search

aws / containers-roadmap

This is the public roadmap for AWS container services (ECS, ECR, Fargate, and EKS).
https://aws.amazon.com/about-aws/whats-new/containers/
Other
5.21k stars 319 forks source link

Support of "GroupAdd" configuration. #350

Open taraspos opened 6 years ago

taraspos commented 6 years ago

Summary

Docker client support option --group-add or API parameter 

       "HostConfig": {
         ...
         "GroupAdd": ["newgroup"],
         ...
}

Would be nice to be able to set this parameter from the TaskDefinition. Support of this configuration was introduced in the API v1.20

adnxn commented 6 years ago

@Trane9991, thanks for bringing this to our attention. We'll track this as a feature request and update the issue accordingly.

jonathan-fugue commented 6 years ago

I'd also like to have the ability to use the docker run --group-add option.

sardesai-ashish commented 4 years ago

Would definitely want to specify Docker option --group-add via ECS Task Definition.

Container defined under ECS Task Definition is unable to access "docker api" via the container which is running as a non-root user. By passing the option: --group-add $(stat -c '%g' /var/run/docker.sock) to the docker run command line; the container (running as non-root user) is able to access the docker api from inside the container. But currently there is no support for this option in ECS Task Definition.

The following approach does NOT work; provide option --user :docker I.e. unable to access "docker api"

The following approach works; provide option --user :497 I.e. specify GID of docker group which is 497 on Amazon "ecs-optimized" AMI However due to hardcoding of the docker group GID, this is not a sustainable solution.

gregtws commented 1 year ago

Ran into this issue today and had to do the above workaround. It would be really nice to support this.

gregtws commented 1 year ago

For others, I'd point out that the workaround is fragile. We've had EC2 nodes whose GID of the docker group changed (AWS side changed it, not us). Why, no idea. Either way it broke some services.