maven - 以非 root 用户身份运行 docker 或以 root 用户身份在 tomcat 上运行 jenkins

Question

我正在尝试使用 docker-maven 插件构建一个 docker 镜像，并计划使用 jenkins 执行 mvn 命令。我将 jenkins.war 部署在 tomcat 实例上，而不是作为非根用户运行的独立应用程序。问题是 docker 需要以 root 用户身份运行，因此 maven 命令需要以 root 用户身份运行，因此 jenkins/tomcat 需要以 root 用户身份运行，这不是一个好的做法(尽管我的非 root 用户是也 sudoer 所以我想不会很重要)。

所以最重要的是，我看到了两个解决方案:要么以非 root 用户身份运行 docker(并且需要有关如何执行此操作的帮助)或者需要以 root 身份运行 jenkins(并且不确定如何实现，因为我更改了环境变量/config 但仍然没有切换到 root)。

关于选择哪种解决方案以及如何实现它有什么建议吗？

Answer 1

The problem is that docker needs to be run as root user, so maven commands need to be run as root user,

不，docker run 可以用 -u (--user) parameter 完成以便在容器内使用非根用户。

Either run docker as non-root user

Your user (on the host) needs to be part of the docker group .然后您可以使用该用户运行 docker 服务。

如评论所述，这不是很安全。
见:

• "chrisfosterelli/dockerrootplease "
• "Understanding how uid and gid work in Docker containers "

最后一个链接以以下发现结束:

• If there’s a known uid that the process inside the container is executing as, it could be as simple as restricting access to the host system so that the uid from the container has limited access.
• The better solution is to start containers with a known uid using the--user (you can use a username also, but remember that it’s just a friendlier way of providing a uid from the host’s username system), and then limiting access to the uid on the host that you’ve decided the container will run as.
• Because of how uids and usernames (and gids and group names) map from a container to the host, specifying the user that a containerized process runs as can make the process appear to be owned by different users inside vs outside the container.

关于最后一点，您现在有 user namespace (userns) remapping (自 docker 1.10 起，但我建议使用 17.06，因为 issue 33844)。