-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature]: Enable specifying user/group permissions in the template stanza #5020
Comments
@danlsgiga could you not set |
@preetapan not really! The template is created with user / group set to root and I run my container using nobody / nobody (best practices heh!). Setting perms = 400 (Tried that and didn't work) will make the file readable by root only. |
Another use case here is certain software (eg PostgreSQL) enforces certain permissions for files like TLS keys and being able to get things working under Nomad can be problematic. Using the docker executor template files are written as root but in the container we don't know what user we're running as, although it probably shouldn't be root. Postgres enforces that key files are 0400 (or 0640) if owned by root so I've had to build a new image with postgres in the root group in make things work. Adding simple options to set file ownership to uids would solve this |
Any update on this issue? |
Hi @peimanja. Sorry we don't have an update on this. I've made sure to put it onto our backlog for discussion though. |
Hey , I would like to work on this issue , could someone give me any idea on where to start from ? |
Would adding extra checks here make a feasible solution |
+1. Trying to deploy |
Similar use case as above: Nomad postgres job being run in the Maybe there is a way to have the consul template files be written as the nobody:nobody user rather than root:root when the nomad jobs are being run as nobody:nobody? |
I'm trying to run HydraCI in a Nix built container, but HydraCI requires the pgpass file to be 600 or less, which means I have to change it's owner from root:root |
Another case for setting templated files ownership is running RabbitMQ containers as non-root user:
|
Ran into needing this a bunch already and it makes things really troublesome to get going sometimes. |
Support for setting So this should be pretty straightforward to implement for nomad as of now |
Hi @3nprob and others. I have raised that internally and any updates will be posted as follow up comments. |
@jrasell Got any news for us now that the prerequisites are in place with 1.3? :) |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
It would be great to have
user
andgroup
parameters to thetemplate
stanza. This would allow us to trim down theperms
of templates handling secrets to just the user/group of the user running in the container.Use case: We have few jobs running the
docker
driver and we are injecting a few config files using thetemplate
stanza with secrets from Vault. Right now we have to setperms = 444
in order to allow the task to read the rendered template. From a security standpoint, this is not optimal since 444 allows anyone to read the file. So, being able to specify anuser
/group
combination in the template stanza would make things simpler since Nomad always create the templates with user and group = root.Having to do manual steps on a docker
entrypoint
script to achieve that is ugly IMO.This is related to #2091
The text was updated successfully, but these errors were encountered: