xnatworks/xnat-web:1.10.0 cannot run with capabilities dropped

[johnflavin]

The entrypoint in the current 1.10.0 docker image (sha256:f9f21673e0b854a424c2b4fd6cf9dec00b3ea3339def82e0017f517cbc9e3adb) has 744 perms and is not executable by any user but root.

$ docker run --rm --entrypoint ls xnatworks/xnat-web:1.10.0 -l /usr/local/bin/entrypoint.sh
-rwxr--r-- 1 root root 190 Oct 18  2024 /usr/local/bin/entrypoint.sh

If the image is started with a non-root user and all capabilities dropped (which is good security posture) the entrypoint cannot start.

$ docker run --rm --user 1000 --cap-drop ALL xnatworks/xnat-web:1.10.0
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: exec: "/usr/local/bin/entrypoint.sh": permission denied: unknown

[johnflavin]

Update: The image also has problems starting as root with capabilities dropped. I tried this as an initial workaround for 👆🏼 , since root is able to execute the entrypoint. But this causes XNAT to fail to start with a permissions error trying to write to /data/xnat/home/work which is owned by tomcat. Without CAP_DAC_OVERRIDE root can't write to directories it doesn't own.

[kathrynalpert]

#18 fixes the underlying non-root/caps-dropped problem in the source, so future ghcr.io/nrgxnat/xnat builds will not exhibit this issue. This does not fix the published 1.10.0 image the issue is filed against - up to you if you want to close this or hold off for a new 1.10.0 image.

[johnflavin]

IMO wait for the next image to be published before we close. But I don’t know if we need to replace the 1.10.0 image, can just publish a 1.10.1 or whatever with all the new stuff.