running oracle 18.4.0 XE on openshift as non-root user

[mipe]

I am trying to run the oracle 18.4.0 XE image on an openshift cluster. Openshift starts containers with arbitrary user ids and not as root which causes the container to crash immediately:

ORACLE_HOME = [/home/oracle] ? ORACLE_BASE environment variable is not being set since this
information is not available for the current user ID .
You can set ORACLE_BASE manually if it is required.
Resetting ORACLE_BASE to its previous value or ORACLE_HOME
The Oracle base remains unchanged with value /opt/oracle
#####################################
########### E R R O R ###############
DATABASE SETUP WAS NOT SUCCESSFUL!
Please check output for further info!
########### E R R O R ###############
#####################################
The following output is now a tail of the alert.log:
tail: cannot open '/opt/oracle/diag/rdbms/*/*/trace/alert*.log' for reading: No such file or directory
tail: no files remaining

So is there a way to start the container as non-root user?

I tried using USER 54321 in the Dockerfile to start as user 'oracle' but this will also cause an error.

[gvenzl]

Do you have more information on what crashes or what the error is that you are getting?
The output above just indicates that a database hasn't been created.

[no-response]

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.

[idlefella]

I'm facing the same issue when I try to run the oracle database (single instance) on openshift. As mentioned by @mipe, Openshift runs Images in a very restricted manner:

• The userids are randomly generated when the container is started. Therefore the userid (here 54321 of the user oracle) can't be hardcoded in /etc/passwd and has to be added on bootup of the container. The permission issue is solved by making the /etc/passwd file writable to the group root (gid=0).
• Per default, the container has several capabilities dropped, e.g. setuid and setgid, therefore commands like su -p oracle -c "xxx" won't work in openshift, because we can't change the userid. We have to use the random userid which has been assigned from openshift to our pod.
• I've already invested quite some time into making the container run with these restricted priviledges, but haven't succeeded yet because I have to basically reverse engineer the behaviour of the configuration commands.

What I did so far:

1. Build the oracle database (in our case 18.4.0) with

git clone git@github.com:oracle/docker-images.git
cd OracleDatabase/SingleInstance/dockerfiles
./buildDockerImage.sh -v 18.4.0 -x

2. Run the image with dropped capabilities:

docker run --rm -e ORACLE_PWD=testtest --cap-drop=setuid --cap-drop=setgid --name oracle --user 1000000 oracle/database:18.4.0-xe

1000000 is just a "random" userid.

3. The log output shows the following:

ORACLE PASSWORD FOR SYS AND SYSTEM: testtest
Specify a password to be used for database accounts. Oracle recommends that the password entered should be at least 8 characters in length, contain at least 1 uppercase character, 1 lower case character and 1 digit [0-9]. Note that the same password will be used for SYS, SYSTEM and PDBADMIN accounts:
Confirm the password:
Configuring Oracle Listener.
su: cannot set groups: Operation not permitted
su: cannot set groups: Operation not permitted
Listener configuration failed. Check log '/opt/oracle/cfgtoollogs/netca/netca_configure_out.log' for more details.
su: cannot set groups: Operation not permitted
su: cannot set groups: Operation not permitted
su: cannot set groups: Operation not permitted
su: cannot set groups: Operation not permitted
su: cannot set groups: Operation not permitted
cp: cannot create regular file '/opt/oracle/oradata/dbconfig/XE/': No such file or directory
cp: cannot stat '/opt/oracle/oradata/dbconfig/XE/oratab': No such file or directory
ORACLE_HOME = [/home/oracle] ? ORACLE_BASE environment variable is not being set since this
information is not available for the current user ID .
You can set ORACLE_BASE manually if it is required.
Resetting ORACLE_BASE to its previous value or ORACLE_HOME
The Oracle base remains unchanged with value /opt/oracle
#####################################
########### E R R O R ###############
DATABASE SETUP WAS NOT SUCCESSFUL!
Please check output for further info!
########### E R R O R ###############
#####################################
The following output is now a tail of the alert.log:
tail: cannot open '/opt/oracle/diag/rdbms/*/*/trace/alert*.log' for reading: No such file or directory
tail: no files remaining

4. From this point, I started applying different patches, e.g.

   1. Setting the uid of the user at runtime in /etc/passwd
   2. Changing file permissions of the /opt/oracle/oradata folder to g=rw, such that all users in the group root can access them.
   3. Many more changes...

   I was able to solve pretty many problems, but I'm stuck with these logs:

   Copying database files
   9% complete
   [WARNING] ORA-12547: TNS:lost contact
   
   31% complete
   100% complete
   [FATAL] Error while cataloging RMAN Backups
   8% complete
   0% complete
   Look at the log file "/opt/oracle/cfgtoollogs/dbca/XE/XE.log" for further details.
   

   I also appended all logs from the cfgtoollogs folder.

Do you know what the problem could be? It would be nice to make the oracle database run on openshift because many companies might need that. I will also upload the full code I used to another public repo.

cfgtoollogs.tar.gz

[avogt-sundn]

allow the oracle pod to run with user id 54321 and it will work.
this can be achieved with a serviceaccount - https://github.com/avogt-sundn/oracle-on-openshift

[altaf369us]

I'm also running into same issue. we build oracle express version 18xe, and while deploying that image container on ocp, it is failing with the following error messages attached screenshot,

[simionescudarius]

Change the UID of the 54321 (oracle) user to match with the user used by openShift to run pods.

You can rebuild the docker image and do something like this

FROM .... oracle

USER root
RUN usermod -u 96988035 oracle  --> (In my case, OC runs the pods using this UID: 96988035)
RUN find /opt -uid 54321 -exec chown -v -h 96988035 '{}' \; 

USER 96988035 

[AdrienHorgnies]

@simionescudarius How can you know the UID at build time ?

During the creation of a project or namespace, OpenShift assigns a User ID (UID) range, a supplemental group ID (GID) range, and unique SELinux MCS labels to the project or namespace.
...
When a Pod is deployed into the namespace, by default, OpenShift will use the first UID and first GID from this range to run the Pod.

Source: https://cloud.redhat.com/blog/a-guide-to-openshift-and-uids