From ee26258fe6a1977570d4e05c9e8a4cd5af0b989f Mon Sep 17 00:00:00 2001 From: Brandon Dunne Date: Wed, 31 Jul 2024 17:40:27 -0400 Subject: [PATCH] Switch to running as the apache user by default instead of root In k3s, we were failing to start because our security policy disables running as root and that is the default user from the base container. When running in OpenShift, the pod is run with a random UID, groups root & random ID When running in k3s, the pod is now run as apache:apache The permissions need to allow writing to both directories in both cases. --- Dockerfile | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4c3738c..373a033 100644 --- a/Dockerfile +++ b/Dockerfile @@ -24,12 +24,12 @@ RUN ARCH=$(uname -m) && \ mod_auth_openidc && \ dnf clean all && \ rm -rf /var/cache/dnf && \ - chmod -R g+w /etc/pki/ca-trust && \ - chmod -R g+w /usr/share/pki/ca-trust-legacy + chmod -R a+rw /etc/pki/ca-trust && \ + chmod -R a+rw /usr/share/pki/ca-trust-legacy # Fix permissions so that httpd can run in the restricted scc -RUN chgrp root /var/run/httpd && chmod g+rwx /var/run/httpd && \ - chgrp root /var/log/httpd && chmod g+rwx /var/log/httpd +RUN chmod 777 /var/run/httpd && \ + chmod 777 /var/log/httpd # Remove any existing configs in conf.d and don't try to bind to port 80 RUN rm -f /etc/httpd/conf.d/* && \ @@ -48,4 +48,7 @@ COPY --from=manifest /tmp/BUILD /opt/manageiq/manifest EXPOSE 8080 +# User: apache +USER 48 + CMD ["/cmd"]