Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow running under root on Linux when unshare is available #39

Merged
merged 2 commits into from
Aug 16, 2020

Conversation

jameshilliard
Copy link

I've reworked the unshare parts from #23 so that we test once on initialization that unshare is useable when running as root on Linux. This should avoid any cryptic errors when unshare is unavailable.

I've also reworked the runner to execute the postgres binary directly as opposed to being backgrounded by pg_ctl. This has the advantage of preventing orphan postgres in the event that cleanup fails as the postgres process should effectively be a child of the java module which would get killed at the same time as the java module.

Copy link
Collaborator

@tomix26 tomix26 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much for your effort. The issues related to Docker must be addressed before merging.

} catch (InterruptedException e) {
throw new RuntimeException(e);
}
if (process.exitValue() == 0 && br.readLine() != "0") {
Copy link
Collaborator

@tomix26 tomix26 Jul 24, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, when I tried it on Docker, it didn't work as expected. The useUnshare variable was always set to false. I also tried to run unshare -U id -u command manually in a docker container but I got unshare failed: Operation not permitted error. When I investigated the problem further, I came to the conclusion that Docker blocks the unshare command by default because it has caused a lot of local privilege escalations over time. So the only workaround I've found is to use --privileged option, which works but it doesn't seem to be an ideal solution.

Could you please investigate it further and find a suitable solution? Because without working it on Docker is this change useless.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I hadn't really targeted docker as the main use case for this change so much as throwaway testing VM's where root is the default user or for cases where one wants to test a java application that itself needs to run as root(for example some system utility than needs full privileges) on the host. This check is to ensure that unshare is only used when it is confirmed to function correctly so that confusing error messages don't get generated.

Basically the unshare command can be thought of as a lightweight docker alternative for changing the uid. I think --privileged is needed because this is somewhat like a docker in docker.

Copy link
Collaborator

@tomix26 tomix26 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks again for your contribution. I've polished the code a bit and updated the documentation accordingly.

@tomix26 tomix26 merged commit d3f6854 into zonkyio:master Aug 16, 2020
@tomix26 tomix26 added this to the 1.2.8 milestone Aug 16, 2020
@jameshilliard jameshilliard deleted the root-unshare branch September 26, 2020 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants