuration of UID/GID for Netdata user. * Consolidate layers in Docker image. * Re-add proper username selection handling. * Unconditionally handle the netdata group. Instead of having it be dependent on the name of the user. * Docs cleanup * Only try to change accounts if daabases are writable.
Austin S. Hemmelgarn committed
Sep 8, 2021 at 06:26 UTC
1da4bd8b7df24b46653e12cbd9e289346407dcd7
3 files changed
+93
-26
packaging/docker/Dockerfile
+12
-23
@@ -60,24 +60,14 @@ FROM netdata/base:latest as base
60
# Configure system
61
ARG NETDATA_UID=201
62
ARG NETDATA_GID=201
63
-ENV DOCKER_GRP netdata
64
-ENV DOCKER_USR netdata
63
+ARG NETDATA_USER=netdata
64
+
65
+ENV NETDATA_UID=$NETDATA_UID
66
+ENV NETDATA_GID=$NETDATA_GID
67
+ENV NETDATA_USER=$NETDATA_USER
68
# If DO_NOT_TRACK is set, it will disable anonymous stats collection and reporting
69
#ENV DO_NOT_TRACK=1
70
68
-# Copy files over
69
-RUN mkdir -p /opt/src /var/log/netdata && \
70
- # Link log files to stdout
71
- ln -sf /dev/stdout /var/log/netdata/access.log && \
72
- ln -sf /dev/stdout /var/log/netdata/debug.log && \
73
- ln -sf /dev/stderr /var/log/netdata/error.log && \
74
- # fping from alpine apk is on a different location. Moving it.
75
- ln -snf /usr/sbin/fping /usr/local/bin/fping && \
76
- chmod 4755 /usr/local/bin/fping && \
77
- # Add netdata user
78
- addgroup -g ${NETDATA_GID} -S "${DOCKER_GRP}" && \
79
- adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}"
80
-
71
# Long-term this should leverage BuildKit’s mount option.
72
COPY --from=builder /wheels /wheels
73
COPY --from=builder /app /
@@ -89,23 +79,22 @@ RUN chown -R root:root \
79
/etc/netdata \
80
/usr/share/netdata \
81
/usr/libexec/netdata && \
92
- chown -R netdata:root \
93
- /usr/lib/netdata \
94
- /var/cache/netdata \
95
- /var/lib/netdata \
96
- /var/log/netdata && \
97
- chown -R netdata:netdata /var/lib/netdata/cloud.d && \
82
+ mkdir -p /opt/src /var/log/netdata && \
83
+ ln -sf /dev/stdout /var/log/netdata/access.log && \
84
+ ln -sf /dev/stdout /var/log/netdata/debug.log && \
85
+ ln -sf /dev/stderr /var/log/netdata/error.log && \
86
chmod 0700 /var/lib/netdata/cloud.d && \
87
chmod 0755 /usr/libexec/netdata/plugins.d/*.plugin && \
88
chmod 4755 \
89
/usr/libexec/netdata/plugins.d/cgroup-network \
90
/usr/libexec/netdata/plugins.d/apps.plugin \
91
/usr/libexec/netdata/plugins.d/freeipmi.plugin && \
104
- # Group write permissions due to: https://github.com/netdata/netdata/pull/6543
92
find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
93
find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
94
pip --no-cache-dir install /wheels/* && \
108
- rm -rf /wheels
95
+ rm -rf /wheels && \
96
+ ln -snf /usr/sbin/fping /usr/local/bin/fping && \
97
+ chmod 4755 /usr/local/bin/fping
98
99
ENV NETDATA_LISTENER_PORT 19999
100
EXPOSE $NETDATA_LISTENER_PORT
packaging/docker/README.md
+6
@@ -246,6 +246,12 @@ If you don't want to destroy and recreate your container, you can edit the Agent
246
above section on [configuring Agent containers](#configure-agent-containers) to find the appropriate method based on
247
how you created the container.
248
249
+### Custom agent UID/GID
250
+
251
+By default, Netdata in the container will run with a user ID and group ID of `201`, matching the default IDs used
252
+on normal installations of Netdata. In the unlikely event that you need to use a different UID or GID for netdata,
253
+set the `NETDATA_UID` and/or `NETDATA_GID` environment variables for the container to the desired UID/GID.
254
+
255
### Add or remove other volumes
256
257
Some of the volumes are optional depending on how you use Netdata:
packaging/docker/run.sh
+75
-3
@@ -13,7 +13,6 @@ if [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] || [ -n "$DO_NOT_TRACK" ]; then
13
touch /etc/netdata/.opt-out-from-anonymous-statistics
14
fi
15
16
-
16
BALENA_PGID=$(ls -nd /var/run/balena.sock | awk '{print $4}')
17
DOCKER_PGID=$(ls -nd /var/run/docker.sock | awk '{print $4}')
18
@@ -27,14 +26,87 @@ elif [[ $DOCKER_PGID =~ $re ]]; then
26
DOCKER_HOST="/var/run/docker.sock"
27
PGID=$(ls -nd /var/run/docker.sock | awk '{print $4}')
28
fi
29
+
30
export PGID
31
export DOCKER_HOST
32
33
+create_group=
34
+remove_group=
35
+create_user=
36
+remove_user=
37
+user_in_group=
38
+
39
+if [ -n "${DOCKER_USR}" ]; then
40
+ NETDATA_USER="${DOCKER_USR}"
41
+fi
42
+
43
+if [ -w /etc/passwd ] && [ -w /etc/group ] && [ -w /etc/shadow ] && [ -w /etc/gshadow ] ; then
44
+ if getent group netdata > /dev/null; then
45
+ existing_gid="$(getent group netdata | cut -d ':' -f 3)"
46
+
47
+ if [ "${existing_gid}" != "${NETDATA_GID}" ]; then
48
+ echo "Netdata group ID mismatch (expected ${NETDATA_GID} but found ${existing_gid}), the existing group will be replaced."
49
+ remove_group=1
50
+ create_group=1
51
+ fi
52
+ else
53
+ echo "Netdata group not found, preparing to create one with GID=${NETDATA_GID}."
54
+ create_group=1
55
+ fi
56
+
57
+ if [ -n "${remove_group}" ]; then
58
+ delgroup netdata netdata
59
+ delgroup netdata || exit 1
60
+ fi
61
+
62
+ if [ -n "${create_group}" ]; then
63
+ addgroup -g "${NETDATA_GID}" -S netdata || exit 1
64
+ fi
65
+
66
+ if [ "${NETDATA_USER}" = "netdata" ]; then
67
+ if getent passwd netdata > /dev/null; then
68
+ existing_user="$(getent passwd netdata)"
69
+ existing_uid="$(echo "${existing_user}" | cut -d ':' -f 3)"
70
+ existing_primary_gid="$(echo "${existing_user}" | cut -d ':' -f 4)"
71
+
72
+ if [ "${existing_gid}" != "${NETDATA_UID}" ]; then
73
+ echo "Netdata user ID mismatch (expected ${NETDATA_UID} but found ${existing_uid}), the existing user will be replaced."
74
+ remove_user=1
75
+ create_user=1
76
+ fi
77
+
78
+ if [ "${existing_primary_gid}" = "${NETDATA_GID}" ]; then
79
+ user_in_group=1
80
+ else
81
+ echo "Netdata user is not in the correct primary group (expected ${NETDATA_GID} but found ${existing_primary_gid}), the user will be updated."
82
+ fi
83
+ else
84
+ echo "Netdata user not found, preparing to create one with UID=${NETDATA_UID}."
85
+ create_user=1
86
+ fi
87
+
88
+ if [ -n "${remove_user}" ]; then
89
+ userdel netdata || exit 1
90
+ fi
91
+
92
+ if [ -n "${create_user}" ]; then
93
+ adduser -S -H -s /usr/sbin/nologin -u "${NETDATA_UID}" -h /etc/netdata -G netdata netdata
94
+ elif [ -z "${user_in_group}" ]; then
95
+ usermod -a -G netdata netdata
96
+ fi
97
+ fi
98
+else
99
+ echo "Account databases are not writable, assuming you know what you’re doing and continuing."
100
+fi
101
+
102
+chown -R "${NETDATA_USER}:root" /usr/lib/netdata /var/cache/netdata /var/lib/netdata /var/log/netdata
103
+chown -R "${NETDATA_USER}:netdata" /var/lib/netdata/cloud.d
104
+
105
if [ -n "${PGID}" ]; then
106
echo "Creating docker group ${PGID}"
107
addgroup -g "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
108
echo "Assign netdata user to docker group ${PGID}"
37
- usermod -a -G "${PGID}" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
109
+ usermod -a -G "${PGID}" "${NETDATA_USER}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
110
fi
111
112
if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /var/lib/netdata/cloud.d/claimed_id ]; then
@@ -45,4 +117,4 @@ if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /v
117
-daemon-not-running
118
fi
119
48
-exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"
120
+exec /usr/sbin/netdata -u "${NETDATA_USER}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"