Skip to content
This repository has been archived by the owner on Jul 4, 2021. It is now read-only.

No longer run wdqs process as root #125

Merged
merged 1 commit into from
Jun 17, 2020
Merged

No longer run wdqs process as root #125

merged 1 commit into from
Jun 17, 2020

Conversation

addshore
Copy link
Contributor

This change makes use of https://github.com/ncopa/su-exec which is
included as a base alpine package.
gosu is recommended by
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
however gosu itself suggests you might want to use su-exec, especially
if you are using alpine.

Any previous wdqs/data directories will be chowned to blazegraph.
the wdqs is now also owned by the blazegraph user.

When chowning the data dir I considered checking who owned it before
running chown, but chown should be fine, and also shoudln't be slow etc,
as the data directory should not include many files.

Bug: T237248

@addshore
Copy link
Contributor Author

Needs #126 first

This change makes use of https://github.com/ncopa/su-exec which is
included as a base alpine package.
gosu is recommended by
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
however gosu itself suggests you might want to use su-exec, especially
if you are using alpine.

Any previous wdqs/data directories will be chowned to blazegraph.
the wdqs is now also owned by the blazegraph user.

When chowning the data dir I considered checking who owned it before
running chown, but chown should be fine, and also shoudln't be slow etc,
as the data directory should not include many files.

Bug: T237248
Copy link
Collaborator

@micgro42 micgro42 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tried it out and 1: it still works and 2: ps aux looks good:

PID   USER     TIME  COMMAND
    1 root      0:00 {entrypoint.sh} /bin/bash /entrypoint.sh /runBlazegraph.sh
   12 blazegra  0:00 bash /runBlazegraph.sh
   13 blazegra  0:36 java -server -XX:+UseG1GC -Xmx1g -Xloggc:/var/log/wdqs/wdqs-blazegraph_jvm_gc.%p-%t.log -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintGCTimeStamps -XX:+Print
  111 root      0:00 bash
  123 root      0:00 ps aux

@micgro42 micgro42 merged commit da7a9c2 into master Jun 17, 2020
@micgro42 micgro42 deleted the wdqsNonRoot branch June 17, 2020 12:56
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants