dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

observability: run as container root 0:0, not 1000:1000

Browse Source 
Measured the rootless mapping: container root IS the invoking user
(dank, owner of the /opt data dirs); the images' default users (loki
10001, prometheus nobody, grafana 472) map to subuids that own nothing.
1000:1000 was the wrong direction.
This commit is contained in:
Frank
2026-08-22 03:45:06 -07:00
parent 11a713e05d
commit 816986139f
2 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/compose.yaml
+12 -9
View File
@@ -103,9 +103,10 @@ services:
image: docker.io/prom/prometheus:latest
container_name: prometheus
restart: unless-stopped
# Rootless: container uid 1000 maps to the invoking user, so the
# container can write its /opt/prometheus/data bind mount.
user: "1000:1000"
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/prometheus/data. The image's default user (nobody) maps to
# a subuid that cannot write it.
user: "0:0"
command:
- --config.file=/etc/prometheus/prometheus.yml
- --storage.tsdb.path=/prometheus
@@ -126,9 +127,10 @@ services:
image: docker.io/grafana/grafana:latest
container_name: grafana
restart: unless-stopped
# Rootless: container uid 1000 maps to the invoking user, so the
# container can write its /opt/grafana/data bind mount.
user: "1000:1000"
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/grafana/data. The image's default user (472) maps to a
# subuid that cannot write it.
user: "0:0"
environment:
GF_SERVER_ROOT_URL: "https://grafana.franksdank.cloud"
GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER}"
@@ -150,9 +152,10 @@ services:
image: docker.io/grafana/loki:latest
container_name: loki
restart: unless-stopped
# Rootless: container uid 1000 maps to the invoking user, so the
# container can write its /opt/loki/data bind mount.
user: "1000:1000"
# Rootless: container root maps to the invoking user (dank), which
# owns /opt/loki/data. The image's default user (10001) maps to a
# subuid that cannot write it.
user: "0:0"
command: ["-config.file=/etc/loki/loki-config.yaml"]
ports:
- "3100:3100"
tests/caddyfile.bats
+7 -6
View File
@@ -119,10 +119,11 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
! grep -nE '^\s*-\s*"?http' "$REPO_ROOT/shared/prometheus/prometheus.yml"
}
@test "observability containers run as the host user (rootless uid mapping)" {
# Rootless podman maps container uid 1000 to the invoking user, so
# 1000:1000 lets these containers write their /opt data dirs. Container
# root would map to a subuid that owns nothing under /opt.
@test "observability containers run as container root (rootless = host user)" {
# In rootless podman, container root maps to the invoking user (dank),
# which owns the /opt data dirs. The images' default users (loki 10001,
# prometheus nobody, grafana 472) map to subuids that own nothing under
# /opt and cannot write the data dirs.
local compose="$REPO_ROOT/dankclaw/compose.yaml"
local svc block
for svc in prometheus loki grafana; do
@@ -130,8 +131,8 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
$0 ~ s { inblk = 1; next }
inblk && /^ [a-z]/ { inblk = 0 }
inblk' "$compose")
echo "$block" | grep -q 'user: "1000:1000"' || {
echo "service $svc does not run as user 1000:1000"; return 1;
echo "$block" | grep -q 'user: "0:0"' || {
echo "service $svc does not run as user 0:0"; return 1;
}
done
}