Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Docker runs etherpad as root user #3629

Closed
badgateway666 opened this issue Jul 31, 2019 · 6 comments · Fixed by #3643
Closed

Docker runs etherpad as root user #3629

badgateway666 opened this issue Jul 31, 2019 · 6 comments · Fixed by #3643

Comments

@badgateway666
Copy link

Hey, i've noticed etherpad/node is running under the root user account in the default docker container.
Is there any special reason it has to be like that?

#1315 mentions it would be advisable to have ep run as a special etherpad user
@zem
Copy link

zem commented Aug 12, 2019

+1 pse fix

@fanjin-z
Copy link

It's common practice to run as root in container just for simplicity. Unless you want to run many different services in a single container, which is generally not advisable.

pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Sep 30, 2019
@pierreprinetti
docker: Run as unprivileged user
efcdac3 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
run the main process using that user.

Fixes ether#3629
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Sep 30, 2019
@pierreprinetti
docker: Run as unprivileged user
ba9f43a 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

Fixes ether#3629
@pierreprinetti pierreprinetti mentioned this issue Sep 30, 2019
Merged
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 20, 2019
@pierreprinetti
docker: Run as unprivileged user
d31df53 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

Fixes ether#3629
@pierreprinetti
Copy link
Contributor

It's common practice to run as root

Using the root user in a container is bad practice, discouraged and even forcefully prevented by default on some platforms.

The good news is that the fix is trivial, as Etherpad does not actually need root privileges to run.

pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 24, 2019
@pierreprinetti
docker: Run as unprivileged user
5f50d5a 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

Fixes ether#3629
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 24, 2019
@pierreprinetti
docker: Run as unprivileged user
8e9ae53 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

Fixes ether#3629
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 24, 2019
@pierreprinetti
docker: Run as unprivileged user
446fd02 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes ether#3629
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 24, 2019
@pierreprinetti
docker: Run as unprivileged user
393cc3b 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes ether#3629
pierreprinetti added a commit to pierreprinetti/etherpad that referenced this issue Oct 24, 2019
@pierreprinetti
docker: Run as unprivileged user
a56f15c 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes ether#3629
muxator pushed a commit that referenced this issue Oct 24, 2019
@pierreprinetti @muxator
docker: Run as unprivileged user
eea99fe 
Processes in containers should not run as root.
This change creates an unprivileged user in the Docker container, and
runs the main process using that user.

References:
* https://en.wikipedia.org/wiki/Principle_of_least_privilege
* https://medium.com/@mccode/processes-in-containers-should-not-run-as-root-2feae3f0df3b
* https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/

Fixes #3629
@muxator
Copy link
Contributor

muxator commented Oct 24, 2019

Merged #3643. Thanks @pierreprinetti for reworking the commit.

@fanjin-z
Copy link

Using the root user in a container is bad practice

@pierreprinetti I don't think it's possible that a root user in a container can escalate to be root user on the host machine.

The example in docker official document Best practices for writing Dockerfiles does not switch to unprivileged user.

@pierreprinetti
Copy link
Contributor

@Fnjn
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user

If a service can run without privileges, use USER to change to a non-root user.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

docker: Run as unprivileged user pierreprinetti/etherpad
5 participants
@zem @badgateway666 @muxator @pierreprinetti @fanjin-z