Docker: Secure, but comfortable images.

by | Nov 4, 2020

While developing Docker images for Icinga 2, Icinga Web 2 and Icinga DB we stumbled over OpenShift which doesn’t allow images to run as root by default. One has to enable that explicitly. Also admins of K8s environments being more permissive by default may decide not to allow running as the superuser.

So we’ve added a USER directive to our Dockerfiles to make our customers‘ compliance departments happy. But then we noticed that not all K8s environments make it easy enough for non-developers to adjust volume permissions respectively. And if a container doesn’t control its volumes…

Setuid to the rescue!

As always we’ve found a solution for this problem: Our container image ships a binary called docker-chown with the setuid and setgid bits set. Before starting the actual application, that binary is being run. Due to the setuid and setgid bits docker-chown can escalate its privileges and adjust the volume permissions as needed.

But if running as root is forbidden… ?

… docker-chown’s privilege escalation is rejected and our image’s init script just continues with the actual application. Without adjusting the permissions, of course.

[2020-11-03 11:29:18 +0000] information/DockerEntrypoint: Checking "/data/var/cache/icinga2"
[2020-11-03 11:29:18 +0000] information/DockerEntrypoint: Copying "/data-init/var/cache/icinga2" to "/data/var/cache/icinga2"
[2020-11-03 11:29:18 +0000] critical/DockerEntrypoint: mkdir /data/var/cache: permission denied 

So if you don’t allow the container to run as the superuser, you have to adjust the volume permissions by yourself.

Try it out!

On NWS K8s hosted in Germany.

You May Also Like…

It’s all about the tools, is it?

It’s all about the tools, is it?

User Interface design or product design in general is less about tools than it is to have a proper understanding about...

Web Access Control Redefined

Web Access Control Redefined

One of the focuses of version 2.9 of Icinga Web 2 will be on access control. For years on now, Icinga Web 2 had a very...

Subscribe to our Newsletter

A monthly digest of the latest Icinga news, releases, articles and community topics.