7

I'm basically trying to run crond -f as root, while having the default user be something different.

Since the crontabs it runs use sensitive information from other files on the image, I want to give root access to these files, start the crond process, then switch the user to a newly created one. This way the cronjobs will be able to get the information they need, while securing the sensitive files in the container from anyone who may get exec access.

have tried a couple things like this:

USER root

CMD ["./runCrons.sh"]

USER newuser

But this does not run the crond process as root, but as newuser.

If anyone has a solution it would save me some digging and experimentation.

boreddude
  • 89
  • 4
  • Try sudo ./runCrons.sh along with the sudoers stuff from this discussion. https://stackoverflow.com/questions/25845538/using-sudo-inside-a-docker-container – dskow Dec 18 '17 at 21:18
  • Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. – jww Dec 19 '17 at 01:19

1 Answers1

2

While building the Docker image, create a user which belongs to sudo group and is allowed to run all sudo commands without a password.

Consider the below example which creates a docker image called test with user named myuser with sudo pass: 

$ cat Dockerfile

FROM debian:latest
ENV user_name myuser
RUN apt-get update
RUN apt-get install -y sudo
RUN useradd --create-home -s /bin/bash ${user_name}
RUN echo "${user_name} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/${user_name}
WORKDIR /home/${user_name}
USER ${user_name}
CMD /bin/bash

Then build the image:

docker build -t test .

Now to fix cron permissions issues for standard user, make sure all commands used on cron scripts start with sudo, like below.

CMD ["sudo ./runCrons.sh"]

Since no password is expected when using sudo, everything should execute fine and you should be good to go.

Aby Sheffer
  • 483
  • 3
  • 4