-
Notifications
You must be signed in to change notification settings - Fork 18.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Docker privileged / capabilities not working with non-root user #38664
Comments
@tianon - IIRC you looked into something similar at some point |
Yep, that'd be #8460, which includes some discussion around this and "ambient capabilities" which is what I understand this cap-based solution requires. My personal preference is for the sysctl referenced in that thread since we're in a network namespace anyhow so "privileged ports" really is pretty meaningless. |
The suggested sysctl flag in #8460 results in
Kernel version: |
Ah bummer, yep, it requires a newer kernel than 4.4.
|
Yes, looks like we should close this one. I don't think there's much more we can do for older kernels |
We're attempting to use the
NET_BIND_SERVICE
capability to allow non-root users to bind to port 80, and others.We're using a basic image from https://github.com/jwilder/whoami, which is a simple HTTP server in Go for demonstration purposes. The
Dockerfile
can be found here: https://github.com/jwilder/whoami/blob/master/Dockerfile.The specific command we're using is the following:
docker run --rm -it --user 5010:5010 -e PORT=80 --cap-add NET_BIND_SERVICE jwilder/whoami
Running solely this command will replicate the issue as described below.
We've tested running this on CentOS 7, and Ubuntu 16, both resulting in a
listen tcp :80: bind: permission denied
error, when we'd expect this to work. Exampledocker version
output:If we manually use
setcap
on the process, we're able to get this working as follows, but we believe this shouldn't be required:Are we missing something with the capabilities, or is this an issue?
The text was updated successfully, but these errors were encountered: