Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[4pt] Сhange the way you use USER instruction in Dockerfile #481

Closed
vanyarock01 opened this issue Feb 26, 2021 · 0 comments · Fixed by #514
Closed

[4pt] Сhange the way you use USER instruction in Dockerfile #481

vanyarock01 opened this issue Feb 26, 2021 · 0 comments · Fixed by #514
Assignees
@mRrvz

Comments

@vanyarock01
Copy link
Contributor

What is meant? Now the default runtime container user is set like this:

USER tarantool:tarantool

What is the problem with this method? The problem occurs when trying to install an builded image in a unprivileged Kubernetes container. The problem is described here.

The error occurs because it is important for the Kubernetes how the user was assigned (by name or UID). If you set a user by name, then Kubernetes cannot check the user's privileges. This happens because the container runtime interface of the Kubernetes has either an UID or a username. UID and the following user name are mutually exclusive. It's just how the container runtime interface standard got designed.

The problem can be solved by installing the user (and his group) by UID (assuming tarantool UID and GID are 1200):

USER 1200:1200
@vanyarock01 vanyarock01 mentioned this issue Feb 26, 2021
Closed
@dokshina dokshina changed the title Сhange the way you use USER instruction in Dockerfile [4pt] Сhange the way you use USER instruction in Dockerfile Mar 11, 2021
@dokshina dokshina assigned mRrvz and unassigned dokshina Mar 11, 2021
@mRrvz mRrvz mentioned this issue Mar 21, 2021
Merged
mRrvz added a commit that referenced this issue Mar 26, 2021
@mRrvz
USER instruction in Dockerfile uses UID and GID numbers (#514)
ec6201c 
 It is possible to run an image generated with the ``cartridge pack docker`` command in an unprivileged Kubernetes container. It became possible, because tarantool user now always has ``UID = 1200`` and ``GID = 1200``. Closes #481
@Totktonada Totktonada mentioned this issue Oct 1, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mRrvz mRrvz

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

USER instruction in Dockerfile uses UID and GID numbers tarantool/cartridge-cli
3 participants
@vanyarock01 @dokshina @mRrvz