While updating some Docker Baseimages (which previously were based on this image openjdk/openjdk-8-rhel8) to this image: ubi8/openjdk-8 I (suspect that I) was unable to add a user with the useradd cammand.
It appears inside the /etc/shadow file, but when I try to login into the container I get that messenge:
NWRAP_ERROR(4677) - nwrap_files_cache_reload: Unable to open '/home/jboss/passwd' readonly -1:Permission denied
NWRAP_ERROR(4677) - nwrap_files_getpwuid: Error loading passwd file
the Dockerfile, which worked well with the previous Image is:
FROM xxxx.azurecr.io/ubi8/openjdk-8:1.3-9
ARG uid=60000
ARG gid=60000
ARG user=testuser
ARG group=testuser
ARG shell=/bin/bash
ARG home=/home/$user
ARG port=8080
USER root
RUN mkdir -p $home \
&& chown ${uid}:${gid} $home \
&& groupadd -g ${gid} ${group} \
&& useradd --uid ${uid} --gid ${gid} --shell ${shell} --home ${home} $user
I don't know what could cause that problem, and searching for NWRAP_ERROR(4677) gave me no results. Dis someone had similar problems and could tell what went wrong and if there is a different way to add the user with the Dockerfile?
I had a similar issue with this image when I tried to :
[root#3ee1b7206f33 ~]# useradd -m -u 15001 myaccount_azpcontainer
[root#3ee1b7206f33 ~]# groupadd azure_pipelines_sudo
[root#3ee1b7206f33 ~]# usermod -a -G azure_pipelines_sudo myaccount_azpcontainer
usermod: user 'myaccount_azpcontainer' does not exist
if I look in /ect/passwd, the user is present :
[root#3ee1b7206f33 ~]# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
jboss:x:185:0:JBoss user:/home/jboss:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
systemd-coredump:x:999:997:systemd Core Dumper:/:/sbin/nologin
systemd-resolve:x:193:193:systemd Resolver:/:/sbin/nologin
unbound:x:998:996:Unbound DNS resolver:/etc/unbound:/sbin/nologin
myaccount_azpcontainer:x:15001:15001::/home/myaccount_azpcontainer:/bin/bash
but usermod doesn't work and getent passwd doesn't work
[root#3ee1b7206f33 ~]# getent passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
jboss:x:185:0:JBoss user:/home/jboss:/sbin/nologin
I have no problem with others redhat images, only with openjdk
By looking the image DockerFile I found :
USER root
RUN [ "sh", "-x", "/tmp/scripts/jboss.container.user/configure.sh" ]
and the content of file :
https://github.com/jboss-openshift/cct_module/blob/master/jboss/container/user/configure.sh
groupadd -r jboss -g 185 && useradd -u 185 -r -g root -G jboss -m -d /home/jboss -s /sbin/nologin -c "JBoss user" jboss
cp /etc/passwd /home/jboss/passwd
chmod ug+rwX /home/jboss /home/jboss/passwd
I tested it in mydockerfile and add cp /etc/passwd /home/jboss/passwd after useradd and It works !!
My colleague explained me the problem is the usage of nss_wrapper :https://cwrap.org/nss_wrapper.html
Maybe, there is another way to manage the useradd, but not yet tested
Thanks,
Related
There are a few posts on how to use Docker + SSH. There are also posts on how to edit files mounted in a docker container, such that editing them won't cause the permissions to become root.
I'm trying to combine the 2 things, so I can SSH into a docker container and edit files without messing up their permissions.
For, using the correct file permissions, I use:
- /etc/passwd:/etc/passwd:ro
- /etc/group:/etc/group:ro
in my docker-compose.yml and
docker compose -f commands/dev/docker-compose.yml run \
--service-ports \
--user $(id -u) \
develop \
bash
so that when I start the docker container, my user is the same user as my local computer.
However, this breaks up my SSH setup inside the Docker container:
useradd -rm -d /home/ubuntu -s /bin/bash -g root -G sudo ubuntu
echo 'ubuntu:ubuntu' | chpasswd
# passwd -d ubuntu
apt install -y --no-install-recommends openssh-server vim-tiny sudo
# See: https://stackoverflow.com/questions/22886470/start-sshd-automatically-with-docker-container
sed 's#session\s*required\s*pam_loginuid.so#session optional pam_loginuid.so#g' -i /etc/pam.d/sshd
mkdir /var/run/sshd
bash -c 'install -m755 <(printf "#!/bin/sh\nexit 0") /usr/sbin/policy-rc.d'
ex +'%s/^#\zeListenAddress/\1/g' -scwq /etc/ssh/sshd_config
ex +'%s/^#\zeHostKey .*ssh_host_.*_key/\1/g' -scwq /etc/ssh/sshd_config
RUNLEVEL=1 dpkg-reconfigure openssh-server
ssh-keygen -A -v
update-rc.d ssh defaults
# Configure sudo
ex +"%s/^%sudo.*$/%sudo ALL=(ALL:ALL) NOPASSWD:ALL/g" -scwq! /etc/sudoers
Here I'm creating a user called ubuntu with password ubuntu for SSH-ing. This lets me SSH in ubuntu#localhost using the password ubuntu.
The issue is that by mounting the /etc/passwd file into my container, I erase the ubuntu user inside the container. This means when I try to ssh in with ssh -p 9002 ubuntu#localhost, the authentication fails (9002 is what I bind port 22 in the container to on the host).
Does anyone have a solution?
Here's a first pass answer.
I can use:
useradd -rm -d /home/yourusername -s /bin/bash -g root -G sudo yourusername
instead of
useradd -rm -d /home/ubuntu -s /bin/bash -g root -G sudo ubuntu
echo 'ubuntu:ubuntu' | chpasswd
then, I:
Run the ssh server in the container with:
su root
/usr/sbin/sshd -D -o ListenAddress=0.0.0.0 -o PermitRootLogin=yes
I can ssh into the container as root (using the root password "root", which I set with RUN echo 'root:root' | chpasswd in the Dockerfile).
Then, I can do su yourusername, to switch my user.
While this works, it is pretty annoying since I need to bake the user name into the Docker container.
I know that one can use the --user option with Docker to run a container as a certain user, but in my case, my Docker image has a user inside it, let us call that user manager. Now is it possible to map that user to a user on host? For example, if there is a user john on the host, can we map john to manager?
Yes, you can set the user from the host, but you should modify your Dockerfile a bit to deal with run time user.
FROM alpine:latest
# Override user name at build. If build-arg is not passed, will create user named `default_user`
ARG DOCKER_USER=default_user
# Create a group and user
RUN addgroup -S $DOCKER_USER && adduser -S $DOCKER_USER -G $DOCKER_USER
# Tell docker that all future commands should run as this user
USER $DOCKER_USER
Now, build the Docker image:
docker build --build-arg DOCKER_USER=$(whoami) -t docker_user .
The new user in Docker will be the Host user.
docker run --rm docker_user ash -c "whoami"
Another way is to pass host user ID and group ID without creating the user in Dockerfile.
export UID=$(id -u)
export GID=$(id -g)
docker run -it \
--user $UID:$GID \
--workdir="/home/$USER" \
--volume="/etc/group:/etc/group:ro" \
--volume="/etc/passwd:/etc/passwd:ro" \
--volume="/etc/shadow:/etc/shadow:ro" \
alpine ash -c "whoami"
You can further read more about the user in docker here and here.
Another way is through an entrypoint.
Example
This example relies on gosu which is present in recent Debian derivatives, not yet in Alpine 3.13 (but is in edge).
You could run this image as follow:
docker run --rm -it \
--env UID=$(id -u) \
--env GID=$(id -g) \
-v "$(pwd):$(pwd)" -w "$(pwd)" \
imagename
tree
.
├── Dockerfile
└── files/
└── entrypoint
Dockerfile
FROM ...
# [...]
ARG DOCKER_USER=default_user
RUN addgroup "$DOCKER_USER" \
&& adduser "$DOCKER_USER" -G "$DOCKER_USER"
RUN wget -O- https://github.com/tianon/gosu/releases/download/1.12/gosu-amd64 |\
install /dev/stdin /usr/local/bin/gosu
COPY files /
RUN chmod 0755 /entrypoint \
&& sed "s/\$DOCKER_USER/$DOCKER_USER/g" -i /entrypoint
ENTRYPOINT ["/entrypoint"]
files/entrypoint
#!/bin/sh
set -e
set -u
: "${UID:=0}"
: "${GID:=${UID}}"
if [ "$#" = 0 ]
then set -- "$(command -v bash 2>/dev/null || command -v sh)" -l
fi
if [ "$UID" != 0 ]
then
usermod -u "$UID" "$DOCKER_USER" 2>/dev/null && {
groupmod -g "$GID" "$DOCKER_USER" 2>/dev/null ||
usermod -a -G "$GID" "$DOCKER_USER"
}
set -- gosu "${UID}:${GID}" "${#}"
fi
exec "$#"
Notes
UID is normally a read-only variable in bash, but it will work as expected if set by the docker --env flag
I choose gosu for it's simplicity, but you could make it work with su or sudo; it will need more configuration however
if you don't want to specify two --env switch, you could do something like: --env user="$(id -u):$(id -g)" and in the entrypoint: uid=${user%:*} gid=${user#*:}; note at this point the UID variable will be read-only in bash that's why I switched to lower-case... rest of the adaptation is left to the reader
There is no simple solution that handles all use cases. Solving these problems is continuous work, a part of life in the containerized world.
There is no magical parameter that you could add to a docker exec or docker run invocation and reliably cause the containerized software to no longer run into permissions issues during operations on host-mapped volumes. Unless your mapped directories are chmod-0777-and-come-what-may (DON'T), you will be running into permissions issues and you will be solving them as you go, and this is the task you should try becoming efficient at, instead of trying to find a miracle once-and-forever solution that will never exist.
I have an OpenSuse 42.3 docker image that I've configured to run a code. The image has a single user(other than root) called "myuser" that I create during the initial Image generation via the Dockerfile. I have three script files that generate a container from the image based on what operating system a user is on.
Question: Can the username "myuser" in the container be set to the username of the user that executes the container generation script?
My goal is to let a user pop into the container interactively and be able to run the code from within the container. The code is just a single binary that executes and has some IO, so I want the user's directory to be accessible from within the container so that they can navigate to a folder on their machine and run the code to generate output in their filesystem.
Below is what I have constructed so far. I tried setting the USER environment variable during the linux script's call to docker run, but that didn't change the user from "myuser" to say "bob" (the username on the host machine that started the container). The mounting of the directories seems to work fine. I'm not sure if it is even possible to achieve my goal.
Linux Container script:
username="$USER"
userID="$(id -u)"
groupID="$(id -g)"
home="${1:-$HOME}"
imageName="myImage:ImageTag"
containerName="version1Image"
docker run -it -d --name ${containerName} -u $userID:$groupID \
-e USER=${username} --workdir="/home/myuser" \
--volume="${home}:/home/myuser" ${imageName} /bin/bash \
Mac Container script:
username="$USER"
userID="$(id -u)"
groupID="$(id -g)"
home="${1:-$HOME}"
imageName="myImage:ImageTag"
containerName="version1Image"
docker run -it -d --name ${containerName} \
--workdir="/home/myuser" \
--v="${home}:/home/myuser" ${imageName} /bin/bash \
Windows Container script:
ECHO OFF
SET imageName="myImage:ImageTag"
SET containerName="version1Image"
docker run -it -d --name %containerName% --workdir="/home/myuser" -v="%USERPROFILE%:/home/myuser" %imageName% /bin/bash
echo "Container %containerName% was created."
echo "Run the ./startWindowsLociStream script to launch container"
The below code has been checked into https://github.com/bmitch3020/run-as-user.
I would handle this in an entrypoint.sh that checks the ownership of /home/myuser and updates the uid/gid of the user inside your container. It can look something like:
#!/bin/sh
set -x
# get uid/gid
USER_UID=`ls -nd /home/myuser | cut -f3 -d' '`
USER_GID=`ls -nd /home/myuser | cut -f4 -d' '`
# get the current uid/gid of myuser
CUR_UID=`getent passwd myuser | cut -f3 -d: || true`
CUR_GID=`getent group myuser | cut -f3 -d: || true`
# if they don't match, adjust
if [ ! -z "$USER_GID" -a "$USER_GID" != "$CUR_GID" ]; then
groupmod -g ${USER_GID} myuser
fi
if [ ! -z "$USER_UID" -a "$USER_UID" != "$CUR_UID" ]; then
usermod -u ${USER_UID} myuser
# fix other permissions
find / -uid ${CUR_UID} -mount -exec chown ${USER_UID}.${USER_GID} {} \;
fi
# drop access to myuser and run cmd
exec gosu myuser "$#"
And here's some lines from a relevant Dockerfile:
FROM debian:9
ARG GOSU_VERSION=1.10
# run as root, let the entrypoint drop back to myuser
USER root
# install prereq debian packages
RUN apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
apt-transport-https \
ca-certificates \
curl \
vim \
wget \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
# Install gosu
RUN dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" \
&& chmod 755 /usr/local/bin/gosu \
&& gosu nobody true
RUN useradd -d /home/myuser -m myuser
WORKDIR /home/myuser
# entrypoint is used to update uid/gid and then run the users command
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD /bin/sh
Then to run it, you just need to mount /home/myuser as a volume and it will adjust permissions in the entrypoint. e.g.:
$ docker build -t run-as-user .
$ docker run -it --rm -v $(pwd):/home/myuser run-as-user /bin/bash
Inside that container you can run id and ls -l to see that you have access to /home/myuser files.
Usernames are not important. What is important are the uid and gid values.
User myuser inside your container will have a uid of 1000 (first non-root user id). Thus when you start your container and look at the container process from the host machine, you will see that the container is owned by whatever user having a uid of 1000 on the host machine.
You can override this by specifying the user once you run your container using:
docker run --user 1001 ...
Therefore if you want the user inside the container, to be able to access files on the host machine owned by a user having a uid of 1005 say, just run the container using --user 1005.
To better understand how users map between the container and host take a look at this wonderful article. https://medium.com/#mccode/understanding-how-uid-and-gid-work-in-docker-containers-c37a01d01cf
First of all (https://docs.docker.com/engine/reference/builder/#arg):
Warning: It is not recommended to use build-time variables for passing
secrets like github keys, user credentials etc. Build-time variable
values are visible to any user of the image with the docker history
command.
But if you still need to do this, read https://docs.docker.com/engine/reference/builder/#arg:
A Dockerfile may include one or more ARG instructions. For example,
the following is a valid Dockerfile:
FROM busybox
ARG user1
ARG buildno
...
and https://docs.docker.com/engine/reference/builder/#user:
The USER instruction sets the user name (or UID) and optionally the
user group (or GID) to use when running the image and for any RUN, CMD
and ENTRYPOINT instructions that follow it in the Dockerfile.
USER <user>[:<group>] or
USER <UID>[:<GID>]
I like to do some things for the build-in users of my yocto project:
1.) set a password for root to "abc"
2.) set the root shell for ssh login form /bin/sh to /bin/bash
3.) add the user "customUser" with password "xyz"
Think a simple recipe can do this. So far I tried # myUser.bb:
SUMMARY = "admin + user"
SECTION = "USR"
LICENSE = "CLOSED"
inherit extrausers useradd
# how to
# pw: abc
# at bash: usermod -p $(openssl passwd abc) root
# get a salted hash: openssl passwd abc
# one possible result: 1Cw5PHLy76ps2
# the command now looks: usermod -p 1Cw5PHLy76ps2 root
# set image root password
EXTRA_USERS_PARAMS = "usermod -p 1Cw5PHLy76ps2 root;"
USERADD_PACKAGES = "${PN}"
# password
# "xyz"
# openssl passwd xyz
# result: y5UyLBO4GNAwc
USERADD_PARAM_${PN} = "-u 1200 -d /home/customUser -r -s /bin/bash -p y5UyLBO4GNAwc customUser"
do_install_append () {
install -d -m 755 ${D}${datadir}/customUser
# The new users and groups are created before the do_install
# step, so you are now free to make use of them:
chown -R customUser ${D}${datadir}/customUser
# groups
# chgrp -R group1 ${D}${datadir}/customUser
}
FILES_${PN} = "${datadir}/*"
#ALLOW_EMPTY_${PN} = "1"
Any idea how to get this done?
You can use EXTRA_USERS_PARAMS global in your main recipe.
inherit extrausers
EXTRA_USERS_PARAMS = " useradd customUser1; \
useradd customUser2; \
usermod -p 'Password_1' customUser1; \
usermod -p 'Password_2' customUser2; \
usermod -a -G sudo customUser1; \
usermod -a -G sudo customUser2;"
I took your example and made two small changes to get it to work.
First, I removed inherit extrauser, this isn't necessary when working with useradd. That made bitbaking the recipe fail; the username was invalid. I changed the username to custom, and everything builds fine.
When inspecting the resulting myuser_1.0-r0.0_armv5e.ipk, I can see that there are a preinstall script in myuser_1.0-r0.0_armv5e.ipk/control.tar.gz/preinst that will create your user.
I'm currently experimenting on Docker specifically on the aspect where a user inside given container affects the Docker host itself. Ultimately, I want the user to be able to run containers on its very own host from inside its container. It kind of sounds a little absurd, but I'm hoping it works.
At the moment, I'm looking for a way for that given user to be part of the Docker host's docker group. Is there a way to do that?
From the perspective of the Docker host, any users inside the container are treated exactly the same as a user outside the container with the same UID (not the same name!), regardless of whether the UID is actually in use on the host. Unfortunately, it appears that only users with a username can belong to groups, so you can't just add the UID to the group. Instead, you need to add the host user with the same UID to the group (or create a user with that UID if one doesn't exist).
I wrote a bash script to generate dockerfiles on the fly with the current user added on the container and the docker group. Here is the meat of it:
# get the current user's info
user=$USER
uid=`id -u $user`
gid=`id -g $user`
# get gid for group docker
RESULT=$(id -g docker 2>&1)
if [ 1 -ne $? ] ; then
docker_gid=$RESULT
fi
echo FROM ubuntu:14.04
echo MAINTAINER Nobody "no-reply#nothere.com"
echo USER root
echo "RUN apt-get update && apt-get -y install docker-engine"
echo "RUN /bin/bash -c 'getent passwd ${user} || \
adduser --system --gid ${gid} ${docker_group} --uid ${uid} --shell /bin/bash ${user} || \
usermod -l ${user} \$(getent passwd ${uid} | cut -d: -f1)'"
if [ -n "$docker_gid" ] ; then
echo "RUN /bin/bash -c 'getent group docker && groupmod --gid ${docker_gid} docker \
|| groupadd --gid ${docker_gid} docker'"
echo "RUN /bin/bash -c 'groups ${user} | grep docker || usermod --groups ${docker_gid} ${user}'"
fi
HTH!