-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dynamic user support. #21
Comments
For example when starting Indy this appears in the log file
|
PR #22 has been created to solve this issue. |
I have reopend this issue because the issue still exists. But the PR #22 did not correctly solve the problem or implement correctly. |
Not only does the running user not get recognized but this impacts the JVM process and the integration with JVM tooling. (jps, jcmd) Openshift then allocates a dynamic user id. In this case 1013040000. When a operations user subsequently uses a JVM tool jps to list the running processes in the container that fails. The tool fails to communicate with the active running Indy JVM. By correctly integrating the nss_wrapper library the current user can be correctly recognized when the Indy JVM starts up. Writing the expected directory |
Investigation into how the Indy JVM is started reveals how shells are used. At the Entrypoint the dumb init command is started with a login-less shell. The current container image which starts Indy JVM shows these log messages.
these messages are logged when shell process start-indy.sh script is discovering the user, then when the shell script is running the /etc/profile to set-up the environment. |
Bash login shells requires configuring with nss_wrapper. But with no modification to /etc/passwd. Which is were the initial implementation failed in PR #22 . The solution is: This correctly integrates the workaround for Openshift dynamic inventory user id. This article explains the integration with nss_wrapper in more detail. The article covers the security concerns and solution that Openshift uses to limit the exposure. |
Currently the Indy docker file uses a user named "Indy" with id 1001.
When the same image is run in Openshift a dynamic user id is created. It means tools like whoami are broken.
The image can be adapted to work elegantly with Openshift by adding dynamic user configuration. Documented here in Support Arbitrary User IDs.
The text was updated successfully, but these errors were encountered: