CODEWITHSUNDEEP
shelldockercomposer-phpentry-point
SkyRar
SkyRar

Reputation: 1277

How to make a docker entrypoint run as non-root for some particular commands only

My PHP image entry point is something like below. The entrypoint runs as root and it is necessary in my case . So any command I run on my container runs as root. For some particular command I want to run it as another user e.g when someone try to execute docker exec -it php composer install composer should run as another user set in entrypoint. when someone try to execute docker exec -it php drush status drush should run as another user set in entry point. Probably a if or switch statement inside entrypoint can help me. I was trying something like this https://unix.stackexchange.com/questions/476155/how-to-pass-multiple-parameters-to-su-user-c-command but passing parameter with double dash (--) breaks some command.

Dockerfile

COPY entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
CMD ["php-fpm"]

entrypoint.sh

#!/bin/sh

set -e

# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
    set -- php-fpm "$@"
fi

exec "$@"

Upvotes: 3

Views: 6087

Answers (1)

Ryan
Ryan

Reputation: 1628

I'm not sure that I understand your use-case, but I use su-exec to drop privileges down to a non-root user within my entrypoint script. Most commonly I have to use this because I need to change permissions on a bind-mounted volume (usually /var/run/docker.sock).

Essentially I will do root level operations in my entrypoint, then drop down to a non-root user when executing the container service.

This blog explains the concept using gosu, su-exec is a refactor of gosu in C that is 10kb vs 1.8MB: https://denibertovic.com/posts/handling-permissions-with-docker-volumes/

Do note the security issues, which AFAIK are not a factor when using this in containers.

Upvotes: 4

Related Questions