feat: arbitrary UID support, GID 0

Author: dotconfig404

Containerfile.alpine

@@ -81,7 +81,8 @@ COPY Containerfile.alpine /Containerfile
 
 RUN /prep_release_container.sh
 
-USER puppetdb:0
+# group 0 allows arbitrary UIDs, 64604 is set as default
+USER 64604:0
 
 # k8s uses livenessProbe, startupProbe, readinessProbe and ignores HEALTHCHECK
 HEALTHCHECK --interval=20s --timeout=15s --retries=12 --start-period=3m CMD ["/healthcheck.sh"]

Containerfile.ubuntu

@@ -90,7 +90,8 @@ COPY Containerfile.ubuntu /Containerfile
 
 RUN /prep_release_container.sh
 
-USER puppetdb:0
+# group 0 allows arbitrary UIDs, 64604 is set as default
+USER 64604:0
 
 # k8s uses livenessProbe, startupProbe, readinessProbe and ignores HEALTHCHECK
 HEALTHCHECK --interval=20s --timeout=15s --retries=12 --start-period=3m CMD ["/healthcheck.sh"]

MIGRATION.md

@@ -1,10 +1,14 @@
 # Migrations
 
-## v8.15.0
+## Coming from a fixed UID release 
 
-UID is changed from 1001 on alpine and 999 on ubuntu to 64604.
-If you already deployed the containers with mounted volume, you NEED to change the ownershop of these volumes and the files underneath.
+The container runs with **group 0** and works under **any UID**. File access is granted exclusively through group 0, and the UID of files on mounted volumes does not matter. There is no `puppet` service account in the image anymore. 
+
+For existing volumes, run once:
 
 ```bash
-chown -R 64604:64604 [PATH TO THE VOLUME]
+chgrp -R 0 [PATH TO THE VOLUME]
+chmod -R g+rwX [PATH TO THE VOLUME]
 ```
+
+On Kubernetes/OpenShift using `fsGroup: 0` in the pod securityContext can be used to achieve the same.

README.md

@@ -11,6 +11,7 @@
     - [End of Life for OpenVox DB 7](#end-of-life-for-openvox-db-7)
     - [Migration](#migration)
   - [Version schema](#version-schema)
+  - [Permissions](#permissions)
   - [Configuration](#configuration)
     - [Cert File Locations](#cert-file-locations)
   - [Initialization Scripts](#initialization-scripts)
@@ -73,6 +74,17 @@ The OpenVoxDB version describes the database version contained in the image.
 The container version follows semantic versioning and describes changes to the
 container image independently of the OpenVoxDB version.
 
+## Permissions
+
+The image runs with GID 0 and supports any runtime UID. GID 0 is what allows 
+file access. 
+
+Volumes can be adjusted to it via:
+
+```shell
+chgrp -R 0 <dir> && chmod -R g+rwX <dir>
+```
+
 ## Configuration
 
 <!-- markdownlint-disable table-column-style -->

openvoxdb/files/container-entrypoint.d/10-wait-for-hosts.sh

@@ -33,7 +33,9 @@ OPENVOXSERVER_HOSTNAME="${OPENVOXSERVER_HOSTNAME:-puppet}"
 OPENVOXSERVER_PORT="${OPENVOXSERVER_PORT:-8140}"
 
 # wait for postgres is ready
-/wtfc.sh --timeout="${OPENVOXDB_WAITFORHOST_SECONDS}" --interval=1 --progress "pg_isready -h ${OPENVOXDB_POSTGRES_HOSTNAME} --port '${OPENVOXDB_POSTGRES_PORT:-5432}'"
+# -U is required: without it pg_isready derives a username from /etc/passwd,
+# which fails under arbitrary UIDs ("no attempt")
+/wtfc.sh --timeout="${OPENVOXDB_WAITFORHOST_SECONDS}" --interval=1 --progress "pg_isready -h ${OPENVOXDB_POSTGRES_HOSTNAME} --port '${OPENVOXDB_POSTGRES_PORT:-5432}' -U '${OPENVOXDB_POSTGRES_USER:-openvoxdb}'"
 
 # wait for puppetserver DNS, then healthcheck
 if [ "$USE_OPENVOXSERVER" = true ]; then

openvoxdb/files/container-entrypoint.d/20-configure-ssl.sh

@@ -10,9 +10,3 @@ if [ "$USE_OPENVOXSERVER" = true ]; then
   # enable SSL in Jetty
   sed -i '/^# ssl-/s/^# //g' /etc/puppetlabs/puppetdb/conf.d/jetty.ini
 fi
-
-if [ -w "$SSLDIR" ] && [ "$(id -un)" = "root" ]; then
-  # make sure Java apps running as puppetdb can read these files
-  echo "Setting ownership for $SSLDIR to puppetdb:puppetdb"
-  chown -R puppetdb:puppetdb ${SSLDIR}
-fi

openvoxdb/files/ssl.sh

@@ -152,14 +152,6 @@ ca_running() {
         httpsreq_insecure "$(get "${CA}/certificate/ca")" > /dev/null
 }
 
-set_file_perms() {
-    msg "Securing permissions on ${SSLDIR}"
-
-    # 700 for directories, 600 for files
-    find "${SSLDIR}/." -type d -exec chmod u=rwx,g=,o= -- {} +
-    find "${SSLDIR}/." -type f -exec chmod u=rw,g=,o= -- {} +
-}
-
 ### Verify we got a signed certificate
 verify_cert() {
     if [ -f "${CERTFILE}" ] && [ "$(head -1 "${CERTFILE}")" = "${CERTHEADER}" ]; then
@@ -260,7 +252,6 @@ msg "* WAITFORCERT: '${WAITFORCERT}' seconds"
 certnames=$(cd "${PRIVKEYDIR}" && ls -A -m -- *.pem 2> /dev/null)
 if [ -s "${CERTFILE}" ]; then
     msg "Certificates (${certnames}) have already been generated - exiting!"
-    set_file_perms
     exit 0
 # warn when rekeying an existing host as it's typically user error
 elif [ -n "${certnames}" ]; then
@@ -373,6 +364,4 @@ if ! cert=$(retry_httpsreq "$CERTREQ" $((WAITFORCERT)) 10); then
 fi
 printf "%s\n" "${cert}" > "${CERTFILE}"
 
-set_file_perms
-
 verify_cert

openvoxdb/prep_release_container.sh

@@ -24,29 +24,26 @@ else
   exit 1
 fi
 
-# Create puppet user and group, and set permissions on necessary directories
-# Used for rootless execution of the container and to match permissions expected by Puppet Server
-if command -v apk > /dev/null 2>&1; then
-  addgroup -g 64604 puppetdb
-  adduser -G puppetdb -u 64604 -h /opt/puppetlabs/server/data/puppetdb -H -D -s /sbin/nologin puppetdb
-else
-  groupadd --gid 64604 puppetdb
-  useradd \
-    --gid puppetdb \
-    --home-dir /opt/puppetlabs/server/data/puppetdb \
-    --no-create-home \
-    --shell /usr/sbin/nologin \
-    --uid 64604 \
-    puppetdb
-fi
-
-mkdir -p "$LOGDIR"
-
-chown -R puppetdb:puppetdb /etc/puppetlabs/puppetdb
-chown -R puppetdb:puppetdb /opt/puppetlabs/server/data/puppetdb
-chown -R puppetdb:puppetdb /var/log/puppetlabs/puppetdb
-chown -R puppetdb:puppetdb /var/run/puppetlabs/puppetdb
-chown -R puppetdb:puppetdb "$LOGDIR"
+# The container runs as UID 64604 by default, but any UID works. Everything the
+# server needs to write is root-owned with group 0 mirroring the owner permissions
+mkdir -p "$LOGDIR" "$SSLDIR"
+
+chown -R 0:0 /etc/puppetlabs/puppetdb
+chown -R 0:0 /opt/puppetlabs/server/data/puppetdb
+chown -R 0:0 /var/log/puppetlabs/puppetdb
+chown -R 0:0 /var/run/puppetlabs/puppetdb
+chown -R 0:0 "$LOGDIR"
+
+# group-0 perms for arbitrary UIDs
+for d in /etc/puppetlabs /etc/logrotate.d /var/log/puppetlabs /var/run/puppetlabs /opt/puppetlabs "$LOGDIR"; do
+  mkdir -p "$d"
+  chgrp -R 0 "$d"
+  chmod -R g=u "$d"
+  find "$d" -type d -exec chmod g+s {} +
+done
+
+# empty USER lets foreground run under any UID
+sed -i 's/^ *USER="puppetdb"/USER=""/' /etc/default/puppetdb
 
 # We want to use the HOCON database.conf and config.conf files, so get rid of the packaged files
 rm -f /etc/puppetlabs/puppetdb/conf.d/database.ini