You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Alexandre Chapellon (Jira)" <ji...@apache.org> on 2025/01/15 16:19:00 UTC
[jira] [Commented] (AMQ-9588) Running Docker image as root is required for proper functionality
[ https://issues.apache.org/jira/browse/AMQ-9588?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17913364#comment-17913364 ]
Alexandre Chapellon commented on AMQ-9588:
------------------------------------------
I think what [~gionn] wants to highlight here is the activemq process runs as root by default within the container. Also the activemq config files belong to that same root user. That allows for configuring simple authentication using the provided entrypoint (`sed` in there). However it's recommended a process within a container should not run as root. Some Orchestration platform such as Openshift would even not let you do it by default and require non root (or even dynamic users).
But with the current image running as a non root user would fail as the entrypoint would not be able to edit the xml config files.
e.g. try:
```bash
docker run --rm --user 990 --name activemq -p 8161:8161 -e ACTIVEMQ_WEB_USER=admin -e ACTIVEMQ_WEB_PASSWORD=s3cr3t -e ACTIVEMQ_CONNECTION_USER=thatsme -e ACTIVEMQ_CONNECTION_PASSWORD=iswear apache/activemq-classic
...
sed: couldn't open temporary file /opt/apache-activemq/conf/sedIyJmTy: Permission denied
sed: couldn't open temporary file /opt/apache-activemq/conf/sedgNiI2u: Permission denied
sed: couldn't open temporary file /opt/apache-activemq/conf/sedwwHpQI: Permission denied
touch: cannot touch '/opt/apache-activemq/conf/connection.security.enabled': Permission denied
Enabling ActiveMQ WebConsole security
sed: couldn't open temporary file /opt/apache-activemq/conf/sedaGuVtR: Permission denied
sed: couldn't open temporary file /opt/apache-activemq/conf/sedNVXjcK: Permission denied
INFO: Loading '/opt/apache-activemq/bin/setenv'
INFO: Using java '/opt/java/openjdk/bin/java'
...
```
Though the problem goes beyond just the execution of the entrypoint as the data, log & tmp folder are also no more writable to activemq in such cases.
> Running Docker image as root is required for proper functionality
> -----------------------------------------------------------------
>
> Key: AMQ-9588
> URL: https://issues.apache.org/jira/browse/AMQ-9588
> Project: ActiveMQ Classic
> Issue Type: Bug
> Components: Docker
> Affects Versions: 5.18.4
> Reporter: Giovanni Toraldo
> Assignee: Jean-Baptiste Onofré
> Priority: Major
>
> During the evaluation of the new Docker image, we found that running it as a non-privileged user is currently not supported. This raises a significant security concern, as it contradicts best practices for container security, where running processes as root should be avoided to minimize risks.
> Below is a log excerpt from our attempt to run the container as a non-privileged user while setting a custom password via the dedicated environment variable:
>
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedB5ltuV: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sednfPcf9: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedto1f2G: Permission denied │}}
> {{│ touch: cannot touch '/opt/apache-activemq/conf/connection.security.enabled': Permission denied │}}
> {{│ Enabling ActiveMQ JMX security │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedoJUbth: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/seduC85KQ: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedSDm7nf: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedanmNww: Permission denied │}}
> {{│ touch: cannot touch '/opt/apache-activemq/conf/jmx.security.enabled': Permission denied │}}
> {{│ Enabling ActiveMQ WebConsole security │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/seddcJbla: Permission denied │}}
> {{│ sed: couldn't open temporary file /opt/apache-activemq/conf/sedFWZO7r: Permission denied}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@activemq.apache.org
For additional commands, e-mail: issues-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact