Unroot docker examples and fix stdout permissions in container #11523

phlax · 2020-06-09T15:54:00Z

Commit Message: Update examples to use non-well known ports and not the root user
Additional Description:
I have updated 80 -> 8000 for any ports I could see that were exposed by an envoy container.

I left one example (load-reporting-service) using port 80 and instead added the ENVOY_UID env var

Some docs (eg docs/root/start/sandboxes) that have port 80 coded in relation to these examples, have been updated

Also adds fix for envoy permissions on /dev/stdout and /dev/stderr

Risk Level: Low
Testing: Manual testing
Docs Changes:

Sandbox examples updated to reflect port changes
Note added about uid/gid of container user

Release Notes: N/A
Fix #11506
Fix #11551

junr03

Thanks for the contribution, do you mind updating any stale docs? Thanks!

/wait

phlax · 2020-06-13T09:33:20Z

@junr03 i have updated the relevant docs - not sure if there are others - but these seem to be the ones that directly referenced the port 80 settings.

I have again committed separately - but will happily squash

phlax · 2020-06-13T09:36:49Z

also, im wondering if i should add a doc about the ENVOY_UID setting. Adding to the existing load_reporting_service example seems a bit arbitrary

junr03 · 2020-06-17T22:36:13Z

also, im wondering if i should add a doc about the ENVOY_UID setting.

Yes, please.

/wait

phlax · 2020-06-18T10:14:49Z

documentation added

lu4t · 2020-06-22T08:46:00Z

Adding a comment and link to this issue:

#11679

as @dio requested....

phlax · 2020-06-22T09:43:31Z

@lu4t @dio - i updated the docs to use py3-pip - but then i saw #11680 so i can remove this commit in favour of that pr if required

commit removed

junr03 · 2020-06-26T21:07:19Z

@lu4t @dio does this look good to both of you?

dio · 2020-06-27T01:45:56Z

Looks good, just a question: @phlax, do you want to tackle the access issue to /dev/stdout here as well (since it is related to privileged access too)? Thank you!

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax · 2020-06-27T07:29:18Z

@dio i added a fix for permissions on /dev/stdout.

I also added it for /dev/stderr on the basis that a config may well use that pipe too.

I have tested the built image with the fault-injection example and this seems to work ok.

I wasn't entirely clear where the envoy-dev image is built - but im assuming its based on the recipe in ci/Dockerfile-envoy

dio · 2020-06-27T07:51:15Z

I wasn't entirely clear where the envoy-dev image is built - but im assuming its based on the recipe in ci/Dockerfile-envoy

Yes, you're right.

dio

Thanks, LGTM. Just an ask to add a comment on the decision of making the envoy user owns stdout and stderr (probably since it is a common use case when we have access logging) and a tiny nit to make sure the doc is rendered as intended.

ci/docker-entrypoint.sh

dio · 2020-06-27T07:45:52Z

docs/root/start/start.rst

+By default the Docker image will run as the `envoy` user created at build time.
+
+The `uid` and `gid` of this user can be set at runtime using the `ENVOY_UID` and `ENVOY_GID`
+environment variables. This can be done, for example, on the Docker command line:
+
+ $ docker run -d --name envoy -e ENVOY_UID=777 -e ENVOY_GID=777 -p 9901:9901 -p 10000:10000 envoy:v1
+
+This can be useful if you wish to restrict or provide access to `unix` sockets inside the container, or
+for controlling access to an `envoy` socket from outside of the container.
+
+If you wish to run the container as the `root` user you can set `ENVOY_UID` to `0`.


Nit. To use double backticks instead of the single one, e.g. for uid and gid, and other words that need to be rendered inside <span class="pre"></span> tag. For example:

``docker``

gives:

Signed-off-by: Ryan Northey <ryan@synca.io>

dio

Thanks!

mattklein123

Nice!

mattklein123 assigned junr03 Jun 10, 2020

junr03 reviewed Jun 12, 2020

View reviewed changes

repokitteh-read-only bot added the waiting label Jun 12, 2020

phlax force-pushed the unroot-docker-examples branch from 9cd3fcf to c0f3b58 Compare June 13, 2020 09:19

repokitteh-read-only bot removed the waiting label Jun 13, 2020

repokitteh-read-only bot added the waiting label Jun 17, 2020

phlax force-pushed the unroot-docker-examples branch from c0f3b58 to c0d98a6 Compare June 18, 2020 10:13

repokitteh-read-only bot removed the waiting label Jun 18, 2020

phlax force-pushed the unroot-docker-examples branch from c0d98a6 to 1b1bee7 Compare June 18, 2020 10:19

dio mentioned this pull request Jun 21, 2020

Front-proxy example error == returned a non-zero code: 127 #11679

Closed

phlax force-pushed the unroot-docker-examples branch from 1b1bee7 to d5ae3f3 Compare June 22, 2020 09:40

dio mentioned this pull request Jun 23, 2020

examples: fixed fault-injection delay demo #11715

Merged

phlax added 10 commits June 27, 2020 07:34

Switch port 80 -> 8000 in example/cors

311e21c

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/csrf

d0733aa

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/front-proxy

2e2ef2e

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/jaeger-native-tracing

5a5a75b

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/jaeger-tracing

dbe547d

Signed-off-by: Ryan Northey <ryan@synca.io>

Set ENVOY_UID=0 in example/load-reporting-service

5685ce5

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/lua

f70bb06

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 example/zipkin-tracing

285db87

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 cors sandbox docs

6a6131e

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 csrf sandbox docs

e4f98f0

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax added 5 commits June 27, 2020 07:34

Switch port 80 -> 8000 front_proxy sandbox docs

5585744

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 jaeger_native_tracing sandbox docs

3fbaf2a

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 jaeger_tracing sandbox docs

db12919

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 lua sandbox docs

7c41831

Signed-off-by: Ryan Northey <ryan@synca.io>

Switch port 80 -> 8000 zipkin_tracing sandbox docs

cf70e4f

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax force-pushed the unroot-docker-examples branch from d5ae3f3 to ee2d267 Compare June 27, 2020 07:02

phlax changed the title ~~Unroot docker examples~~ Unroot docker examples and fix stdout permissions in container Jun 27, 2020

dio suggested changes Jun 27, 2020

View reviewed changes

phlax added 3 commits June 27, 2020 08:59

Add documentation regarding uid/gid in docker container

083ea61

Signed-off-by: Ryan Northey <ryan@synca.io>

Fix stdout/stderr permissions in docker container

521eaae

Signed-off-by: Ryan Northey <ryan@synca.io>

Remove ENVOY_UID=0 from fault-injection example

6d80371

Signed-off-by: Ryan Northey <ryan@synca.io>

phlax force-pushed the unroot-docker-examples branch from ee2d267 to 6d80371 Compare June 27, 2020 08:01

dio approved these changes Jun 27, 2020

View reviewed changes

mattklein123 approved these changes Jun 28, 2020

View reviewed changes

mattklein123 merged commit 504d78b into envoyproxy:master Jun 28, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unroot docker examples and fix stdout permissions in container #11523

Unroot docker examples and fix stdout permissions in container #11523

phlax commented Jun 9, 2020 •

edited

Loading

junr03 left a comment

phlax commented Jun 13, 2020

phlax commented Jun 13, 2020

junr03 commented Jun 17, 2020

phlax commented Jun 18, 2020

lu4t commented Jun 22, 2020

phlax commented Jun 22, 2020 •

edited

Loading

junr03 commented Jun 26, 2020

dio commented Jun 27, 2020

phlax commented Jun 27, 2020

dio commented Jun 27, 2020

dio left a comment •

edited

Loading

dio Jun 27, 2020 •

edited

Loading

phlax Jun 27, 2020

dio left a comment

mattklein123 left a comment

Unroot docker examples and fix stdout permissions in container #11523

Unroot docker examples and fix stdout permissions in container #11523

Conversation

phlax commented Jun 9, 2020 • edited Loading

junr03 left a comment

Choose a reason for hiding this comment

phlax commented Jun 13, 2020

phlax commented Jun 13, 2020

junr03 commented Jun 17, 2020

phlax commented Jun 18, 2020

lu4t commented Jun 22, 2020

phlax commented Jun 22, 2020 • edited Loading

junr03 commented Jun 26, 2020

dio commented Jun 27, 2020

phlax commented Jun 27, 2020

dio commented Jun 27, 2020

dio left a comment • edited Loading

Choose a reason for hiding this comment

dio Jun 27, 2020 • edited Loading

Choose a reason for hiding this comment

phlax Jun 27, 2020

Choose a reason for hiding this comment

dio left a comment

Choose a reason for hiding this comment

mattklein123 left a comment

Choose a reason for hiding this comment

phlax commented Jun 9, 2020 •

edited

Loading

phlax commented Jun 22, 2020 •

edited

Loading

dio left a comment •

edited

Loading

dio Jun 27, 2020 •

edited

Loading