Feature/container uid

[mblaschke]

• Add support for eg. docker run --user 999 webdevops/php-apache:ubuntu-16.04

[htuscher]

I'm not quite sure if that's within the concept of docker, because I don't know of any other image having that functionality. Usually you have a fixed user running everything inside the container e.g. nginx, elasticsearch, postgres, etc.
But implementation looks good though.

[mblaschke]

The master process of FPM needs AFAIK root rights for eg. slowlog so it should be started as root.
Also most of the configuration files are not changeable for other users for security reasons: An attacker (via FPM) can modify configuration files or other files.

So i'm detecting that docker container is not running as root, privilege escalation via gosu and remove the suid bit after privilege escalation. So the main entrypoint is still running via root but the application can be run as normal user.
If we don't use privilege escalation then all processes must be able to run under this user which will be more difficult.

With this fix we can run FPM under any user and new files are also created under this UID and is not fixed to UID 1000 anymore.

[mblaschke]

eg. FPM configuration and all other configuration which are modified after ENTRYPOINT startup (eg. by env vars) must be world writeable if we don't do privilege escalation. I'm really not happy with world writeable configuration files.

[sergeyklay]

How about adding wget in next section (below)

[sergeyklay]

wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture | awk -F- '{ print $NF }').asc"

[mblaschke]

I've only used the part from the "official" installation and wanted to keep the steps :)
https://github.com/tianon/gosu

[sergeyklay]

https://github.com/tianon/gosu#from-debian

[htuscher]

@mblaschke ok, I'll get it. Brilliant solution!