Non root docker by phlax · Pull Request #11323 · envoyproxy/envoy

phlax · 2020-05-26T16:57:57Z

Commit Message:

Allow envoy to run as non-root user in Docker container, Fixes #11311

Additional description:

creates a non-root user in docker recipes
installs su-exec and requirements for usermod and groupmod
updates the docker entrypoint to use su-exec

Unfortunately su-exec is not currently packaged in debian, so i had to compile the binary

An alternative would be to use gosu but its signififcantly larger

Risk Level: low/medium
The main risk is from compiling the su-exec binary for the debian build
Its not clear to me if these recipes are intended for ci or production - if the latter then introducing su-exec has more significant security implications
Testing:
Docs Changes: I could not find any docs relating to running with Docker
Release Notes: n/a

lizan · 2020-05-29T10:35:07Z

ci/Dockerfile-envoy-alpine-debug

I don't think you need update if you do add --no-cache below.

seems not. removed

ci/Dockerfile-envoy

lizan · 2020-05-29T10:43:06Z

can you merge master? that will fix the CI

phlax · 2020-05-29T11:46:40Z

done

lizan · 2020-06-02T17:49:59Z

ci/docker-entrypoint.sh

What if a user want to run Envoy as root? Non-root user cannot listen on well-known ports. Setting ENVOY_UID to 0 will fail at usermod.

this has been updated, so if ENVOY_UID=0 it follows the existing exec codepath and avoids usermod, su-exec etc

phlax · 2020-06-02T19:51:17Z

@lizan i have updated the PR and rebased to master.

lmk if there are any further changes that you would like

lizan

Thanks, this is in right direction. Can you add a release note as well? It should be noted that users have to set ENVOY_UID=0 to get old behavior.

phlax · 2020-06-02T20:28:44Z

release note added

lizan · 2020-06-02T21:13:48Z

docs/root/version_history/current.rst

alphabetical order, that's why format CI fails

mattklein123

Small question, thank you!

/wait

mattklein123 · 2020-06-04T14:57:05Z

ci/docker-entrypoint.sh

What is the default here? If not set somehow by default should this default to "0"? I think by default we will enter this statement but the string will be empty?

thats correct. The default is to use the envoy user with the uid/gid that is set at build time

Where are these env variables set?

they are runtime env vars for the container - so they can be set eg on the docker command line or in a compose file etc

It's not clear that this now has to be set. Can we please change this so that the default stays wat it was and we document how to set the right variables? By default I don't think this makes sense.

in the default case nothing should need to be set and all should work as it does now - save for the fact that process inside the container doesnt run as root.

The cases where you would want to set these vars are:

opening well-known ports inside the container and running as root - containers kind of negate the need to ever do this

setting a specific uid/gid to get the correct permissions on in or out sockets

my own opinion is that it is better to not run as root by default. Im happy to make whatever changes others feel necessary though

If both of these env vars are empty strings which would be the defualt, do the commands even work?

yep for sure.

the default case is that ENVOY_UID is not set - ie also not set to 0

in this case it goes into this code block, but as ENVOY_UID is not set (same with gid) it goes straight to

su-exec envoy "${@}"

Ah OK, gotcha. Alright thanks for the explanation. LGTM.

mattklein123 · 2020-06-04T16:17:02Z

Oops sorry can you merge master?

/wait

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax · 2020-06-04T16:21:47Z

done

Signed-off-by: Ryan Northey <ryan@synca.io>

mattklein123

Thanks!

phlax · 2020-06-04T19:00:36Z

its not obvious to me why ci is failing - the error seems to be here

ERROR: The project you're trying to build requires Bazel 3.1.0 (specified in /Users/runner/runners/2.169.1/work/1/s/.bazelversion), but it wasn't found in /usr/local/Cellar/bazel/3.2.0/libexec/bin.

im wondering if i need to do anything to get tests passing

lizan · 2020-06-04T19:11:00Z

@phlax no your fault, don't worry :)

because we cannot bind to 80 port for envoy since envoyproxy/envoy#11323 envoyproxy/envoy#11506

Allow envoy to run as non-root user in Docker container. Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: yashwant121 <yadavyashwant36@gmail.com>

phlax force-pushed the non-root-docker branch 4 times, most recently from da8729d to d877580 Compare May 26, 2020 17:45

lizan suggested changes May 29, 2020

View reviewed changes

phlax force-pushed the non-root-docker branch from d877580 to 0d5fe1a Compare May 29, 2020 11:45

phlax force-pushed the non-root-docker branch 2 times, most recently from a26c616 to b62d97b Compare May 30, 2020 16:59

mattklein123 assigned lizan May 30, 2020

phlax force-pushed the non-root-docker branch from b62d97b to 1389cd0 Compare June 1, 2020 08:37

lizan reviewed Jun 2, 2020

View reviewed changes

phlax force-pushed the non-root-docker branch 2 times, most recently from 337fa99 to 018d2bc Compare June 2, 2020 19:48

lizan reviewed Jun 2, 2020

View reviewed changes

phlax force-pushed the non-root-docker branch from b9da5c4 to 2f2b6d3 Compare June 2, 2020 20:27

lizan reviewed Jun 2, 2020

View reviewed changes

docs/root/version_history/current.rst Outdated

Copy link

Member

lizan Jun 2, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

alphabetical order, that's why format CI fails

phlax force-pushed the non-root-docker branch from 2f2b6d3 to 51c30be Compare June 2, 2020 21:37

lizan previously approved these changes Jun 4, 2020

View reviewed changes

mattklein123 requested changes Jun 4, 2020

View reviewed changes

repokitteh-read-only bot added the waiting label Jun 4, 2020

mattklein123 self-assigned this Jun 4, 2020

Update Dockerfile recipes to install su-exec

384c953

Signed-off-by: Ryan Northey <ryan@synca.io>

Update docker-entrypoint to use su-exec

57e272b

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax dismissed lizan’s stale review via 3f062e2 June 4, 2020 16:22

phlax force-pushed the non-root-docker branch from 51c30be to 3f062e2 Compare June 4, 2020 16:22

repokitteh-read-only bot removed the waiting label Jun 4, 2020

Add release note for envoyproxy#11323

0d020df

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax force-pushed the non-root-docker branch from 3f062e2 to 0d020df Compare June 4, 2020 16:33

mattklein123 approved these changes Jun 4, 2020

View reviewed changes

mattklein123 merged commit e8a2d1e into envoyproxy:master Jun 4, 2020

This was referenced Jun 8, 2020

examples/front-proxy tutorial is broken #11506

Closed

Getting permission denied on latest dev image for access logs #11551

Closed

phlax deleted the non-root-docker branch June 26, 2020 07:52

kenju added a commit to kenju/service-mesh-patterns that referenced this pull request Jul 5, 2020

add ENVOY_UID

33a80c4

because we cannot bind to 80 port for envoy since envoyproxy/envoy#11323 envoyproxy/envoy#11506

akonradi mentioned this pull request Jul 15, 2020

docker: run in front-envoy container as root #12112

Closed

dio mentioned this pull request Sep 24, 2020

event_log_path has permission error on 1.15 #13241

Closed

Conversation

phlax commented May 26, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lizan commented May 29, 2020

Uh oh!

phlax commented May 29, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phlax commented Jun 2, 2020

Uh oh!

lizan left a comment

Choose a reason for hiding this comment

Uh oh!

phlax commented Jun 2, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattklein123 commented Jun 4, 2020

Uh oh!

phlax commented Jun 4, 2020

Uh oh!

mattklein123 left a comment

Choose a reason for hiding this comment

Uh oh!

phlax commented Jun 4, 2020

Uh oh!

lizan commented Jun 4, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

phlax commented May 26, 2020 •

edited

Loading