Upgrading to user restricted Docker Container

Tags: #<Tag:0x00007f70bfab22c8>

Containers published by i-net software will run with a restricted user in their respective containers in early 2023. This is a major change and implies additional changes for existing containers.

Until now, containers were running with the user root. The default configuration and file persistence were stored in the container directory /root. Also, backup etc. was usually stored at this location.

Our updated containers will run with a restricted user with the UID and GID set to 1000. The name of the user depends on the product and can usually be resolved by $PRODUCT inside the container:

  • reporting - i-net Clear Reports
  • pdfc - i-net PDFC
  • helpdesk - i-net HelpDesk
  • cowork - i-net CoWork

The user name can be derived from the call:

docker run inetsoftware/i-net-<PRODUCT>:<TAG> whoami

Data Migration

Due to the change of the service user, you’ll have to update the mount point into the container from /root to /home/$PRODUCT and update the file owner and group id to 1000:1000. This can best be achieved using the root user in the upgraded container:

Plain Bash Code
~ $ # outside the container
~ $ docker exec -it -u root <your container> sh
/usr/share/<product> $ # inside the container
/usr/share/<product> $ cd /home/$PRODUCT
/home/<user> $ # change owner on every dot-anything directory,
/home/<user> $ # that is e.g.: '.java', '.i-net software'
/home/<user> $ chown -R 1000:1000 .*

Custom Image Migration

If you were using a custom image, built from one of our existing images, you’ll have to switch the user prior to installing any new software components to root and switch back to $PRODUCT when the operation is finished. Also, please make sure that any additionally installed components are available to the restricted service user, i.e. file permissions.

Plain Dockerfile
FROM inetsoftware/i-net-<PRODUCT>:<TAG>

# Switch to root user
USER root

# Do the tasks
RUN install-plugin authentication.twofactor

# Switch back to product user

Non-file persistence

(Update 2023-02-14: Containers build after this date do not have this restriction anymore)

If you are using a non-file persistence, such as MongoDB, you will have to see using the root user for now. The reason for that is that the non-file persistences require the System-Scope for the configuration, which can otherwise not be used by the application.

To achieve the root-user context you can either create a custom image, without switching back to the product user or a docker compose file, which switches the runtime user to root:

Docker compse file
version: '2.1'

        image: 'inetsoftware/i-net-<product>:latest'
        # Root user is required for other persistences than file
        user: "root"
        # ...

© Copyright 1996 - 2018, i-net software; All Rights Reserved.