docker - 除了 root 之外，您如何运行 Openshift Docker 容器？

Question

我目前正在运行 Openshift，但是当我尝试构建/部署我的自定义 Docker 容器时遇到了问题。该容器在我的本地机器上正常工作，但是一旦它在 openshift 中构建并尝试部署它，我就会收到错误消息。我相信问题是因为我试图以 root 身份在容器内运行命令。

(13)Permission denied: AH00058: Error retrieving pid file /run/httpd/httpd.pid

我正在部署的 Docker 文件如下所示 -

FROM centos:7
MAINTAINER me<me@me>
RUN yum update -y
RUN yum install -y git https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

RUN yum install -y ansible && yum clean all -y
RUN git clone https://github.com/dockerFileBootstrap.git
RUN ansible-playbook "-e edit_url=andrewgarfield edit_alias=emmastone site_url=testing.com" dockerAnsible/dockerFileBootstrap.yml
RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \
rm -f /lib/systemd/system/multi-user.target.wants/*;\
rm -f /etc/systemd/system/*.wants/*;\
rm -f /lib/systemd/system/local-fs.target.wants/*; \
rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
rm -f /lib/systemd/system/basic.target.wants/*;\
rm -f /lib/systemd/system/anaconda.target.wants/*;
COPY supervisord.conf /usr/etc/supervisord.conf
RUN rm -rf supervisord.conf
VOLUME [ "/sys/fs/cgroup" ]
EXPOSE 80 443
#CMD ["/usr/bin/supervisord"]
CMD ["/usr/sbin/httpd", "-D", "FOREGROUND"]

我多次遇到类似的问题，它会说 Permission Denied on file/supervisord.log 或类似的东西。

如何设置它，使我的容器不会以 root 身份运行所有命令？它似乎导致了我遇到的所有问题。

Answer 1

Openshift 对自定义 Docker 构建有严格的安全政策。

看看这个OpenShift Application Platform

特别是在常见问题解答部分的第 4 点，此处引用。

4. Why doesn't my Docker image run on OpenShift?

Security! Origin runs with the following security policy by default:

Containers run as a non-root unique user that is separate from other system users They cannot access host resources, run privileged, or become root They are given CPU and memory limits defined by the system administrator Any persistent storage they access will be under a unique SELinux label, which prevents others from seeing their content These settings are per project, so containers in different projects cannot see each other by default Regular users can run Docker, source, and custom builds By default, Docker builds can (and often do) run as root. You can control who can create Docker builds through the builds/docker and builds/custom policy resource. Regular users and project admins cannot change their security quotas.

Many Docker containers expect to run as root (and therefore edit all the contents of the filesystem). The Image Author's guide gives recommendations on making your image more secure by default:

Don't run as root

Make directories you want to write to group-writable and owned by group id 0 Set the net-bind capability on your executables if they need to bind to ports <1024

Otherwise, you can see the security documentation for descriptions on how to relax these restrictions.

希望对你有帮助。