Can't run rootless with no capabilities #777

jbonnier · 2024-05-12T05:09:23Z

What happened?

I'm trying to run Frankenphp in a rootless, no-capabilities, read-only container.

Everything works so far except for the no-capabilities part. I know it is required to have the NET_BIND_SERVICE capability when running as non-root to be able to map ports in the 0-1024 range. However I using ports 4443 and 8080 so I don't understand why it is not working.

Here's my compose.yaml file.

services:
  php:
    build:
      context: ./
      dockerfile: Dockerfile
      target: php_dev
    hostname: php
    networks:
      - php
    ports:
      - "80:8080"
      - "443:4443"
    environment:
      CADDY_GLOBAL_OPTIONS: |
        http_port 8080
        https_port 4443
      CADDY_SERVER_EXTRA_DIRECTIVES: |
        tls /etc/caddy/certs/server.crt /etc/caddy/certs/server.key
    read_only: true
    volumes:
      - ./app:/app
      # this is where I store my local dev cert/key
      - ~/.tls/local-dev:/etc/caddy/certs:ro
    tmpfs:
      - /tmp:uid=1000,gid=1000
      - /data/caddy:uid=1000,gid=1000
      - /config/caddy:uid=1000,gid=1000
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
      
networks:
  php:

And here's my Dockerfile :

ARG COMPOSER_VERSION=latest
ARG FRANKENPHP=1.1-php8.3-bookworm
ARG NGINX_VERSION=1.21-alpine
# ----------------------------------------------------------------------------------------------------------------------
# COMPOSER
# ----------------------------------------------------------------------------------------------------------------------
FROM composer:$COMPOSER_VERSION as my_composer

# ----------------------------------------------------------------------------------------------------------------------
# PHP BASE IMAGE
# ----------------------------------------------------------------------------------------------------------------------
FROM dunglas/frankenphp:$FRANKENPHP as php_base

ENV COMPOSER_ALLOW_SUPERUSER=0
ENV COMPOSER_HOME=/tmp

# please do not change these after build
ENV APP_USER=app
ENV APP_USER_HOME=/home/app
ENV APP_USER_UID=1000
ENV APP_USER_GID=1000
ENV APP_HOME=/app

# create the app user
RUN set -eux; \
    addgroup --gid $APP_USER_GID --system $APP_USER; \
    adduser \
      --system \
      --disabled-password \
      --home "$APP_USER_HOME" \
      --uid $APP_USER_UID \
      --shell /sbin/nologin \
      --gid $APP_USER_GID \
      --gecos $APP_USER \
      $APP_USER

# install php debpendencies and configure extensions
RUN set -ex; \
    install-php-extensions \
        opcache \
        pdo_pgsql \
        gd \
        intl \
        zip

# install composer
COPY --from=my_composer /usr/bin/composer /usr/bin/composer
RUN set -eux; \
    chmod a+x /usr/bin/composer; \
    composer --ansi --version --no-interaction

# copy config files
RUN set -eux; \
    ln -s "${PHP_INI_DIR}/php.ini-production" "${PHP_INI_DIR}/php.ini"

# setting up healtcheck
COPY .docker/php/docker-healthcheck.sh /usr/local/bin/docker-healthcheck
RUN set -eux; chmod +x /usr/local/bin/docker-healthcheck
HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD ["docker-healthcheck"]

EXPOSE 8080 4443

# ----------------------------------------------------------------------------------------------------------------------
# PHP DEVELOPMENT
# ----------------------------------------------------------------------------------------------------------------------
FROM php_base as php_dev

# install development only tools
RUN set -ex; \
    install-php-extensions xdebug

# copy config files
COPY .docker/.bashrc ${APP_USER_HOME}/.bashrc
COPY .docker/php/xdebug.ini "${PHP_INI_DIR}/conf.d/docker-php-ext-xdebug.ini"
COPY .docker/php/conf.d/symfony.dev.ini "${PHP_INI_DIR}/conf.d/symfony.ini"

# these are only for debugging
RUN apt update && apt install net-tools
RUN sed -i 's/set -e/set -ex/' /usr/local/bin/docker-php-entrypoint

VOLUME ["${APP_HOME}", "/tmp"]
USER $APP_USER
WORKDIR "${APP_HOME}"

Build Type

Docker (Debian Bookworm)

Worker Mode

No

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

Relevant log output

/usr/local/bin/docker-php-entrypoint: 9: exec: frankenphp: Operation not permitted

The text was updated successfully, but these errors were encountered:

withinboredom · 2024-05-12T12:47:40Z

FrankenPHP (the official images) are built with that capability requirement baked in the Dockerfile. If you are on Linux, you have to give it that NET_BIND capability even if you are only using high ports.

You have to fork and build a completely custom container if you want a truly rootless container.

dunglas · 2024-05-12T12:51:41Z

Maybe could we move the capacity requirement in another stage or something like that?

jbonnier · 2024-05-13T01:09:09Z

I think there is something that happens when frankenphp starts. Ie. Maybe it tries to listen on the default ports which would require the capability.

jbonnier · 2024-05-13T01:22:54Z

I finally fixed my problem by simply adding RUN setcap -r /usr/local/bin/frankenphp in my Dockerfile.

withinboredom · 2024-05-13T07:36:19Z

@jbonnier brilliant!

jbonnier added the bug Something isn't working label May 12, 2024

dunglas mentioned this issue May 13, 2024

docs: rootless Docker images with no capabilities #779

Merged

dunglas closed this as completed in #779 May 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't run rootless with no capabilities #777

Can't run rootless with no capabilities #777

jbonnier commented May 12, 2024

withinboredom commented May 12, 2024

dunglas commented May 12, 2024

jbonnier commented May 13, 2024

jbonnier commented May 13, 2024

withinboredom commented May 13, 2024

Can't run rootless with no capabilities #777

Can't run rootless with no capabilities #777

Comments

jbonnier commented May 12, 2024

What happened?

Build Type

Worker Mode

Operating System

CPU Architecture

PHP configuration

Relevant log output

withinboredom commented May 12, 2024

dunglas commented May 12, 2024

jbonnier commented May 13, 2024

jbonnier commented May 13, 2024

withinboredom commented May 13, 2024