Run nginx as a non root user #2934
Conversation
|
Created a staging project on OBS for Tumbleweed: home:pushman:BCI:Staging:Tumbleweed:Tumbleweed-2934 Build ResultsRepository
Repository
Build succeeded ✅ To run BCI-tests against this PR, use the following command: OS_VERSION=tumbleweed TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/tumbleweed/tumbleweed-2934/ tox -- -n autoThe following images can be pulled from the staging project:
|
|
Created a staging project on OBS for 7: home:pushman:BCI:Staging:SLE-15-SP7:7-2934 Build ResultsRepository
Repository
Repository
Repository
Build succeeded ✅ To run BCI-tests against this PR, use the following command: OS_VERSION=15.7 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/sle-15-sp7/7-2934/ tox -- -n autoThe following images can be pulled from the staging project:
|
|
Created a staging project on OBS for 16.0: home:pushman:BCI:Staging:16.0:16.0-2934 Build ResultsRepository
Repository
Repository
Repository
Build succeeded ✅ To run BCI-tests against this PR, use the following command: OS_VERSION=16.0 TARGET=custom BASEURL=registry.opensuse.org/home/pushman/bci/staging/16.0/16.0-2934/ tox -- -n autoThe following images can be pulled from the staging project:
|
| "exposes_ports": [TCP(8080)], | ||
| "custom_end": f"""{version_check_lines} | ||
| # Modify the default Nginx config to listen on port 8080 and PID file location to a writable path | ||
| {DOCKERFILE_RUN} sed -i 's/listen *80;/listen 8080;/g' /etc/nginx/nginx.conf &&\\ |
There was a problem hiding this comment.
This is a breaking change for anyone using the container as is.
In my view, if you want to change the container port and user, you must provide your own nginx.conf file.
I would just downgrade the nginx process by setting the worker user to nginx.
| "extra_files": _NGINX_FILES, | ||
| "support_level": SupportLevel.L3, | ||
| "exposes_ports": [TCP(80)], | ||
| "exposes_ports": [TCP(8080)], |
There was a problem hiding this comment.
we can't just change this without a version bump.
Nginx can be run as non-root user(nginx user) as follows:
where 499 and 498 are the UID and GID of nginx user.