4 ms·

You are correct. Unfortunately, nginx (and other web servers) generally need to run as root in normal web applications because they are listening on port 80 or

by frays 3y ago

You are correct. Unfortunately, nginx (and other web servers) generally need to run as root in normal web applications because they are listening on port 80 or 443. Ports below 1024 can be opened only by root. A more detailed explanation can be found here: https://unix.stackexchange.com/questions/134301/why-does-nginx-starts-process-as-root https://unix.stackexchange.com/questions/134301/why-does-ngi...

guraf 3y ago
Nginx is started as root but it does not run as root, it changes its user after opening log files and sockets. (unless you use a lazy docker container and just run everything as root inside it).
- jand 3y ago
  Even in (the official) docker image, a nginx user is created: (latest, layer 6) /bin/sh -c set -x && groupadd --system --gid 101 nginx && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx ..... [1] https://hub.docker.com/layers/library/nginx/latest/images/sha256-d2b2f2980e9ccc570e5726b56b54580f23a018b7b7314c9eaff7e5e479c78657?context=explore https://hub.docker.com/layers/library/nginx/latest/images/sh...
oefrha 3y ago
Nginx workers shouldn’t run as root and certainly don’t on any distro I know. Typically you have a www-data user/group or equivalent. Dropping privilege is very basic.
duijf 3y ago
> Ports below 1024 can be opened only by root. Or processes running with the CAP_NET_BIND_SERVICE capability! [1] Capabilities are a Linux kernel feature. Granting CAP_NET_BIND_SERVICE to nginx means you do not need to start it with full root privileges. This capability gives it the ability to open ports below 1024 Using systemd, you can use this feature like this: [Service] ExecStart=/usr/bin/nginx -c /etc/my_nginx.conf AmbientCapabilities=CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_NET_BIND_SERVICE User=nginx Group=nginx (You probably also want to enable a ton of other sandboxing options, see `systemd-analyze security` for tips) [1]: https://man7.org/linux/man-pages/man7/capabilities.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html

by frays 3y ago

guraf 3y ago

Nginx is started as root but it does not run as root, it changes its user after opening log files and sockets. (unless you use a lazy docker container and just run everything as root inside it).

jand 3y ago
Even in (the official) docker image, a nginx user is created: (latest, layer 6) /bin/sh -c set -x && groupadd --system --gid 101 nginx && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx ..... [1] https://hub.docker.com/layers/library/nginx/latest/images/sha256-d2b2f2980e9ccc570e5726b56b54580f23a018b7b7314c9eaff7e5e479c78657?context=explore https://hub.docker.com/layers/library/nginx/latest/images/sh...

oefrha 3y ago

Nginx workers shouldn’t run as root and certainly don’t on any distro I know. Typically you have a www-data user/group or equivalent. Dropping privilege is very basic.

duijf 3y ago

> Ports below 1024 can be opened only by root. Or processes running with the CAP_NET_BIND_SERVICE capability! [1] Capabilities are a Linux kernel feature. Granting CAP_NET_BIND_SERVICE to nginx means you do not need to start it with full root privileges. This capability gives it the ability to open ports below 1024 Using systemd, you can use this feature like this: [Service] ExecStart=/usr/bin/nginx -c /etc/my_nginx.conf AmbientCapabilities=CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_NET_BIND_SERVICE User=nginx Group=nginx (You probably also want to enable a ton of other sandboxing options, see `systemd-analyze security` for tips) [1]: https://man7.org/linux/man-pages/man7/capabilities.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html