You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@bookkeeper.apache.org by "nodece (via GitHub)" <gi...@apache.org> on 2024/07/15 10:40:07 UTC

[PR] fix: permission denied in the docker image [bookkeeper]

nodece opened a new pull request, #4464:
URL: https://github.com/apache/bookkeeper/pull/4464

   Fix #4461 
   
   ### Motivation
   
   `$BK_USER` has been added to the image, we should use this user to run the image.
   
   ### Changes
   
   - Use `$BK_USER` with the group `root` to run the image.
   - Change `/opt/bookkeeper` directory user and group to `$BK_USER:root`, not `root:root`
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1694704210


##########
docker/Dockerfile:
##########
@@ -86,6 +86,9 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper

Review Comment:
   Done.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "eolivelli (via GitHub)" <gi...@apache.org>.
eolivelli merged PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1694638016


##########
docker/Dockerfile:
##########
@@ -86,6 +86,9 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper

Review Comment:
   "Principle of least privilege" should be followed. Only the directories that need to be writable should be writable.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj commented on PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#issuecomment-2293051053

   @lhotari Would you please take a look again?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1694578845


##########
docker/Dockerfile:
##########
@@ -86,6 +86,9 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper

Review Comment:
   I think it's better to specifically list the directories that are allowed to be writable, [similar to how this is handled in Pulsar's Dockerfile](https://github.com/apache/pulsar/blob/47f204fb20d324d6794e3b57e06807af66b799bc/docker/pulsar/Dockerfile#L38-L48). 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1726679478


##########
docker/Dockerfile:
##########
@@ -86,6 +86,13 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper
+RUN chmod -R ug+rwx /opt/bookkeeper
+RUN chmod -R g+rx /opt/bookkeeper/bin
+RUN chmod -R g+rx /opt/bookkeeper/scripts

Review Comment:
   I think that this could potentially increase the size of the docker image. That's why a multi-stage docker image is recommended where the bits are set in one stage and copied from the intermediate image in the final stage.
   For example this is what is done in Pulsar: https://github.com/apache/pulsar/blob/0a5cb51a2f010d6771ae0ae0fd259d002cca20da/docker/pulsar/Dockerfile#L138 . You could check the Dockerfile from branch-3.2 to see an Ubuntu example: https://github.com/apache/pulsar/blob/f7c540e79873dff6dc447dcc0f3b814000743ec3/docker/pulsar/Dockerfile#L20-L48



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1727572469


##########
docker/Dockerfile:
##########
@@ -86,6 +86,13 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper
+RUN chmod -R ug+rwx /opt/bookkeeper
+RUN chmod -R g+rx /opt/bookkeeper/bin
+RUN chmod -R g+rx /opt/bookkeeper/scripts

Review Comment:
   > squashing is deprecated.
   
   Good catch! I don't know this thing, because I'm using `podman` instead of `docker`, so I can still use the squash feature on the podman.
   
   > what did you try?
   
   I write two dockerfiles, one is multiple stages, and the other is a single stage, and then use the podman to build the different dockerfile:
   ```
   cd $BK/docker
   podman build --squash --platform linux/amd64 -t zixuan/bk:0822 .
   ```
   
   
   
   
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#issuecomment-2228198742

   Could you help to review this PR? @shoothzj 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#issuecomment-2305318675

   @lhotari Your review result has been fixed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1726879092


##########
docker/Dockerfile:
##########
@@ -86,6 +86,13 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper
+RUN chmod -R ug+rwx /opt/bookkeeper
+RUN chmod -R g+rx /opt/bookkeeper/bin
+RUN chmod -R g+rx /opt/bookkeeper/scripts

Review Comment:
   I tried to use the multi-staged, but the image size has not changed.
   
   When we build the image, we need to use `--squash` feature, this can help us to reduce the intermediate image.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1726884919


##########
docker/Dockerfile:
##########
@@ -86,6 +86,13 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper
+RUN chmod -R ug+rwx /opt/bookkeeper
+RUN chmod -R g+rx /opt/bookkeeper/bin
+RUN chmod -R g+rx /opt/bookkeeper/scripts

Review Comment:
   > When we build the image, we need to use `--squash` feature, this can help us to reduce the intermediate image.
   
   squashing is deprecated. 



##########
docker/Dockerfile:
##########
@@ -86,6 +86,13 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper
+RUN chmod -R ug+rwx /opt/bookkeeper
+RUN chmod -R g+rx /opt/bookkeeper/bin
+RUN chmod -R g+rx /opt/bookkeeper/scripts

Review Comment:
   > I tried to use the multi-staged, but the image size has not changed.
   
   what did you try?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#issuecomment-2246691720

   Bump


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: permission denied in the docker image [bookkeeper]

Posted by "nodece (via GitHub)" <gi...@apache.org>.
nodece commented on code in PR #4464:
URL: https://github.com/apache/bookkeeper/pull/4464#discussion_r1694614184


##########
docker/Dockerfile:
##########
@@ -86,6 +86,9 @@ COPY --from=jre-build /javaruntime $JAVA_HOME
 COPY scripts /opt/bookkeeper/scripts
 RUN chmod +x -R /opt/bookkeeper/scripts/
 
+RUN chown -R 10000:0 /opt/bookkeeper

Review Comment:
   Do you want to limit some directories to be writable/readonly?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org