From f9ccb1c8829cef551b875c7c387530e7980414a7 Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Mon, 9 Nov 2015 22:14:56 -0500 Subject: [PATCH] Drop root for Horizon service Drop root privileges for Horizon service. It is necesssary to set a capability on the filesystem to allow binding to port 80 as a non-root user. I have tested this works correctly from a registry on both CentOS and Ubuntu. Change-Id: I4c26f28bb28b6633784e6842f3423a2425332c27 Partially-Implements: blueprint drop-root --- docker/horizon/Dockerfile.j2 | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2 index 30b2277814..c083fa1072 100644 --- a/docker/horizon/Dockerfile.j2 +++ b/docker/horizon/Dockerfile.j2 @@ -56,7 +56,25 @@ RUN ln -s horizon-source/* horizon \ {% endif %} +# Set NET_BIND_SERVICE capability to httpd/apache2 so that it may run on +# ports lower than 1024. +# Set pidfile and log directory to be writeable by # the horizon user. +{% if base_distro in ['centos', 'fedora', 'oraclelinux', 'rhel'] %} + +RUN setcap 'cap_net_bind_service=ep' /usr/sbin/httpd \ + && chown horizon: /run/httpd /etc/httpd/logs + +{% elif base_distro in ['ubuntu'] %} + +RUN setcap 'cap_net_bind_service=ep' /usr/sbin/apache2 \ + && chown -R horizon: /var/run/apache2 /var/log/apache2 + +{% endif %} + COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN chmod 755 /usr/local/bin/kolla_extend_start +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && usermod -a -G kolla horizon + +USER horizon {{ include_footer }}