revant
commented
3 years ago except for nginx container all containers run as non root
this was a pending issue https://github.com/frappe/frappe_docker/issues/493
Closed Tus1688 closed 2 years ago
revant
commented
3 years ago except for nginx container all containers run as non root
this was a pending issue https://github.com/frappe/frappe_docker/issues/493
Tus1688
commented
3 years ago Hi @revant, thank you for replying. I wonder if podman work with compose installation? Because, it would be awesome if all containers run as non root
revant
commented
3 years ago as mentioned in the issue, probably we'll have to build nginx image from scratch with uid:gid 1000:1000.
anyone up for that refactor?
revant
commented
3 years ago nginx unprivileged image does not run as 1000:1000 user. worker image runs as 1000:1000
Another idea is to build worker images that can be made to use configurable uid gid? It'll need to handle migration of current 1000:1000 setups with docker and kubernetes.
Any ideas what else can be done?
revant
commented
2 years ago Check if you can build the image based on PR and try it out.
continue discussion on PR
revant
commented
2 years ago can you add 1 more container to you docker-compose that fixes the vol permission. I'm trying to get it running with podman and facing the issue. I'll update here.
...
fix-vol-permissions:
image: frappe/frappe-worker:${ERPNEXT_VERSION}
user: root
command: chown -R 1000:1000 /sites /assets /logs
volumes:
- sites-vol:/sites
- assets-vol:/assets
- logs-vol:/logs
...Note: I've not yet found a way to fix it.
Tus1688
commented
2 years ago Sure, let me try
Update: after adding 1 more container, I still got same error. To be honest, I am not really sure where the error come from
revant
commented
2 years ago it comes from erpnext-nginx container.
can you try adding depends_on to erpnext-nginx service:
erpnext-nginx:
...
depends_on:
- fix-vol-permissions
...make sure you pull the images again after #572 is merged
Tus1688
commented
2 years ago It seems permission issue has gone away, but new issue arise. When I open my site, I got 404 page not found
logs of erpnext-nginx:
Generating default template
Waiting for frappe-python to be available on erpnext-python port 8000
Frappe-python available on erpnext-python port 8000
Waiting for frappe-socketio to be available on frappe-socketio port 9000
Frappe-socketio available on frappe-socketio port 9000
2021/11/20 03:15:39 [notice] 1#1: using the "epoll" event method
2021/11/20 03:15:39 [notice] 1#1: nginx/1.21.4
2021/11/20 03:15:39 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6)
2021/11/20 03:15:39 [notice] 1#1: OS: Linux 4.18.0-305.19.1.el8_4.x86_64
2021/11/20 03:15:39 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2021/11/20 03:15:39 [notice] 1#1: start worker processes
2021/11/20 03:15:39 [notice] 1#1: start worker process 36
2021/11/20 03:15:39 [notice] 1#1: start worker process 37Edit: have you get it running on podman?
revant
commented
2 years ago have you get it running on podman?
not exactly. everything started but nginx kept failing. I'm using rootless podman, I think containers with ports on < 1000 may cause issues. I tried to publish it on 8080.
there is no permission error after fix-vol-permissions. the erpnext-nginx container keeps restarting even in 8080
for the 404 not found check this: https://discuss.erpnext.com/t/production-installation-using-frappe-docker/82677/2?u=revant_one
I'll close this issue. Re-open or open another if needed.
Description of the issue
Hi everyone! Thank you for making ERP next deployment become easier and less complicated. I tried to harden docker daemon using SELinux. Luckily, this happen to my testing server, I create /etc/docker/daemon.json then fill it with
FYI, I have enabled selinux before updating to latest version of ERP next, and it worked as it supposed to be. Then.... everything has change after rebuilding container to latest version using
docker-compose pullanddocker-compose up -d, I gotbad gatewaywhen trying to access our sites.OS: Rocky Linux 8.4 Docker: Docker version 20.10.10, build b485636 Compose: docker-compose version 1.29.2, build 5becea4c
Steps to reproduce the issue
systemctl restart dockerrestorecon -R -v /var/lib/dockerrestorecon -R -v /usr/bincd /frappe-dockerdocker-compose pulldocker-compose up -dBad Gatewayin top left cornerdocker psfrappe/erpnext-nginx:version-13*logs belowObserved result
Get
Bad GatewayExpected result
Can access our site normally
Stacktrace / full error message if available
output of
docker infoI haven't been able to find workaround, do you have any clue? Thanks in advance 🙂