search

voxpupuli / container-puppetdb

Container image for PuppetDB
Apache License 2.0
9 stars 10 forks source link

Startup fails when running as non-root / read-only #48

Closed bootc closed 6 months ago

bootc commented 6 months ago

I run PuppetDB and Puppet Server in Kubernetes, with the pods being configured to start as non-root and with read-only root filesystem and mounts for configuration. Currently the PuppetDB container fails to start in this configuration:

[...]
Running /docker-entrypoint.d/20-configure-ssl.sh
Setting ownership for /opt/puppetlabs/server/data/puppetdb/certs to puppetdb:puppetdb
chown: changing ownership of '/opt/puppetlabs/server/data/puppetdb/certs': Operation not permitted

The docker-entrypoint.d/20-configure-ssl.sh script unconditionally runs:

chown -R puppetdb:puppetdb ${SSLDIR}

The simple fix for this would be to avoid trying to chown unless running as root and the directory is writeable. A PR is incoming.