Allow non-root server startup - #60
Open
Araeos wants to merge 2 commits into
Open
Conversation
The default requires non-root start, which can be disabled by setting RUN_AS_ROOT=true
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The image currently assumes it is started as root. Because of this, running it with Docker's -u option fails before the server can start.
At the same time, PUID and PGID are available as configuration options, but they don't control the user running the server. They are only used when handling some downloaded files. The Java server itself is still always run as root.
I can't speak for everyone, but I don't give my network services unnecessary root permissions.
Expected behavior
The container should be able to start directly as any user, for example:
docker run -u 1001:1001 ...The server should then run as UID 1001 / GID 1001.
The user is responsible for making sure the storage locations are writable by that user. This ensures that privileged access is never used incorrectly/malicously
Actual behavior
Starting the container with a specific non-root user currently fails because the entrypoint expects root access.
When started normally, the entrypoint runs the Java server as root regardless of the configured PUID and PGID.
Changes
This PR removes PUID and PGID and changes the startup logic so it no longer requires root.
The container can now be started directly with Docker's -u option or Docker Compose's
user: 1001:10001setting and the server will run as that user.Running as root is still possible, but must be explicitly enabled with the variable
RUN_AS_ROOT=trueRUN_AS_ROOT defaults to false.So a normal non-root setup is simply:
If the container is started as root without RUN_AS_ROOT=true, startup will fail with an error instead of silently running the server as root.
This is accomplished by allowing everyone write access to the container's home directory, but with the container isolation, I think this a worthwhile tradeoff when comparing it to giving the whole process root access.