search

RotherOSS / otobo-docker

OTOBO Docker and Docker Compose files.
GNU General Public License v3.0
32 stars 16 forks source link

Docker containers should not run as root #6

Closed bschmalhofer closed 4 years ago

bschmalhofer commented 4 years ago

The containers should not run as root.

TODO:

bschmalhofer commented 4 years ago

Looks like otobo_db_1 can be run as mysql:mysql. This setting can be specied in docker-compose/otobo-base.yml.

otobo_elastic_1 already runs as elasticsearch:root . The group root has no special privileges on CentOS.

otobo_nginx_1: This is a bit more work, as only root has rights for ports below 1024. But according to http://pjdietz.com/2016/08/28/nginx-in-docker-without-root.html this can easily be handled.

otobo_redis_1: Looks like the user already drops down to the used redis. Specifyin redis:redis in docker-compose/otobo-base.yml should work

bschmalhofer commented 4 years ago

otobo_nginx_1 can keep running as root. Nginx runs only the master process as root, and then switches to a non-root user. Running as non-root would require that the SSL private key is also readable as non-root. And this is not helping with security.

bschmalhofer commented 4 years ago

Checked the containers. Closing this issue.

bschmalhofer commented 4 years ago

Reopening as the feature should be backported to 10.0.4

bschmalhofer commented 4 years ago

Looks good so far. Closing this issue.