dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

observability: run as container root 0:0, not 1000:1000

Browse Source 
Measured the rootless mapping: container root IS the invoking user
(dank, owner of the /opt data dirs); the images' default users (loki
10001, prometheus nobody, grafana 472) map to subuids that own nothing.
1000:1000 was the wrong direction.
This commit is contained in:
Frank
2026-08-22 03:45:06 -07:00
parent 11a713e05d
commit 816986139f
2 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/caddyfile.bats
+7 -6
View File
@@ -119,10 +119,11 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
! grep -nE '^\s*-\s*"?http' "$REPO_ROOT/shared/prometheus/prometheus.yml"
}
@test "observability containers run as the host user (rootless uid mapping)" {
# Rootless podman maps container uid 1000 to the invoking user, so
# 1000:1000 lets these containers write their /opt data dirs. Container
# root would map to a subuid that owns nothing under /opt.
@test "observability containers run as container root (rootless = host user)" {
# In rootless podman, container root maps to the invoking user (dank),
# which owns the /opt data dirs. The images' default users (loki 10001,
# prometheus nobody, grafana 472) map to subuids that own nothing under
# /opt and cannot write the data dirs.
local compose="$REPO_ROOT/dankclaw/compose.yaml"
local svc block
for svc in prometheus loki grafana; do
@@ -130,8 +131,8 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
$0 ~ s { inblk = 1; next }
inblk && /^ [a-z]/ { inblk = 0 }
inblk' "$compose")
echo "$block" | grep -q 'user: "1000:1000"' || {
echo "service $svc does not run as user 1000:1000"; return 1;
echo "$block" | grep -q 'user: "0:0"' || {
echo "service $svc does not run as user 0:0"; return 1;
}
done
}