-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
WIP: introduce unprivileged images #772
Conversation
7140b0b
to
2e00c8c
Compare
Nice work! |
This is indeed nice. Could you separate your PR on 2 commits, one with the changes and one with the update.sh? This makes it easier to review. Thanks :) |
Signed-off-by: Stephan Müller <mail@stephanmueller.eu>
2e00c8c
to
81b9c10
Compare
Signed-off-by: Stephan Müller <mail@stephanmueller.eu>
81b9c10
to
51d464d
Compare
@pierreozoux I did a rebase on the latest master commit and seperated the changes into two seperat commits. In the meantime, I changed my mind and think it is not worth the effort to support both, privileged and unprivileged container images. The default one should always be unprivileged. With that in mind, I stopped working on this PR because it is not target-oriented for me. |
You are right, everything should be unpriviledged and readonly, imho too :) |
wouldn't it be enough to add a environment var, that changes the port? Running as an unprivileged user is already possible with |
Using the |
Additionally to what @smueller18 said, there are a few more cases where nextcloud don't work right when you set the --user parameter. For example (at least, with the apache image):
I think the only clean solution to this would be to make the entrypoint script aware for UID/GID env variables. The entrypoint could make the changes above as root and then start the services under the unprivileged UID/GID. I think this is described in #359 |
fix: nextcloud#359, nextcloud#772, nextcloud#1081, nextcloud#1087, nextcloud#1278 Signed-off-by: J0WI <J0WI@users.noreply.github.com>
fix: nextcloud#359, nextcloud#772, nextcloud#1081, nextcloud#1087, nextcloud#1278 Signed-off-by: J0WI <J0WI@users.noreply.github.com>
closing due #1812 |
fix: nextcloud#359, nextcloud#772, nextcloud#1081, nextcloud#1087, nextcloud#1278 Signed-off-by: J0WI <J0WI@users.noreply.github.com> Signed-off-by: J0WI <J0WI@users.noreply.github.com>
fix: nextcloud#359, nextcloud#772, nextcloud#1081, nextcloud#1087, nextcloud#1278 Signed-off-by: J0WI <J0WI@users.noreply.github.com> Signed-off-by: J0WI <J0WI@users.noreply.github.com>
Following Docker best practices, all images should run as non-root user. This PR introduces
nginx
image withnginxinc/nginx-unprivileged
Todos:
nextcloud:unprivileged
)Closes #760