Docker: don't run as root user #2917

gerardsn · 2024-03-13T17:01:08Z

closes #1779

In this PR:

default user in the docker container changed to 18081
moved and updated documentation for running docker
set default container working dir to /nuts
set defaults for various config paths to ./config/... which is relative to the working directory
fixed permission issues in e2e-tests. In most tests this means the datadir volume mount is removed if not needed

In a followup PR I will fix all default paths in the e2e-tests to cleanup a bit

TODO:

cleanup https://nuts-node.readthedocs.io/en/feature-dont-run-container-as-root/
set same workdir in Dockerfile of dev image

reinkrul · 2024-03-14T05:10:04Z

Isn't this going to break all existing deployments?

gerardsn · 2024-03-14T07:57:08Z

yes, and that's why it is v6 and we need to add instructions on how to upgrade. I can't get it to fail on my laptop though

discovery/module.go

reinkrul · 2024-03-26T13:02:31Z

docs/pages/deployment/docker.rst

+If you already use Docker, the easiest way to get your Nuts Node up and running for development or production is
+using Docker. This guide helps you to configure the Nuts node in Docker.
+To use the most recent release use ``nutsfoundation/nuts-node:latest``. For production environments it's advised to use a specific version.
+


can we start with the most important part when people start with Nuts, which is i.m.o. the Docker run and docker compose examples?

Then probably the dev image, and user/mount stuff

reordered some stuff, does this work?

docs/pages/deployment/docker.rst

docs/pages/release_notes.rst

Dockerfile

woutslakhorst · 2024-03-27T10:48:51Z

docs/pages/release_notes.rst

 *******************

 **Release date:** TBD
-**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v5.0.0...master
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v5.0.0...v6.0.0


There's no v6.0.0

it still takes you to a page where you can manually set a different target. I'd rather set this correct now so we don't forget to change it on release.

woutslakhorst · 2024-03-27T10:51:33Z

e2e-tests/README.md

@@ -8,6 +8,8 @@
 - The `run-test.sh` of each test should be added to the respective group's `/<test-group>/run-tests.sh` script.
 - All `/<test-group>/run-tests.sh` should be added to `/run-tests.sh`

+If the `datadir` needs to be mounted for a test, add `USER=$UID` to the top of the test's `run-test.sh`, and add `user: "$USER:$USER"` to each service in the `docker-compose.yml` that mounts a `datadir`.


are $UID and $USER always available?

In the environment that we use for the e2e-test (and on macOS): yes

$USER is should be set in the run-test.sh script, so that is available as long as $UID is available. AFAIK UID is always available. USER might not be the best choice since some systems control this env variable, but for the e2e-tests this is not an issue.

docs/pages/deployment/docker.rst

woutslakhorst · 2024-03-27T10:57:04Z

docs/pages/deployment/docker.rst

+using Docker. This guide helps you to configure the Nuts node in Docker.
+To use the most recent release use ``nutsfoundation/nuts-node:latest``. For production environments it's advised to use a specific version.
+
+User


Also refer to docker documentation to use a different user?

The only documentation I can find has a different angle on managing users, so I added a note on L45:

- *"User 18081 already exists on my host."* See `docker security <https://docs.docker.com/engine/security/userns-remap/>`_ (or relevant container orchestration platform) documentation how to restrict privileges to a user namespace / create a user mapping between host and container.

gerardsn · 2024-03-27T15:29:52Z

Should the dev-container have the same user? consistency makes for better development, but fixing permission issues every time will be annoying.

gerardsn · 2024-03-27T15:50:09Z

Fixed issue introduced by this PR: address and directory are mutual exclusive config values for policy. This means you need to remove the default directory to use address. This is fixed in 6091095

docs/pages/deployment/docker.rst

reinkrul

Functional changes approved, but I find the documentation too complicated (we're in the risk of getting too much of it, again)

docs/pages/deployment/docker.rst

docs/pages/release_notes.rst

docs/pages/deployment/docker.rst

* run docker as non-root user * add documentation * move docker.rst to deployment * update docs * Add release note * set default config directories * fix e2e-tests * fix private transacitons test * update e2e-tests readme * pr feedback * reorder sections in docker.rst * fix mutual exclusive config values combination with defaults * pr feedback

* master: (21 commits) IAM: Remove OpenID4VP PoC code (#3022) Bump golang.org/x/crypto from 0.21.0 to 0.22.0 (#3021) VDR: Support root did:web DIDs (#2900) extended policy mapping for user/organization (#2977) IAM: fix loading of server state (#3011) Bump github.com/nats-io/nats.go from 1.34.0 to 1.34.1 (#3018) Bump github.com/prometheus/client_model from 0.6.0 to 0.6.1 (#3017) Bump google.golang.org/grpc from 1.62.1 to 1.63.0 (#3016) Update golang.org/x/net@v0.23.0 (#3014) Ignore allowUntrustedIssuer for did:web and clarify 'revocation' in vcr/search (#2992) document liveness and readiness probes (#2982) IAM: Allow user details to be passed in requestUserAccessToken (#2990) Policy: allow multiple policy files in local PDP (#3010) Bump github.com/amacneil/dbmate/v2 from 2.13.0 to 2.14.0 (#2999) Docker: don't run as root user (#2917) Add missing copyright notices (#3000) Set SQL logging to TRACE instead of DEBUG (#3002) fix invalid swagger (#2988) add credentialStatus to common ssi_types (#2989) Auth: IAM client should not use PKI TLS config (#2998) ...

… to changes from: "Docker: don't run as root user (#2917)" Security settings for the nuts-node have been updated in the values.yaml file. The fsGroup value under podSecurityContext has been changed to 18081 and the runAsUser and runAsGroup have been added under securityContext, both set to 18081.

… to changes from: "Docker: don't run as root user (#2917)" (#3041)

* master: Fix for #3040: Update podSecurityContext and securityContext settings to changes from: "Docker: don't run as root user (#2917)" (#3041)

gerardsn force-pushed the feature/dont-run-container-as-root branch 7 times, most recently from e22423d to dbd72ce Compare March 22, 2024 11:52

gerardsn added 6 commits March 22, 2024 12:58

run docker as non-root user

493645b

add documentation

5ef7ae2

move docker.rst to deployment

b501052

update docs

5c27c52

Add release note

3a52431

set default config directories

16f426f

gerardsn force-pushed the feature/dont-run-container-as-root branch 2 times, most recently from 47d4fe3 to 229aa56 Compare March 22, 2024 14:39

fix e2e-tests

78cc6aa

gerardsn force-pushed the feature/dont-run-container-as-root branch from 229aa56 to 78cc6aa Compare March 22, 2024 15:44

gerardsn added 2 commits March 22, 2024 16:50

fix private transacitons test

ce8f7a6

update e2e-tests readme

1bb1304

gerardsn marked this pull request as ready for review March 22, 2024 16:19

gerardsn requested review from woutslakhorst and reinkrul March 22, 2024 16:19

reinkrul requested changes Mar 26, 2024

View reviewed changes

discovery/module.go Show resolved Hide resolved

reinkrul reviewed Mar 26, 2024

View reviewed changes

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

reinkrul reviewed Mar 26, 2024

View reviewed changes

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

reinkrul reviewed Mar 26, 2024

View reviewed changes

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

reinkrul reviewed Mar 26, 2024

View reviewed changes

docs/pages/release_notes.rst Show resolved Hide resolved

reinkrul reviewed Mar 26, 2024

View reviewed changes

docs/pages/release_notes.rst Outdated Show resolved Hide resolved

woutslakhorst requested changes Mar 27, 2024

View reviewed changes

gerardsn and others added 3 commits March 27, 2024 16:13

Merge branch 'master' into feature/dont-run-container-as-root

eb410f2

pr feedback

ba4bb1a

reorder sections in docker.rst

335a08c

gerardsn requested review from reinkrul and woutslakhorst March 27, 2024 15:26

fix mutual exclusive config values combination with defaults

6091095

woutslakhorst approved these changes Mar 29, 2024

View reviewed changes

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

reinkrul approved these changes Apr 2, 2024

View reviewed changes

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

docs/pages/deployment/docker.rst Show resolved Hide resolved

docs/pages/release_notes.rst Show resolved Hide resolved

docs/pages/deployment/docker.rst Outdated Show resolved Hide resolved

pr feedback

ad42c64

gerardsn merged commit c9fe559 into master Apr 3, 2024
8 of 9 checks passed

gerardsn deleted the feature/dont-run-container-as-root branch April 3, 2024 11:12

rolandgroen mentioned this pull request Apr 10, 2024

Helm charts won't start container due to gid/uid and datadir change (from /opt/nuts/data to /nuts/data/) #3040

Closed

rolandgroen mentioned this pull request Apr 10, 2024

Fix for #3040: Update podSecurityContext and securityContext settings… #3041

Merged

gerardsn pushed a commit that referenced this pull request Apr 10, 2024

Fix for #3040: Update podSecurityContext and securityContext settings…

701ae93

… to changes from: "Docker: don't run as root user (#2917)" (#3041)

rolandgroen added a commit that referenced this pull request Apr 10, 2024

Merge branch 'master' into mitzXnuts

f9e2dee

* master: Fix for #3040: Update podSecurityContext and securityContext settings to changes from: "Docker: don't run as root user (#2917)" (#3041)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker: don't run as root user #2917

Docker: don't run as root user #2917

gerardsn commented Mar 13, 2024 •

edited

Loading

reinkrul commented Mar 14, 2024

gerardsn commented Mar 14, 2024

reinkrul Mar 26, 2024

gerardsn Mar 27, 2024

woutslakhorst Mar 27, 2024

gerardsn Mar 27, 2024

woutslakhorst Mar 27, 2024

gerardsn Mar 27, 2024

woutslakhorst Mar 27, 2024

gerardsn Mar 27, 2024

gerardsn commented Mar 27, 2024

gerardsn commented Mar 27, 2024

reinkrul left a comment

Docker: don't run as root user #2917

Docker: don't run as root user #2917

Conversation

gerardsn commented Mar 13, 2024 • edited Loading

reinkrul commented Mar 14, 2024

gerardsn commented Mar 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gerardsn commented Mar 27, 2024

gerardsn commented Mar 27, 2024

reinkrul left a comment

Choose a reason for hiding this comment

gerardsn commented Mar 13, 2024 •

edited

Loading