1
0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-07 09:46:53 +01:00

remove unnecessary /etc/passwd directives

This commit is contained in:
Ben Parees
2019-09-26 15:08:56 -04:00
parent 9abb11850e
commit 1128e47ee0

View File

@@ -63,46 +63,6 @@ arrangement. In addition, the processes running in the container must not listen
on privileged ports (ports below 1024), since they are not running as a
privileged user.
Because the user ID of the container is generated dynamically, it will not have
an associated entry in *_/etc/passwd_*. This can cause problems for applications
that expect to be able to look up their user ID. One way to address this problem
is to dynamically create a *_passwd_* file entry with the container's user ID as part
of the image's start script. This is what a Dockerfile might include:
----
RUN chmod g=u /etc/passwd
ENTRYPOINT [ "uid_entrypoint" ]
USER 1001
----
Where *_uid_entrypoint_* contains:
----
if ! whoami &> /dev/null; then
if [ -w /etc/passwd ]; then
echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:${HOME}:/sbin/nologin" >> /etc/passwd
fi
fi
----
ifdef::openshift-origin[]
For a complete example of this, see
link:https://github.com/RHsyseng/container-rhel-examples/blob/master/starter-arbitrary-uid/Dockerfile.centos7[this Dockerfile].
endif::[]
ifdef::openshift-enterprise[]
For a complete example of this, see
link:https://github.com/RHsyseng/container-rhel-examples/blob/master/starter-arbitrary-uid/Dockerfile[this Dockerfile].
endif::[]
Lastly, the final *USER* declaration in the `Dockerfile` should specify the user
ID (numeric value) and not the user name. This allows {product-title} to
validate the authority the image is attempting to run with and prevent running
images that are trying to run as root, because running containers as a
privileged user exposes potential security holes.
If the image does not specify a *USER*, it inherits the *USER*
from the parent image.
ifdef::openshift-enterprise,openshift-origin[]
[IMPORTANT]
====