Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix folder permissions in docker for openshift deployment #240

Merged

Conversation

FabianWilms
Copy link
Contributor

@FabianWilms FabianWilms commented Jun 29, 2020

Hey, it's me again :)

While the previous PR #237 made the docker images more secure it wasn't enough to make the official FROST-Images be run in an Openshift environment.

After consulting the official guidelines to creating images for openshift the following problem surfaced:

By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node.

To adress this issue the recommended code was added to the Dockerfiles of the HTTP and MQTTP variants.

This time I went a step further and used https://github.com/minishift/minishift to test the changes in this PR successfully.

@hylkevds hylkevds merged commit 2803c0a into FraunhoferIOSB:master Jun 29, 2020
@hylkevds
Copy link
Member

Nice, thanks for the PR!

@hylkevds
Copy link
Member

We noticed an issue with tomcat not being able to write to the webapps directory: If it can't unzip the war file, Liquibase doesn't work... This was reproduceable when using the docker-compose-separated.yaml setup.

I've made a branch (https://github.com/FraunhoferIOSB/FROST-Server/tree/fixes-userRights) that unzips the war file when creating the Docker image. This seems to work for the docker-compose setup. Can you test if it still works in OpenShift?

@FabianWilms
Copy link
Contributor Author

@hylkevds Sorry for the late reply!

Your change is running on openshift just fine 👌

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants