错误：仅当主进程以超级用户权限运行时，“user”指令才有意义

Question

您好，当我尝试在 dockerfile 中实现新用户而不是使用 root 用户时，出现以下错误。

2020-10-16T09:28:04.554363522Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:04.564383012Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
2020-10-16T09:28:06.882365055Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:06.891084727Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
2020-10-16T09:28:09.331807870Z nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:5
2020-10-16T09:28:09.342560643Z nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)

下面是我创建的以下 dockerfile。我创建了一个名为 api-gateway 的新组件，但是，当我构建 docker 映像并运行容器时，出现上述错误。

对于我需要实施哪些更改才能让用户而不是根用户工作有什么建议吗？

USER root
RUN microdnf --setopt=tsflags=nodocs install -y nginx procps shadow-utils net-tools ca-certificates dirmngr gnupg wget vim\
            && microdnf clean all \
            && rpm -q procps-ng

ENV NGINX_USER="api-gatway" \
    NGINXR_UID="8987" \
    NGINX_GROUP="api-gatway" \
    NGINX_GID="8987"     

RUN set -ex; \
  groupadd -r --gid "$NGINX_GID" "$NGINX_GROUP"; \
  useradd -r --uid "$NGINXR_UID" --gid "$NGINX_GID" "$NGINX_USER" 

#To start up NGINX 
EXPOSE 80
RUN mkdir -p /var/lib/nginx/
RUN mkdir -p /var/log/nginx/

RUN mkdir -p /var/lib/nginx/tmp/

RUN chown api-gatway /var/lib/nginx/
RUN chownd api-gatway /var/log/nginx/
USER api-gatway
CMD ["nginx", "-g", "daemon off;"]

Answer 1

请在部署 yaml 文件中添加卷和卷安装部分：

卷：

- name: nginx-dir
  emptyDir: { }
- name: nginx-empty
  emptyDir: { }
- name: nginx-run
  emptyDir: { }

体积安装：

- mountPath: /etc/nginx/conf.d/
  name: nginx-dir
- mountPath: /var/cache/nginx/client_temp
  name: nginx-empty
- mountPath: /var/run/
  name: nginx-run

这应该允许您无需 root 用户即可访问特定目录。

Answer 2

NGINX 现在有一个官方的非特权 Docker 镜像，有更细粒度的更改（下面只是“值得注意的”更改，还有更多）：

• 删除user指令/etc/nginx/nginx.conf
• 将 PID 从 移动/var/run/nginx.pid到/tmp/nginx.pid
• *_temp_path将变量更改为/tmp/*
• 将监听端口更改为非 root 端口（80->8080）。

要查看所有这些更改，请查看nginxinc/docker-nginx-unprivileged 的​​源代码，或者直接从 Docker Hub 中提取生成的非特权 Docker 镜像之一 ( nginxinc/nginx-unprivileged )，我强烈推荐基于 Alpine 的镜像而不是在 Debian 上以避免频繁出现的漏洞：

docker pull nginxinc/nginx-unprivileged:stable-alpine