SCMOD-12755: Allow startup scripts to run as non-root user.

[dgibson-microfocus]

https://portal.digitalsafe.net/browse/SCMOD-12755

[buildmachine-sou-jenkins2]

CI Build Link:
http://sou-jenkins2.swinfra.net:8080/job/CAFapi/job/CAFapi~opensuse-base-image~SCMOD-12755~CI

[dermot-hardy]

I'm don't really like the file being called caf. It doesn't project that the permissions are required for the install-ca-cert-base.sh script. Can we change the filename to install-ca-cert-base? And can we change the folder name from permissions to sudoers.d?

[dermot-hardy]

The output filename is now install_ca_cert-base.sh. I don't like the mix of underscores and dash. Just keep it as install-ca-cert-base.sh like it was before. Also change the filename in the source code to match that and change the folder name from container-cert-script to startup.d, and put it inside the startup folder. Come to think of it, if it's in the startup folder like that you may not need the line at all since the COPY startup /startup line above will probably cover it.

[dermot-hardy]

Let's put the comment back so that it's back the way it was before the gosu changes.

Suggested change

	exec "$@"
	# Execute the specified command
	exec "$@"

[dermot-hardy]

Is the space at the start of the line necessary? It just looks strange to me (but I don't know the syntax so keep it if it's normal).

[dermot-hardy]

Drop this blank line.

[dermot-hardy]

Does this actually work? I tried it on Moe and I'm not seeing it working:

[dgibson-microfocus]

Does this actually work? I tried it on Moe and I'm not seeing it working:

@dermot-hardy sudo checks the passwd file to resolve the uid to a username for permissions checking which is why you're getting that error. From what I can tell, either the user needs to be created on the container or mount your passwd file into the container

[dermot-hardy]

That is a domain user so it won't exist in the passwd file. Is there a way to make this work with anonymous users?

[dgibson-microfocus]

That is a domain user so it won't exist in the passwd file. Is there a way to make this work with anonymous users?

@dermot-hardy sudo will always use your real UID for permissions checks so it must map to a user who exists on the container. Setting the SetUID flag only works on binaries but some of the setup steps we need root permissions for are scripts (e.g. update-ca-certificates) We could add our own binary to execute arbitrary files similar to sudo but that seems like a big can of worms.

[dermot-hardy]

Let's try to keep it simple but if we have to create a binary that wraps update-ca-certificates then so be it.

[dgibson-microfocus]

Let's try to keep it simple but if we have to create a binary that wraps update-ca-certificates then so be it.

@dermot-hardy A possible alternative is we create a default non-root user in the base image and then use docker namespace remapping though I don't know how practical that would be in prod.

[dermot-hardy]

That still leaves all containers running as the same user. It's an improvement because it's not the root user but it's still not the arbitrary user being requested here.