Is this a critical security issue?
Describe the Bug
New versions of the ubuntu based images now drop privileges inside Dockerfile, which causes entrypoints to run as puppetdb instead of root. When using this image, you usually want to mount /opt/puppetlabs/server/data/puppetdb/ as a volume. New volumes are root-owned by default, so /container-entrypoint.d/20-configure-ssl.sh fails with mkdir: Permission denied and the container fails to start.
This is also a problem if you have custom entrypoints that need root privileges. The same issue exists with the openvoxserver8 images.
Expected Behavior
Entrypoints should run as root, and fix volume permissions on startup.
Steps to Reproduce
Start this image with a volume mounted to /opt/puppetlabs/server/data/puppetdb/. New volumes are root-owner, and the entrypoint scripts will fail to create the required directories.
Environment
Version [e.g. 1.27.0]
Platform [e.g. Ubuntu 18.04]
Additional Context
When I package projects as container images and want to drop privileges for the actual application, I usually do that as the last step in my main entrypoint script and not as the image default. That way, entrypoint scripts can still fix permissions in volumes as root. The last line of the main entrypoint would be something like: exec gosu puppetdb:0 /opt/puppetlabs/bin/puppetdb "$@"
Relevant log output
Is this a critical security issue?
Describe the Bug
New versions of the ubuntu based images now drop privileges inside
Dockerfile, which causes entrypoints to run aspuppetdbinstead ofroot. When using this image, you usually want to mount/opt/puppetlabs/server/data/puppetdb/as a volume. New volumes are root-owned by default, so/container-entrypoint.d/20-configure-ssl.shfails withmkdir: Permission deniedand the container fails to start.This is also a problem if you have custom entrypoints that need root privileges. The same issue exists with the
openvoxserver8images.Expected Behavior
Entrypoints should run as root, and fix volume permissions on startup.
Steps to Reproduce
Start this image with a volume mounted to
/opt/puppetlabs/server/data/puppetdb/. New volumes are root-owner, and the entrypoint scripts will fail to create the required directories.Environment
Version [e.g. 1.27.0]
Platform [e.g. Ubuntu 18.04]
Additional Context
When I package projects as container images and want to drop privileges for the actual application, I usually do that as the last step in my main entrypoint script and not as the image default. That way, entrypoint scripts can still fix permissions in volumes as root. The last line of the main entrypoint would be something like:
exec gosu puppetdb:0 /opt/puppetlabs/bin/puppetdb "$@"Relevant log output