Make the docker image to run as arbitrary user (#6543)
In container runtime with arbitrary user (e.g. Openshift) there are permission problems when trying to start
Chris committed
Dec 18, 2019 at 14:01 UTC
27c58418e4c7df3420885ba5bc56b167f5f78702
2 files changed
+16
-8
packaging/docker/Dockerfile
+15
-7
@@ -74,13 +74,21 @@ RUN \
74
addgroup -g ${NETDATA_GID} -S "${DOCKER_GRP}" && \
75
adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}" && \
76
# Apply the permissions as described in
77
- # https://github.com/netdata/netdata/wiki/netdata-security#netdata-directories
78
- chown -R root:netdata /etc/netdata && \
79
- chown -R netdata:netdata /var/cache/netdata /var/lib/netdata /usr/share/netdata && \
80
- chown -R root:netdata /usr/lib/netdata && \
81
- chown -R root:netdata /usr/libexec/netdata/ && \
82
- chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network /usr/libexec/netdata/plugins.d/apps.plugin && \
83
- chmod 0750 /var/lib/netdata /var/cache/netdata && \
77
+ # https://docs.netdata.cloud/docs/netdata-security/#netdata-directories, but own everything by root group due to https://github.com/netdata/netdata/pull/6543
78
+ chown -R root:root \
79
+ /etc/netdata \
80
+ /usr/share/netdata \
81
+ /usr/libexec/netdata && \
82
+ chown -R netdata:root \
83
+ /usr/lib/netdata \
84
+ /var/cache/netdata \
85
+ /var/lib/netdata \
86
+ /var/log/netdata && \
87
+ chmod 0755 /usr/libexec/netdata/plugins.d/*.plugin && \
88
+ chmod 4755 /usr/libexec/netdata/plugins.d/cgroup-network /usr/libexec/netdata/plugins.d/apps.plugin && \
89
+ # Group write permissions due to: https://github.com/netdata/netdata/pull/6543chmod 0770 -R /var/lib/netdata /var/cache/netdata && \
90
+ find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
91
+ find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
92
# Link log files to stdout
93
ln -sf /dev/stdout /var/log/netdata/access.log && \
94
ln -sf /dev/stdout /var/log/netdata/debug.log && \
packaging/docker/run.sh
+1
-1
@@ -20,6 +20,6 @@ if [ -n "${PGID}" ]; then
20
usermod -a -G ${PGID} ${DOCKER_USR} || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
21
fi
22
23
-exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_PORT}" "$@"
23
+exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"
24
25
echo "Netdata entrypoint script, completed!"