Revert "Add support for runtime configuration of UID/GID for Netdata user. (#10683)" (#11495)
This reverts commit 1da4bd8b7df24b46653e12cbd9e289346407dcd7.
Austin S. Hemmelgarn committed
Sep 9, 2021 at 06:03 UTC
538ba0a2e5befe6c3f51f60f667268e342226ad4
3 files changed
+26
-93
packaging/docker/Dockerfile
+23
-12
@@ -60,14 +60,24 @@ FROM netdata/base:latest as base
60
# Configure system
61
ARG NETDATA_UID=201
62
ARG NETDATA_GID=201
63
-ARG NETDATA_USER=netdata
64
-
65
-ENV NETDATA_UID=$NETDATA_UID
66
-ENV NETDATA_GID=$NETDATA_GID
67
-ENV NETDATA_USER=$NETDATA_USER
63
+ENV DOCKER_GRP netdata
64
+ENV DOCKER_USR netdata
65
# If DO_NOT_TRACK is set, it will disable anonymous stats collection and reporting
66
#ENV DO_NOT_TRACK=1
67
68
+# Copy files over
69
+RUN mkdir -p /opt/src /var/log/netdata && \
70
+ # Link log files to stdout
71
+ ln -sf /dev/stdout /var/log/netdata/access.log && \
72
+ ln -sf /dev/stdout /var/log/netdata/debug.log && \
73
+ ln -sf /dev/stderr /var/log/netdata/error.log && \
74
+ # fping from alpine apk is on a different location. Moving it.
75
+ ln -snf /usr/sbin/fping /usr/local/bin/fping && \
76
+ chmod 4755 /usr/local/bin/fping && \
77
+ # Add netdata user
78
+ addgroup -g ${NETDATA_GID} -S "${DOCKER_GRP}" && \
79
+ adduser -S -H -s /usr/sbin/nologin -u ${NETDATA_GID} -h /etc/netdata -G "${DOCKER_GRP}" "${DOCKER_USR}"
80
+
81
# Long-term this should leverage BuildKit’s mount option.
82
COPY --from=builder /wheels /wheels
83
COPY --from=builder /app /
@@ -79,22 +89,23 @@ RUN chown -R root:root \
89
/etc/netdata \
90
/usr/share/netdata \
91
/usr/libexec/netdata && \
82
- mkdir -p /opt/src /var/log/netdata && \
83
- ln -sf /dev/stdout /var/log/netdata/access.log && \
84
- ln -sf /dev/stdout /var/log/netdata/debug.log && \
85
- ln -sf /dev/stderr /var/log/netdata/error.log && \
92
+ chown -R netdata:root \
93
+ /usr/lib/netdata \
94
+ /var/cache/netdata \
95
+ /var/lib/netdata \
96
+ /var/log/netdata && \
97
+ chown -R netdata:netdata /var/lib/netdata/cloud.d && \
98
chmod 0700 /var/lib/netdata/cloud.d && \
99
chmod 0755 /usr/libexec/netdata/plugins.d/*.plugin && \
100
chmod 4755 \
101
/usr/libexec/netdata/plugins.d/cgroup-network \
102
/usr/libexec/netdata/plugins.d/apps.plugin \
103
/usr/libexec/netdata/plugins.d/freeipmi.plugin && \
104
+ # Group write permissions due to: https://github.com/netdata/netdata/pull/6543
105
find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
106
find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
107
pip --no-cache-dir install /wheels/* && \
95
- rm -rf /wheels && \
96
- ln -snf /usr/sbin/fping /usr/local/bin/fping && \
97
- chmod 4755 /usr/local/bin/fping
108
+ rm -rf /wheels
109
110
ENV NETDATA_LISTENER_PORT 19999
111
EXPOSE $NETDATA_LISTENER_PORT
packaging/docker/README.md
-6
@@ -246,12 +246,6 @@ If you don't want to destroy and recreate your container, you can edit the Agent
246
above section on [configuring Agent containers](#configure-agent-containers) to find the appropriate method based on
247
how you created the container.
248
249
-### Custom agent UID/GID
250
-
251
-By default, Netdata in the container will run with a user ID and group ID of `201`, matching the default IDs used
252
-on normal installations of Netdata. In the unlikely event that you need to use a different UID or GID for netdata,
253
-set the `NETDATA_UID` and/or `NETDATA_GID` environment variables for the container to the desired UID/GID.
254
-
249
### Add or remove other volumes
250
251
Some of the volumes are optional depending on how you use Netdata:
packaging/docker/run.sh
+3
-75
@@ -13,6 +13,7 @@ if [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] || [ -n "$DO_NOT_TRACK" ]; then
13
touch /etc/netdata/.opt-out-from-anonymous-statistics
14
fi
15
16
+
17
BALENA_PGID=$(ls -nd /var/run/balena.sock | awk '{print $4}')
18
DOCKER_PGID=$(ls -nd /var/run/docker.sock | awk '{print $4}')
19
@@ -26,87 +27,14 @@ elif [[ $DOCKER_PGID =~ $re ]]; then
27
DOCKER_HOST="/var/run/docker.sock"
28
PGID=$(ls -nd /var/run/docker.sock | awk '{print $4}')
29
fi
29
-
30
export PGID
31
export DOCKER_HOST
32
33
-create_group=
34
-remove_group=
35
-create_user=
36
-remove_user=
37
-user_in_group=
38
-
39
-if [ -n "${DOCKER_USR}" ]; then
40
- NETDATA_USER="${DOCKER_USR}"
41
-fi
42
-
43
-if [ -w /etc/passwd ] && [ -w /etc/group ] && [ -w /etc/shadow ] && [ -w /etc/gshadow ] ; then
44
- if getent group netdata > /dev/null; then
45
- existing_gid="$(getent group netdata | cut -d ':' -f 3)"
46
-
47
- if [ "${existing_gid}" != "${NETDATA_GID}" ]; then
48
- echo "Netdata group ID mismatch (expected ${NETDATA_GID} but found ${existing_gid}), the existing group will be replaced."
49
- remove_group=1
50
- create_group=1
51
- fi
52
- else
53
- echo "Netdata group not found, preparing to create one with GID=${NETDATA_GID}."
54
- create_group=1
55
- fi
56
-
57
- if [ -n "${remove_group}" ]; then
58
- delgroup netdata netdata
59
- delgroup netdata || exit 1
60
- fi
61
-
62
- if [ -n "${create_group}" ]; then
63
- addgroup -g "${NETDATA_GID}" -S netdata || exit 1
64
- fi
65
-
66
- if [ "${NETDATA_USER}" = "netdata" ]; then
67
- if getent passwd netdata > /dev/null; then
68
- existing_user="$(getent passwd netdata)"
69
- existing_uid="$(echo "${existing_user}" | cut -d ':' -f 3)"
70
- existing_primary_gid="$(echo "${existing_user}" | cut -d ':' -f 4)"
71
-
72
- if [ "${existing_gid}" != "${NETDATA_UID}" ]; then
73
- echo "Netdata user ID mismatch (expected ${NETDATA_UID} but found ${existing_uid}), the existing user will be replaced."
74
- remove_user=1
75
- create_user=1
76
- fi
77
-
78
- if [ "${existing_primary_gid}" = "${NETDATA_GID}" ]; then
79
- user_in_group=1
80
- else
81
- echo "Netdata user is not in the correct primary group (expected ${NETDATA_GID} but found ${existing_primary_gid}), the user will be updated."
82
- fi
83
- else
84
- echo "Netdata user not found, preparing to create one with UID=${NETDATA_UID}."
85
- create_user=1
86
- fi
87
-
88
- if [ -n "${remove_user}" ]; then
89
- userdel netdata || exit 1
90
- fi
91
-
92
- if [ -n "${create_user}" ]; then
93
- adduser -S -H -s /usr/sbin/nologin -u "${NETDATA_UID}" -h /etc/netdata -G netdata netdata
94
- elif [ -z "${user_in_group}" ]; then
95
- usermod -a -G netdata netdata
96
- fi
97
- fi
98
-else
99
- echo "Account databases are not writable, assuming you know what you’re doing and continuing."
100
-fi
101
-
102
-chown -R "${NETDATA_USER}:root" /usr/lib/netdata /var/cache/netdata /var/lib/netdata /var/log/netdata
103
-chown -R "${NETDATA_USER}:netdata" /var/lib/netdata/cloud.d
104
-
33
if [ -n "${PGID}" ]; then
34
echo "Creating docker group ${PGID}"
35
addgroup -g "${PGID}" "docker" || echo >&2 "Could not add group docker with ID ${PGID}, its already there probably"
36
echo "Assign netdata user to docker group ${PGID}"
109
- usermod -a -G "${PGID}" "${NETDATA_USER}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
37
+ usermod -a -G "${PGID}" "${DOCKER_USR}" || echo >&2 "Could not add netdata user to group docker with ID ${PGID}"
38
fi
39
40
if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /var/lib/netdata/cloud.d/claimed_id ]; then
@@ -117,4 +45,4 @@ if [ -n "${NETDATA_CLAIM_URL}" ] && [ -n "${NETDATA_CLAIM_TOKEN}" ] && [ ! -f /v
45
-daemon-not-running
46
fi
47
120
-exec /usr/sbin/netdata -u "${NETDATA_USER}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"
48
+exec /usr/sbin/netdata -u "${DOCKER_USR}" -D -s /host -p "${NETDATA_LISTENER_PORT}" -W set web "web files group" root -W set web "web files owner" root "$@"