Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding new Container and Container.debian dockerfiles to enable rootl… #8

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Adding new Container and Container.debian dockerfiles to enable rootl… #8

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
353c7dd
Adding new Container and Container.debian dockerfiles to enable rootl…
Jan 31, 2025
cb8c788
Cleaned up ENV files in Containerfiles.
Jan 31, 2025
4b1eef3
Added a link to /opt to the puppet users interpolated path.
Jan 31, 2025
52d59c0
Updated default containerfile to include puppetconfig change for CA c…
Jan 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 1 addition & 36 deletions openvoxserver/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
ENVIRONMENTPATH=/etc/puppetlabs/code/environments \
HIERACONFIG='$confdir/hiera.yaml' \
HOME=/home/puppet \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in the deb/rpm packages, it's /opt/puppetlabs/server/data/puppetserver

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesnt matter if the HOME directory is
/opt/puppetlabs/server/data/puppetserver
or
/home/puppet

because it will still be interpolated as
/opt/puppetlabs/server/data/puppetserver/.puppetlabs/....
or
/home/puppet/.puppetlabs/...

I simply felt that /home/puppet/.puppetlabs/... looks a lot cleaner. One could just as easily setup the SYMLINK for the opt folder as well, simply by changing this:

RUN mkdir -p /home/puppet/.puppetlabs/etc/ && \
        ln -s /etc/puppetlabs/puppet/ /home/puppet/.puppetlabs/etc/puppet
`

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually this can get simpler

RUN mkdir -p /home/puppet/.puppetlabs && \
        ln -s /etc/puppetlabs /home/puppet/.puppetlabs/etc

However CADIR for a non-root user is set to:

cadir = /home/puppet/.puppetlabs/etc/puppet/ssl/ca

Which conflicts that it should be /etc/puppetlabs/puppetserver/ca.

Also, I need to do a similar link for the OPT and VAR folders.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be fixed. I added a similar symlink to /opt.

I also fixed the incorrect non-root CA dir by adding:
puppet config set cadir /etc/puppetlabs/puppetserver/ca/

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just wondering why this is required at all. When systemd starts the normal puppetserver unit, it does that as puppet user, but it doesn't look for configs in its home.

Copy link
Author

@icsy7867 icsy7867 Feb 1, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Systemd doesn't exist in the container.

I dont have a puppetserver in front of me. But I would guess it's because the service runs as root.
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#User=

And I'm guessing the environment in this case is setup for root, not puppet, even though the binaries are being ran as puppet.

I'm willing to bet if you actually ssh'd into a server as a non root user and ran the systemd unit without sudo (you would have to use the --user flag https://wiki.archlinux.org/title/Systemd/User) it would be a different story.

CSR_ATTRIBUTES='{}'

COPY docker-entrypoint.sh \
Expand Down Expand Up @@ -129,42 +130,6 @@ USER puppet
RUN mkdir -p /home/puppet/.puppetlabs/etc/ && \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why exactly is this required? Without the container, puppetserver is also started as puppet user.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure I follow what you mean by "Without the container".

The main issue is that the ENTRYPOINT and CMD within container is RAN by root, it assumed all of the ROOT ENV and puppet config variables in the deployment scripts within /docker-entrypoint.d. This is easy to see:

Lets use your container:

podman run -itd --replace --name openvox --hostname openvox --entrypoint bash ghcr.io/openvoxproject/openvoxserver:8.8.0-latest

And now lets get a shell inside the container and see who the container is running as:

podman exec -it openvox bash
root@openvox:/# whoami
root

This is a security issue. The containers user should be a non-root user. If this container was to run in Openshift or Rancher Carbide, it would be immediately rejected.

Similarly lets look at the new container builds..

podman run -itd --replace --name openvox --hostname openvox --entrypoint bash openvoxserver:debian

podman exec -it openvox bash
puppet@openvox:~$ whoami
puppet

Excellent... this would run without warnings or issues in Rancher Carbide or Openshift.

SOOO... looking at the issue we need to solve when using USER puppet.

When using root:

#podman exec -itd openvox bash
#puppet config print
agent_catalog_run_lockfile = /opt/puppetlabs/puppet/cache/state/agent_catalog_run.lock
agent_disabled_lockfile = /opt/puppetlabs/puppet/cache/state/agent_disabled.lock
allow_duplicate_certs = false
allow_pson_serialization = false
always_retry_plugins = true
autoflush = true
autosign = /etc/puppetlabs/puppet/autosign.conf
basemodulepath = /etc/puppetlabs/code/modules:/opt/puppetlabs/puppet/modules
binder_config =
bucketdir = /opt/puppetlabs/puppet/cache/bucket
ca_fingerprint =
ca_name = Puppet CA: openvox.core.gtri.org
ca_port = 8140
ca_refresh_interval = 86400
ca_server = puppet
ca_ttl = 157680000
cacert = /etc/puppetlabs/puppetserver/ca/ca_crt.pem
cacrl = /etc/puppetlabs/puppetserver/ca/ca_crl.pem
cadir = /etc/puppetlabs/puppetserver/ca
cakey = /etc/puppetlabs/puppetserver/ca/ca_key.pem
capub = /etc/puppetlabs/puppetserver/ca/ca_pub.pem
catalog_cache_terminus =
catalog_terminus = compiler
cert_inventory = /etc/puppetlabs/puppetserver/ca/inventory.txt
certdir = /etc/puppetlabs/puppet/ssl/certs
certificate_revocation = chain
...

Versus non-root. The puppet user has UID 999

#podman exec -it --user 999 openvox bash
$ puppet config print
puppet@openvox:/$ puppet config print
agent_catalog_run_lockfile = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/opt/puppet/cache/state/agent_catalog_run.lock
agent_disabled_lockfile = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/opt/puppet/cache/state/agent_disabled.lock
allow_duplicate_certs = false
allow_pson_serialization = false
always_retry_plugins = true
autoflush = true
autosign = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/etc/puppet/autosign.conf
basemodulepath = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/etc/code/modules:/opt/puppetlabs/puppet/modules
binder_config =
bucketdir = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/opt/puppet/cache/bucket
ca_fingerprint =
ca_name = Puppet CA: openvox.core.gtri.org
ca_port = 8140
ca_refresh_interval = 86400
ca_server = puppet
ca_ttl = 157680000
cacert = /etc/puppetlabs/puppetserver/ca/ca_crt.pem
cacrl = /etc/puppetlabs/puppetserver/ca/ca_crl.pem
cadir = /etc/puppetlabs/puppetserver/ca
cakey = /etc/puppetlabs/puppetserver/ca/ca_key.pem
capub = /etc/puppetlabs/puppetserver/ca/ca_pub.pem
catalog_cache_terminus =
catalog_terminus = compiler
cert_inventory = /etc/puppetlabs/puppetserver/ca/inventory.txt
certdir = /opt/puppetlabs/server/data/puppetserver/.puppetlabs/etc/puppet/ssl/certs
certificate_revocation = chain

So in the default container, the puppet user (UID - 999) has a HOME directory set as /opt/puppetlabs/server/data/puppetserver, and looking at the puppet documentation:
https://www.puppet.com/docs/puppet/8/dirs_confdir.html#dirs_confdir-confdir-location
Non-root users: ~/.puppetlabs/etc/puppet

This change in the path, really screws up the ENTRYPOINT and CMD init using:
/docker-entrypoint.sh and /docker-entrypoint.d/

Because of this, I KNOW where things will change to automatically when I use a non-root user to run the ENTRYPOINT/CMD, so I leverage this and link it to the default deployment.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also... it is important to make the mounts simple, or keep them the same, as we need to give the end users an easy way to preserve the CA folder for certificates.

By using the symlink method, the container can still easily mount:

-v ./CA/:/etc/puppetlabs/puppet/ssl/ca/

VERSUS

-v ./CA/:/home/puppet/.puppetlabs/etc/puppet/ssl/ca

ln -s /etc/puppetlabs/puppet/ /home/puppet/.puppetlabs/etc/puppet

ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \
confdir=/etc/puppetlabs/puppet \
PATH=$PATH:/opt/puppetlabs/server/bin:/opt/puppetlabs/puppet/bin:/opt/puppetlabs/bin \
SSLDIR=/etc/puppetlabs/puppet/ssl \
LOGDIR=/var/log/puppetlabs/puppetserver \
OPENVOXSERVER_HOSTNAME="" \
CERTNAME="" \
DNS_ALT_NAMES="" \
OPENVOXSERVER_PORT=8140 \
AUTOSIGN=true \
OPENVOXSERVER_MAX_ACTIVE_INSTANCES=1 \
OPENVOXSERVER_MAX_REQUESTS_PER_INSTANCE=0 \
CA_ENABLED=true \
CA_TTL=157680000 \
CA_HOSTNAME=puppet \
CA_PORT=8140 \
CA_ALLOW_SUBJECT_ALT_NAMES=false \
INTERMEDIATE_CA=false \
INTERMEDIATE_CA_BUNDLE=/etc/puppetlabs/intermediate/ca.pem \
INTERMEDIATE_CRL_CHAIN=/etc/puppetlabs/intermediate/crl.pem \
INTERMEDIATE_CA_KEY=/etc/puppetlabs/intermediate/key.pem \
USE_OPENVOXDB=true \
OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
OPENVOX_STORECONFIGS=true \
OPENVOX_REPORTS="puppetdb" \
OPENVOXSERVER_GRAPHITE_EXPORTER_ENABLED=false \
OPENVOXSERVER_GRAPHITE_PORT=9109 \
OPENVOXSERVER_GRAPHITE_HOST=exporter \
OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
ENVIRONMENTPATH=/etc/puppetlabs/code/environments \
HIERACONFIG='$confdir/hiera.yaml' \
HOME=/home/puppet \
CSR_ATTRIBUTES='{}'

#We need to tell puppet to use the default installation for the non-root user.
RUN echo 'confdir = /etc/puppetlabs/puppet' >> /etc/puppetlabs/puppet/puppet.conf

Expand Down
38 changes: 1 addition & 37 deletions openvoxserver/Containerfile.debian
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why a new file? Can't you use an argument for the base container just like UBUNTU_VERSION is now an arg?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The repo URL is a bit different. To me it makes since to separate out the files.

You would also need an OS argument for:

ADD https://apt.overlookinfratech.com/openvox${OPENVOX_RELEASE}-release-debian${DEBIAN_VERSION}.deb

But you could do that and have a single file if desired.

Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
ENVIRONMENTPATH=/etc/puppetlabs/code/environments \
HIERACONFIG='$confdir/hiera.yaml' \
HOME=/home/puppet \
CSR_ATTRIBUTES='{}'

COPY docker-entrypoint.sh \
Expand Down Expand Up @@ -102,7 +103,6 @@ RUN groupadd -g ${OPENVOX_USER_GID} puppet && \
cp -pr /etc/puppetlabs/puppet /var/tmp && \
cp -pr /opt/puppetlabs/server/data/puppetserver /var/tmp && \
rm -rf /var/tmp/puppet/ssl
# apt-get install -y openvox-agent=${OPENVOXAGENT_VERSION}-1+debian${DEBIAN_VERSION} && \

# needs to be copied after package installation
COPY puppetserver /etc/default/puppetserver
Expand Down Expand Up @@ -132,42 +132,6 @@ USER puppet
RUN mkdir -p /home/puppet/.puppetlabs/etc/ && \
ln -s /etc/puppetlabs/puppet/ /home/puppet/.puppetlabs/etc/puppet

ENV OPENVOXSERVER_JAVA_ARGS="-Xms1024m -Xmx1024m" \
confdir=/etc/puppetlabs/puppet \
PATH=$PATH:/opt/puppetlabs/server/bin:/opt/puppetlabs/puppet/bin:/opt/puppetlabs/bin \
SSLDIR=/etc/puppetlabs/puppet/ssl \
LOGDIR=/var/log/puppetlabs/puppetserver \
OPENVOXSERVER_HOSTNAME="" \
CERTNAME="" \
DNS_ALT_NAMES="" \
OPENVOXSERVER_PORT=8140 \
AUTOSIGN=true \
OPENVOXSERVER_MAX_ACTIVE_INSTANCES=1 \
OPENVOXSERVER_MAX_REQUESTS_PER_INSTANCE=0 \
CA_ENABLED=true \
CA_TTL=157680000 \
CA_HOSTNAME=puppet \
CA_PORT=8140 \
CA_ALLOW_SUBJECT_ALT_NAMES=false \
INTERMEDIATE_CA=false \
INTERMEDIATE_CA_BUNDLE=/etc/puppetlabs/intermediate/ca.pem \
INTERMEDIATE_CRL_CHAIN=/etc/puppetlabs/intermediate/crl.pem \
INTERMEDIATE_CA_KEY=/etc/puppetlabs/intermediate/key.pem \
USE_OPENVOXDB=true \
OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
OPENVOX_STORECONFIGS=true \
OPENVOX_REPORTS="puppetdb" \
OPENVOXSERVER_GRAPHITE_EXPORTER_ENABLED=false \
OPENVOXSERVER_GRAPHITE_PORT=9109 \
OPENVOXSERVER_GRAPHITE_HOST=exporter \
OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
ENVIRONMENTPATH=/etc/puppetlabs/code/environments \
HIERACONFIG='$confdir/hiera.yaml' \
HOME=/home/puppet \
CSR_ATTRIBUTES='{}'

RUN echo 'confdir = /etc/puppetlabs/puppet' >> /etc/puppetlabs/puppet/puppet.conf
WORKDIR /home/puppet

Expand Down