7 ms·

Shouldn't the Dockerfile have a USER directive, so it doesn't use root by default?

cpach 6y ago
AFAIK, it works like this: A web server need root privileges in order to bind ports 80/443. But in this case it’s only the primary Nginx process that will run as root. The subprocesses will run as a non-privileged user, as specified with the “user nginx” directive. https://github.com/bunkerity/bunkerized-nginx/blob/master/confs/nginx.conf https://github.com/bunkerity/bunkerized-nginx/blob/master/co... https://unix.stackexchange.com/questions/134301/why-does-nginx-starts-process-as-root https://unix.stackexchange.com/questions/134301/why-does-ngi...
- otterley 6y ago
  It's better to run as a non-root user, and use the CAP_NET_BIND_SERVICE capability (see capabilities(7)) to allow only the minimal privileges necessary to bind to a low-numbered port. A lot of Linux admins are unaware that this is the modern best practice for running applications securely. Starting as root for the sole purpose of binding to a low-numbered port and then dropping privileges is an outdated practice that is both difficult to program correctly and arguably unnecessary today.
  - sjy 6y ago
    Thanks for pointing this out. I usually rely on the default settings in Arch Linux to handle stuff like this in the default package configuration, but it seems that the nginx package’s [1] systemd service [2] is not set up that way. Maybe it should be updated with a non-root User= and Capability=CAP_NET_BIND_SERVICE directive? [1] https://www.archlinux.org/packages/extra/x86_64/nginx/ https://www.archlinux.org/packages/extra/x86_64/nginx/ [2] https://github.com/archlinux/svntogit-packages/blob/packages/nginx/trunk/service https://github.com/archlinux/svntogit-packages/blob/packages...
  - cpach 6y ago
    This is why i love HN. Had no idea about that capability. Thanks for enlightening us! A quick googling tells me that FreeBSD has something similar: https://gist.github.com/TomHetmer/b0a048d688af78e78f45609880ef4d67 https://gist.github.com/TomHetmer/b0a048d688af78e78f45609880... PS. If I would have bothered to read the whole Stack Exchange article I linked to, that capability is even mentioned there (^_^) https://unix.stackexchange.com/a/134324/68449 https://unix.stackexchange.com/a/134324/68449
  - gui77aume 6y ago
    Nice to know. Also, using a container, the port number generally doesn't matter so much.
    - cmckn 6y ago
      Totally, just run things on 8080/8443 in the container and then use your privileges outside the container to map 80/443 on the host. Don’t use low-numbered ports until you truly have to, IMO.
  - brigandish 6y ago
    Why not use gosu or su-exec to run the entrypoint command? That's straightforward.
    - otterley 6y ago
      Better to never have root privileges anywhere in the container. Entry points can be overridden and never running as root at all greatly reduces the attack surface.
e-Minguez 6y ago
Exactly. Just like the nginx-unprivileged https://github.com/nginxinc/docker-nginx-unprivileged https://github.com/nginxinc/docker-nginx-unprivileged I've opened them an issue just in case https://github.com/bunkerity/bunkerized-nginx/issues/11 https://github.com/bunkerity/bunkerized-nginx/issues/11

AFAIK, it works like this: A web server need root privileges in order to bind ports 80/443. But in this case it’s only the primary Nginx process that will run as root. The subprocesses will run as a non-privileged user, as specified with the “user nginx” directive. https://github.com/bunkerity/bunkerized-nginx/blob/master/confs/nginx.conf https://github.com/bunkerity/bunkerized-nginx/blob/master/co... https://unix.stackexchange.com/questions/134301/why-does-nginx-starts-process-as-root https://unix.stackexchange.com/questions/134301/why-does-ngi...

otterley 6y ago
It's better to run as a non-root user, and use the CAP_NET_BIND_SERVICE capability (see capabilities(7)) to allow only the minimal privileges necessary to bind to a low-numbered port. A lot of Linux admins are unaware that this is the modern best practice for running applications securely. Starting as root for the sole purpose of binding to a low-numbered port and then dropping privileges is an outdated practice that is both difficult to program correctly and arguably unnecessary today.
- sjy 6y ago
  Thanks for pointing this out. I usually rely on the default settings in Arch Linux to handle stuff like this in the default package configuration, but it seems that the nginx package’s [1] systemd service [2] is not set up that way. Maybe it should be updated with a non-root User= and Capability=CAP_NET_BIND_SERVICE directive? [1] https://www.archlinux.org/packages/extra/x86_64/nginx/ https://www.archlinux.org/packages/extra/x86_64/nginx/ [2] https://github.com/archlinux/svntogit-packages/blob/packages/nginx/trunk/service https://github.com/archlinux/svntogit-packages/blob/packages...
- cpach 6y ago
  This is why i love HN. Had no idea about that capability. Thanks for enlightening us! A quick googling tells me that FreeBSD has something similar: https://gist.github.com/TomHetmer/b0a048d688af78e78f45609880ef4d67 https://gist.github.com/TomHetmer/b0a048d688af78e78f45609880... PS. If I would have bothered to read the whole Stack Exchange article I linked to, that capability is even mentioned there (^_^) https://unix.stackexchange.com/a/134324/68449 https://unix.stackexchange.com/a/134324/68449
- gui77aume 6y ago
  Nice to know. Also, using a container, the port number generally doesn't matter so much.
  - cmckn 6y ago
    Totally, just run things on 8080/8443 in the container and then use your privileges outside the container to map 80/443 on the host. Don’t use low-numbered ports until you truly have to, IMO.
- brigandish 6y ago
  Why not use gosu or su-exec to run the entrypoint command? That's straightforward.
  - otterley 6y ago
    Better to never have root privileges anywhere in the container. Entry points can be overridden and never running as root at all greatly reduces the attack surface.

e-Minguez 6y ago

Exactly. Just like the nginx-unprivileged https://github.com/nginxinc/docker-nginx-unprivileged https://github.com/nginxinc/docker-nginx-unprivileged I've opened them an issue just in case https://github.com/bunkerity/bunkerized-nginx/issues/11 https://github.com/bunkerity/bunkerized-nginx/issues/11