0

I have a docker image with base image ubuntu and tomcat installed later on that image. After the docker build, I am able to run the docker image locally without any issue. But when it is deployed on OpenShift, it fails to start.

Dockerfile

FROM ubuntu:latest
RUN apt-get -y update && apt-get -y upgrade
RUN apt-get -y install openjdk-8-jdk wget
RUN wget http://apache.stu.edu.tw/tomcat/tomcat-8/v8.5.58/bin/apache-tomcat-8.5.58.tar.gz -O /tmp/tomcat.tar.gz && \
    cd /tmp && tar xvfz tomcat.tar.gz && \
    cp -Rv /tmp/apache-tomcat-8.5.58/* /usr/local/tomcat/ 
EXPOSE 8080
CMD /usr/local/tomcat/bin/catalina.sh run
jfk
  • 4,335
  • 34
  • 27

1 Answers1

2

By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group. Files to be executed should also have group execute permissions.

Here is the modified Dockerfile

FROM ubuntu:latest
RUN apt-get -y update && apt-get -y upgrade
RUN apt-get -y install openjdk-8-jdk wget
RUN wget http://apache.stu.edu.tw/tomcat/tomcat-8/v8.5.58/bin/apache-tomcat-8.5.58.tar.gz -O /tmp/tomcat.tar.gz && \
    cd /tmp && tar xvfz tomcat.tar.gz && \
    cp -Rv /tmp/apache-tomcat-8.5.58/* /usr/local/tomcat/ 

#Add a user ubuntu with UID 1001
RUN useradd -rm -d /home/ubuntu -s /bin/bash -g root -G sudo -u 1001 ubuntu && \
   chown -R ubuntu:root /usr/local/tomcat && \
   chgrp -R 0 /usr/local/tomcat && \
   chmod -R g=u /usr/local/tomcat

#Specify the user with UID
USER 1001

EXPOSE 8080    
CMD /usr/local/tomcat/bin/catalina.sh run

Refer section "Support Arbitrary User IDs" on the Guideline from Openshift

To relax the security in your cluster so that images are not forced to run as a pre-allocated UID, without granting everyone access to the privileged SCC:

Grant all authenticated users access to the anyuid SCC:

$ oc adm policy add-scc-to-group anyuid system:authenticated

This allows images to run as the root UID if no USER is specified in the Dockerfile.

jfk
  • 4,335
  • 34
  • 27