Skip to content

[2-EL10] Switch to running as the apache user - #92

Merged
Fryguy merged 1 commit into
ManageIQ:2-el10from
bdunne:apache_user
Jul 24, 2026
Merged

[2-EL10] Switch to running as the apache user#92
Fryguy merged 1 commit into
ManageIQ:2-el10from
bdunne:apache_user

Conversation

@bdunne

@bdunne bdunne commented Jul 31, 2024 •
edited
Loading

Copy link
Copy Markdown
Member
  • apache user needs permissions to run update-ca-trust
  • /var/run/httpd is owned by root:apache, but the group has no permissions, in the restricted OpenShift SCC we need to allow the random UID to write to the directory.

This fixes Error: container has runAsNonRoot and image will run as root on this container.

Todo:

  • Test on OpenShift cluster
  • Test on k3s

@miq-bot miq-bot changed the title [WIP] Switch to running as the apache user [2-EL9] [WIP] Switch to running as the apache user Jul 31, 2024
@miq-bot miq-bot added the wip label Jul 31, 2024
@Fryguy Fryguy changed the title [2-EL9] [WIP] Switch to running as the apache user [WIP] [2-EL9] Switch to running as the apache user Jul 31, 2024
@miq-bot miq-bot added the stale label Nov 1, 2024
@miq-bot

miq-bot commented Nov 1, 2024

Copy link
Copy Markdown
Member

This pull request has been automatically marked as stale because it has not been updated for at least 3 months.

If these changes are still valid, please remove the stale label, make any changes requested by reviewers (if any), and ensure that this issue is being looked at by the assigned/reviewer(s).

4 similar comments
@miq-bot

miq-bot commented Feb 3, 2025

Copy link
Copy Markdown
Member

This pull request has been automatically marked as stale because it has not been updated for at least 3 months.

If these changes are still valid, please remove the stale label, make any changes requested by reviewers (if any), and ensure that this issue is being looked at by the assigned/reviewer(s).

@miq-bot

miq-bot commented May 5, 2025

Copy link
Copy Markdown
Member

This pull request has been automatically marked as stale because it has not been updated for at least 3 months.

If these changes are still valid, please remove the stale label, make any changes requested by reviewers (if any), and ensure that this issue is being looked at by the assigned/reviewer(s).

@miq-bot

miq-bot commented Dec 27, 2025

Copy link
Copy Markdown
Member

This pull request has been automatically marked as stale because it has not been updated for at least 3 months.

If these changes are still valid, please remove the stale label, make any changes requested by reviewers (if any), and ensure that this issue is being looked at by the assigned/reviewer(s).

@miq-bot

miq-bot commented Mar 30, 2026

Copy link
Copy Markdown
Member

This pull request has been automatically marked as stale because it has not been updated for at least 3 months.

If these changes are still valid, please remove the stale label, make any changes requested by reviewers (if any), and ensure that this issue is being looked at by the assigned/reviewer(s).

@bdunne
bdunne changed the base branch from 2-el9 to 2-el10 July 14, 2026 21:30
@miq-bot miq-bot changed the title [WIP] [2-EL9] Switch to running as the apache user [2-EL10] [WIP] [2-EL9] Switch to running as the apache user Jul 14, 2026
@bdunne bdunne changed the title [2-EL10] [WIP] [2-EL9] Switch to running as the apache user [WIP] [2-EL10] Switch to running as the apache user Jul 14, 2026
@bdunne bdunne changed the title [WIP] [2-EL10] Switch to running as the apache user [2-EL10] Switch to running as the apache user Jul 16, 2026
@bdunne bdunne removed the wip label Jul 16, 2026
jrafanie
jrafanie reviewed Jul 16, 2026
View reviewed changes
Comment thread Dockerfile
Comment thread Dockerfile
Comment thread Dockerfile
@jrafanie jrafanie self-assigned this Jul 16, 2026
@jrafanie jrafanie removed the stale label Jul 16, 2026
Fryguy
Fryguy reviewed Jul 23, 2026
View reviewed changes
Comment thread Dockerfile
Brandon Dunne @bdunne
Switch to running as the apache user by default instead of root
ee26258 
In k3s, we were failing to start because our security policy disables running
as root and that is the default user from the base container.

When running in OpenShift, the pod is run with a random UID, groups root & random ID
When running in k3s, the pod is now run as apache:apache

The permissions need to allow writing to both directories in both cases.
@miq-bot

miq-bot commented Jul 23, 2026

Copy link
Copy Markdown
Member

Checked commit bdunne@ee26258 with ruby 3.3.10, rubocop 1.86.0, haml-lint 0.73.0, and yamllint 1.37.1
0 files checked, 0 offenses detected
Everything looks fine. 🍰

@Fryguy
Fryguy merged commit dfc991e into ManageIQ:2-el10 Jul 24, 2026
1 check passed
@Fryguy Fryguy assigned Fryguy and unassigned jrafanie Jul 24, 2026
@bdunne
bdunne deleted the apache_user branch July 27, 2026 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Fryguy Fryguy Fryguy left review comments
@jrafanie jrafanie jrafanie approved these changes

Assignees

@Fryguy Fryguy

Labels

enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@bdunne @miq-bot @jrafanie @Fryguy