Arbitrary user for container

steakhutzeee commented 3 years ago

Hi,

have a quick question, can this container be run as an user different from root?

Thanks!

fradelg commented 3 years ago

Hi,

I haven't tried but technically you can as long as that user has access to the mounted volume where the backups are stored. You might have some issues with the rights of the executable scripts copied into the docker image but the best way to know is trying it.

steakhutzeee commented 3 years ago

Hi,

I haven't tried but technically you can as long as that user has access to the mounted volume where the backups are stored. You might have some issues with the rights of the executable scripts copied into the docker image but the best way to know is trying it.

These are the logs:

today at 00:45:11  2021/05/01 00:45:11 Waiting for: tcp://bookstack_db:3306
today at 00:45:11  2021/05/01 00:45:11 Connected to tcp://bookstack_db:3306
today at 00:45:11  touch: /mysql_backup.log: Permission denied
today at 00:45:11  tail: can't open '/mysql_backup.log': No such file or directory
today at 00:45:11  => Create a backup on the startup
today at 00:45:11  => Backup started at 2021-05-01 00:45:11
today at 00:45:11  ==> Dumping database: bookstackapp
today at 00:45:11  ==> Creating symlink to latest backup: 202105010045.bookstackapp.sql.gz
today at 00:45:11  /
today at 00:45:12  => Backup process finished at 2021-05-01 00:45:12
today at 00:45:12  /run.sh: line 18: /crontab.conf: Permission denied
today at 00:45:12  crontab: must be suid to work properly
today at 00:45:12  => Running cron task manage

The backup is created successfully but as you said i have some permission issues. There is a way to fix this?

steakhutzeee commented 3 years ago

Hi,

any hint? :)

fradelg commented 3 years ago

Can you paste your docker cli line or docker-compose.yml file to reproduce the issue?

steakhutzeee commented 3 years ago

Can you paste your docker cli line or docker-compose.yml file to reproduce the issue?

Sure:

mysql-cron-backup:
    image: fradelg/mysql-cron-backup
    container_name: bookstack_db_bak
    depends_on:
        - bookstack_db
    user: 1000:100
    volumes:
       - /srv/dev-disk-by-label-HC2/AppData/bookstack_db_bak/backup:/backup
    environment:
      - MYSQL_HOST=bookstack_db
      - MYSQL_USER=xxx
      - MYSQL_PASS=xxx
      - MAX_BACKUPS=7
      - INIT_BACKUP=1
      - CRON_TIME=0 0 * * * # Every day at 00
      - GZIP_LEVEL=9 # High compression level
      - TZ=Europe/Rome
      - MYSQLDUMP_OPTS=--skip-lock-tables --single-transaction --quick
    restart: unless-stopped

Actually the cron is not workin so no backup is performed.

fradelg commented 3 years ago

Please, give a try to the new image fradelg/mysql-cron-backup:no-root-user

steakhutzeee commented 3 years ago

Please, give a try to the new image fradelg/mysql-cron-backup:no-root-user

Thanks for this.

I see no errors, but the schedule is not working. I have two instances of the image to backup two different databases and both are not working at the scheduled time (midnight gmt +2)

    yesterday at 22:21:16  2021/05/08 22:21:16 Waiting for: tcp://bookstack_db:3306
    yesterday at 22:21:16  2021/05/08 22:21:16 Connected to tcp://bookstack_db:3306
    yesterday at 22:21:16  => Create a backup on the startup
    yesterday at 22:21:16  => Backup started at 2021-05-08 22:21:16
    yesterday at 22:21:17  ==> Dumping database: bookstackapp
    yesterday at 22:21:19  ==> Creating symlink to latest backup: 202105082221.bookstackapp.sql.gz
    yesterday at 22:21:19  /
    yesterday at 22:21:19  => Backup process finished at 2021-05-08 22:21:19
    yesterday at 22:21:19  => Running cron task manager

fradelg commented 3 years ago

Sorry, but it seems like the cron daemon cannot be run as any other user that root to schedule tasks from other users:

https://stackoverflow.com/questions/53103621/how-to-start-crond-as-non-root-user-in-a-docker-container

I get:

backup_1   | => Running cron task manager
backup_1   | crond: root: Permission denied
backup_1   | crond: cronuser: Permission denied
backup_1   | crond: root: Permission denied
backup_1   | crond: cronuser: Permission denied

So if you still need to run the backup as a non-root user you should search for a different docker image.

steakhutzeee commented 3 years ago

Thank you for your deep dive on this!

fradelg / docker-mysql-cron-backup

Arbitrary user for container #46