search

yvnicolas / docker-apacheds

A Docker file to produce a simple image of Apache Directory Service.
0 stars 1 forks source link

Image doesnot start on Openshift #2

Open yvnicolas opened 7 years ago

yvnicolas commented 7 years ago

Uploading the image on Openshift gives following error


current directory : /var/lib/apacheds-2.0.0-M23
No existing running instance, starting a new server
/usr/bin/id: cannot find name for user ID 1000130000
su: must be run from a terminal
waiting for apacheds to properly start
No Initial files found, starting with an empty server
WARNING : No password found as environment variable, keeping default password
/usr/bin/id: cannot find name for user ID 1000130000
su: must be run from a terminal
/usr/bin/id: cannot find name for user ID 1000130000
su: must be run from a terminal
yvnicolas commented 7 years ago

My assumption is that the apacheds start script in opt/apache-ver/bin directory does su which is not allowed by openshift.

I have done a few tries in modifying the apacheds script but I broke more things than I solve, especially the rights management of the instances file are not managed correctly.

I have included in the feature/kub branch of this repo the non modified version of the script as apacheds-standard and a modified version of the script as apacheds-script which is the one currently used in the yvnicolas/docker-apacheds:M23-kub docker hub image.

This is probably happening inside the checkuser() function of the apacheds script where the 

if [ "`$IDEXE -u -n`" = "$RUN_AS_USER" ]

gets into an error which prints the 

/usr/bin/id: cannot find name for user ID 1000130000

and is not really caught in the script and generates the crash

xprazak2 commented 4 years ago

Hi, I am a bit late for the party, but I encountered the same error with a completely different image today and found this issue when looking for the solution how to fix it.

The cause is that pod spawns a container with restricted Security Context Constraints, which picks a user id from a range. The solution for me was to create a new Service Account, add anyuid scc to that account and then use the account for my deployment.

SCCs in detail: https://www.openshift.com/blog/managing-sccs-in-openshift