如何将用户添加到 Docker 容器? [英] How to add users to Docker container?

问题描述

我有一个 docker 容器，里面运行着一些进程(uwsgi 和 celery).我想为这些进程创建一个 celery 用户和一个 uwsgi 用户，以及一个他们都属于的工作组，以便分配权限.

I have a docker container with some processes (uwsgi and celery) running inside. I want to create a celery user and a uwsgi user for these processes as well as a worker group that they will both belong to, in order to assign permissions.

我尝试将 RUN adduser uwsgi 和 RUN adduser celery 添加到我的 Dockerfile，但这会导致问题，因为这些命令提示输入(我已经发布了响应从下面的构建).

I tried adding RUN adduser uwsgi and RUN adduser celery to my Dockerfile, but this is causing problems, since these commands prompt for input (I've posted the responses from the build below).

将用户添加到 Docker 容器以便为容器中运行的工作人员设置权限的最佳方法是什么?

What is the best way to add users to a Docker container so as to set permissions for workers running in the container?

我的 Docker 镜像是基于官方的 Ubuntu14.04 基础构建的.

My Docker image is built from the official Ubuntu14.04 base.

这是运行 adduser 命令时 Dockerfile 的输出:

Here is the output from the Dockerfile when the adduser commands are run:

Adding user `uwsgi' ...
Adding new group `uwsgi' (1000) ... 
Adding new user `uwsgi' (1000) with group `uwsgi' ... 
Creating home directory `/home/uwsgi' ...
Copying files from `/etc/skel' ... 
[91mEnter new UNIX password: Retype new UNIX password: [0m 
[91mpasswd: Authentication token manipulation error
passwd: password unchanged
[0m 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 563.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 564.
[0m 
Try again? [y/N] 
Changing the user information for uwsgi
Enter the new value, or press ENTER for the default
    Full Name []: 
Room Number []:     Work Phone []:  Home Phone []:  Other []: 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 589.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 590.
[0m 
Is the information correct? [Y/n] 
---> 258f2f2f13df 
Removing intermediate container 59948863162a 
Step 5 : RUN adduser celery 
---> Running in be06f1e20f64 
Adding user `celery' ...
Adding new group `celery' (1001) ... 
Adding new user `celery' (1001) with group `celery' ... 
Creating home directory `/home/celery' ...
Copying files from `/etc/skel' ... 
[91mEnter new UNIX password: Retype new UNIX password: [0m 
[91mpasswd: Authentication token manipulation error
passwd: password unchanged
[0m 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 563.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 564.
[0m 
Try again? [y/N] 
Changing the user information for celery
Enter the new value, or press ENTER for the default
    Full Name []:   Room Number []:     Work Phone []: 
Home Phone []:  Other []: 
[91mUse of uninitialized value $answer in chop at /usr/sbin/adduser line 589.
[0m 
[91mUse of uninitialized value $answer in pattern match (m//) at /usr/sbin/adduser line 590.
[0m 
Is the information correct? [Y/n] 

推荐答案

诀窍是使用 useradd 而不是它的交互式包装器 adduser.我通常使用以下方法创建用户:

The trick is to use useradd instead of its interactive wrapper adduser. I usually create users with:

RUN useradd -ms /bin/bash newuser

为用户创建一个主目录并确保 bash 是默认 shell.

which creates a home directory for the user and ensures that bash is the default shell.

然后您可以添加:

USER newuser
WORKDIR /home/newuser

到您的 dockerfile.之后的每个命令以及交互式会话都将作为用户 newuser 执行:

to your dockerfile. Every command afterwards as well as interactive sessions will be executed as user newuser:

docker run -t -i image
newuser@131b7ad86360:~$

在调用用户命令之前，您可能必须授予 newuser 执行您打算运行的程序的权限.

You might have to give newuser the permissions to execute the programs you intend to run before invoking the user command.

出于安全原因，在容器内使用非特权用户是一个好主意.它也有一些缺点.最重要的是，从您的镜像中获取镜像的人必须先切换回 root，然后才能以超级用户权限执行命令.

Using non-privileged users inside containers is a good idea for security reasons. It also has a few drawbacks. Most importantly, people deriving images from your image will have to switch back to root before they can execute commands with superuser privileges.

这篇关于如何将用户添加到 Docker 容器?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！