Repository navigation
Fix the Docker image build and run OpenAS2 in it as a non-root user - #637
Open
JakeHuneau wants to merge 1 commit into
Open
JakeHuneau wants to merge 1 commit into
JakeHuneau wants to merge 1 commit into
Conversation
The Dockerfile built on eclipse-temurin 11, but since the minimum Java version was raised the project compiles for Java 17, so "docker build" failed in the build stage with "invalid target release: 17". Both stages now use eclipse-temurin 21, the newer LTS release CI already tests. The server also ran as root inside the container (issue OpenAS2#367), which matters for a service that is normally exposed to the internet. It now runs as the user "openas2" with the numeric UID 1000, so Kubernetes can verify runAsNonRoot, in group 0. Everything under /opt/openas2 is owned by that user and group writable, so platforms that run containers under an arbitrary UID in group 0 work too. A volume owned by root is not writable by the new user, so an existing deployment whose config or data volume was created as root fails to start with "Permission denied" until it is changed. The README now explains the ownership needed and how to keep running as root while volumes are migrated, the Kubernetes guide's example sets a pod securityContext, and the release notes carry an upgrade note. The README's description of the image's environment, which still gave Tomcat paths and Java 11, is corrected. Verified with the built image: the server runs as uid 1000 and starts, the config template is copied into an empty config folder, docker stop shuts it down cleanly, a named volume is created with the right owner, and a root-owned bind mount fails as described and starts with either fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #367.
Problem
The image doesn't build. The Dockerfile uses
eclipse-temurin:11for both stages, but since #593 the project compiles for Java 17 (<java.version>17</java.version>). The build stage fails:And it runs as root (#367). That matters for a service that is normally exposed to the internet.
Change
eclipse-temurin:21(jdk for building, jre at runtime). That's the newer LTS release, and CI already tests it.openas2, with numeric UID 1000, so Kubernetes can verifyrunAsNonRoot, in group 0./opt/openas2is owned by that user and is group writable. Platforms that run containers under an arbitrary UID in group 0 work too.k8s-deployment.md: the example deployment sets a podsecurityContext, with a note that Azure Files / SMB / NFS volumes ignorefsGroupand need mount options instead.RELEASE-NOTES.md: an upgrade note.Upgrade impact
A volume owned by root isn't writable by the new user. An existing deployment whose config or data volume was created by root will fail to start with
Permission denieduntil it does one of these:chown -R 1000:0the volumes, orfsGroupin Kubernetes, ordocker run --user 0/user: "0".That's what the upgrade note covers.
Verified with the built image
mvnw package.uid=1000(openas2) gid=0(root).OpenAS2 Server v4.14.0 started.docker stopshuts down cleanly in 2 seconds ("All work in progress finished before shutting down").1000:0and the server starts.Permission denied, and starts with either--user 0or afterchown 1000:0.Dockerfile_WebUIis unchanged.