mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-07 09:46:53 +01:00
remove unnecessary /etc/passwd directives
This commit is contained in:
@@ -63,46 +63,6 @@ arrangement. In addition, the processes running in the container must not listen
|
||||
on privileged ports (ports below 1024), since they are not running as a
|
||||
privileged user.
|
||||
|
||||
Because the user ID of the container is generated dynamically, it will not have
|
||||
an associated entry in *_/etc/passwd_*. This can cause problems for applications
|
||||
that expect to be able to look up their user ID. One way to address this problem
|
||||
is to dynamically create a *_passwd_* file entry with the container's user ID as part
|
||||
of the image's start script. This is what a Dockerfile might include:
|
||||
|
||||
----
|
||||
RUN chmod g=u /etc/passwd
|
||||
ENTRYPOINT [ "uid_entrypoint" ]
|
||||
USER 1001
|
||||
----
|
||||
|
||||
Where *_uid_entrypoint_* contains:
|
||||
|
||||
----
|
||||
if ! whoami &> /dev/null; then
|
||||
if [ -w /etc/passwd ]; then
|
||||
echo "${USER_NAME:-default}:x:$(id -u):0:${USER_NAME:-default} user:${HOME}:/sbin/nologin" >> /etc/passwd
|
||||
fi
|
||||
fi
|
||||
----
|
||||
|
||||
ifdef::openshift-origin[]
|
||||
For a complete example of this, see
|
||||
link:https://github.com/RHsyseng/container-rhel-examples/blob/master/starter-arbitrary-uid/Dockerfile.centos7[this Dockerfile].
|
||||
endif::[]
|
||||
ifdef::openshift-enterprise[]
|
||||
For a complete example of this, see
|
||||
link:https://github.com/RHsyseng/container-rhel-examples/blob/master/starter-arbitrary-uid/Dockerfile[this Dockerfile].
|
||||
endif::[]
|
||||
|
||||
|
||||
Lastly, the final *USER* declaration in the `Dockerfile` should specify the user
|
||||
ID (numeric value) and not the user name. This allows {product-title} to
|
||||
validate the authority the image is attempting to run with and prevent running
|
||||
images that are trying to run as root, because running containers as a
|
||||
privileged user exposes potential security holes.
|
||||
If the image does not specify a *USER*, it inherits the *USER*
|
||||
from the parent image.
|
||||
|
||||
ifdef::openshift-enterprise,openshift-origin[]
|
||||
[IMPORTANT]
|
||||
====
|
||||
|
||||
Reference in New Issue
Block a user