linux - 如何更改 openshift 容器平台中的权限？

Question

我是 Openshift 的新手。
我已经在 openshift 中部署了一个应用程序。当我检查日志时，某些文件存在权限被拒绝错误。
现在，我想更改已部署在 Openshift 中的容器的权限，但收到“不允许操作”警告。我该如何解决 ？

这适用于运行最新版本 MongoDB 的 linux。我已经尝试在我的 docker 文件中执行 RUN chmod 777/path/to/directory，创建图像并在我的 yaml 文件中提取相同的图像，我正在我的 openshift 中部署它。但是，当我检查我的 docker 容器时，它显示该目录的权限已更改，但是当我部署时，我在日志中收到警告为“权限被拒绝”。

FROM node:10.16.3

RUN apt update && apt install -y openjdk-8-jdk

RUN useradd -ms /bin/bash admin

# Set the workdir /var/www/myapp
WORKDIR /var/www/myapp

# Copy the package.json to workdir
COPY package.json .

# Run npm install - install the npm dependencies
RUN npm install

RUN npm install sqlite3

# Copy application source
COPY . .

RUN chown -R admin:admin /var/www/myapp

RUN chmod 775 /var/www/myapp

USER admin

# Copy .env.docker to workdir/.env - use the docker env
#COPY .env.docker ./.env

# Expose application ports - (4300 - for API and 4301 - for front end)
# EXPOSE 4300 4301
EXPOSE 52000

CMD [ "npm", "start" ]

不过，当我运行 dockerifle 时，权限已更改，但是当我尝试在 openshift 中部署时，该目录中的某些文件的权限被拒绝。

Answer 1

默认情况下，在 OpenShift 中启动的任何容器都会获得一个随机用户 ID。因此，不是设计用于处理此类随机 UID 的图像将因权限错误而失败。
为了让您的图像正常工作，我建议您阅读以下最新 OpenShift 文档的文章:https://docs.openshift.com/container-platform/4.2/openshift_images/create-images.html
这是与您的问题相关的简短版本:

SUPPORT ARBITRARY USER IDS

By default, OpenShift Container Platformruns containers using an arbitrarily assigned user ID. This providesadditional security against processes escaping the container due to acontainer engine vulnerability and thereby achieving escalatedpermissions on the host node.

For an image to support running as an arbitrary user, directories andfiles that may be written to by processes in the image should be ownedby the root group and be read/writable by that group. Files to beexecuted should also have group execute permissions.

Adding the following to your Dockerfile sets the directory and filepermissions to allow users in the root group to access them in thebuilt image:

RUN chgrp -R 0 /some/directory && \
    chmod -R g=u /some/directory 

Because the container user is always a member of the root group, the container user can read and writethese files. The root group does not have any special permissions(unlike the root user) so there are no security concerns with thisarrangement. In addition, the processes running in the container mustnot listen on privileged ports (ports below 1024), since they are notrunning as a privileged user.