Closed billionairiam closed 9 months ago
As we can see, user postgress belongs to 999(postgres) and 101(ssl-cert).
# id postgres
uid=999(postgres) gid=999(postgres) groups=999(postgres),101(ssl-cert)
And command gosu will invoke the syscall of setgroups with parameter 101. In this case, the error will be "invalid argument". So, it seems the supplementary gids also need to be written to /proc/[pid]/gid_map. (see https://man7.org/linux/man-pages/man7/user_namespaces.7.html)
The
/etc/passwd
file
Seems there is not an ssl-cert
user inside the /etc/passwd
file.
The
/etc/passwd
fileSeems there is not an
ssl-cert
user inside the/etc/passwd
file.
It is a kind of group. So pls find it in /etc/group.
The
/etc/passwd
fileSeems there is not an
ssl-cert
user inside the/etc/passwd
file.It is a kind of group. So pls find it in /etc/group.
Add 101 to gid_map
can fix this?
The
/etc/passwd
fileSeems there is not an
ssl-cert
user inside the/etc/passwd
file.It is a kind of group. So pls find it in /etc/group.
Add 101 to
gid_map
can fix this?
The /proc/pid/setgroups file The /proc/pid/setgroups file displays the string "allow" if processes in the user namespace that contains the process pid are permitted to employ the setgroups(2) system call; it displays "deny" if setgroups(2) is not permitted in that user namespace. Note that regardless of the value in the /proc/pid/setgroups file (and regardless of the process's capabilities), calls to setgroups(2) are also not permitted if /proc/pid/gid_map has not yet been set.
From the user_namespace manual, it does but I haven't tried it. Let's have a discussion in the weekly meeting first.
Linux distinguish UID and GID but to simplify implementation, ACON Image spec doesn't employ separate fields for UIDs and GIDs. Instead, all IDs listed in uids
will be enabled as both UIDs and GIDs. So for this test case, what's needed is simply to add 101
to uids
in the image manifest.
Linux distinguish UID and GID but to simplify implementation, ACON Image spec doesn't employ separate fields for UIDs and GIDs. Instead, all IDs listed in
uids
will be enabled as both UIDs and GIDs. So for this test case, what's needed is simply to add101
touids
in the image manifest.
Solved and added PostgreSQL to action
The entrypoint script for postgreSQL runs the command
exec gosu postgres "$BASH_SOURCE" "$@"
, resulting in the error message: error: failed switching to "postgres": invalid argument.The
/etc/passwd
file in the PostgreSQL Docker container contains the following entries:Additionally, the user ID 999 has been added to the JSON file.
Running either
exec gosu postgres:postgres "$BASH_SOURCE" "$@"
orexec gosu 999:999 "$BASH_SOURCE" "$@"
would resolve the issue, but these commands would modify the scripts. It appears that gosu might interpret the first command as an attempt to switch to a user named "postgres" without specifying a group.