Php process fail when executed with 'nobody' account
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker
- Domain
- infrastructure
Research direction
Start by reading the Dockerfile around the COPY root / step and the following RUN commands; the report identifies copied /etc permissions as the cause and gives a chmod 755 /etc workaround. Check how the image build leaves /etc accessible to the nobody user, then build the image and verify php --version runs as a non-root user.
Written by the indexing model from the issue text.
Description
TL;DR: /etc has wrong permission attributes in my case, causing errors for non-root users when launching executables
Environment
Container engine: Podman (rootless)
Host OS: Ubuntu Server 26.04
Host arch: aarch64 (arm64)
Container image built from master (commit dd7191fa6d1837df00518d3a3a422dc353af1f34)
Issue
I've built locally the wallabag image using the Dockerfile from master branch on my raspbery pi 5, in order to have the latest patch of PHP.
I simply ran the following command inside the git repo:
podman build -t wallabag:2.6.14 .
When running a container with this image, it immediately fails with the following errors in logs:
Error loading shared library libxml2.so.2: Permission denied (needed by /usr/bin/php)
Error loading shared library libpcre2-8.so.0: Permission denied (needed by /usr/bin/php)
Error loading shared library libz.so.1: Permission denied (needed by /usr/bin/php)
Error loading shared library libedit.so.0: Permission denied (needed by /usr/bin/php)
Error loading shared library libargon2.so.1: Permission denied (needed by /usr/bin/php)
Error relocating /usr/bin/php: gzflush: symbol not found
Error relocating /usr/bin/php: zError: symbol not found
Error relocating /usr/bin/php: argon2_hash: symbol not found
Error relocating /usr/bin/php: inflateReset: symbol not found
(...) # Omitted for brevity
Error relocating /usr/bin/php: pcre2_maketables_8: symbol not found
Error relocating /usr/bin/php: xmlOutputBufferCreateIO: symbol not found
Error relocating /usr/bin/php: pcre2_get_mark_8: symbol not found
Analysis
Entering a shell inside the container, I tried to run php --version. It works well with the root user, but I get the same errors when running any other user (notably the nobody used by the entrypoint). I checked the permissions of /usr, /usr/lib folders and library files, but everything seems fine (755 for dirs and files).
After analyzing system calls with strace, I noticed the process tried to access /etc, but failed to do so for non-root users.
Indeed /etc permissions are 750, so non-root user cannot access it. This must be due to this repo's folder etc (permissions 750 on my host) being copied into the image, with its permissions copied as-is (maybe it's a podman specific behavior? or because my host user's umask is 027?). Anyway, after setting /etc back to 755, php --version works again for non-root users, and so does my wallabag container.
Workaround
I added the following line in the Dockerfile to set /etc permissions correctly:
diff --git a/Dockerfile b/Dockerfile
index ff622df..89b9510 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -67,6 +67,7 @@ COPY --from=composer /usr/bin/composer /usr/local/bin/composer
COPY root /
RUN set -ex \
+ && chmod 755 /etc \
&& curl -L -o /tmp/wallabag.tar.gz https://github.com/wallabag/wallabag/releases/download/$WALLABAG_VERSION/wallabag-$WALLABAG_VERSION.tar.gz \
&& tar xvf /tmp/wallabag.tar.gz -C /tmp \
&& mkdir /var/www/wallabag \
It might be necessary to add correct permissions for other files inside /etc though... (php config files, and so on)
- Dominant language
- Shell
- Stars
- 771
- Forks
- 168
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from wallabag/docker
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 3/5 1-2 days Newbie friendliness 57/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Awaiting response
Difficulty 4/5 3-5 days Newbie friendliness 32/100
-
Difficulty 4/5 3-5 days Newbie friendliness 28/100
Similar issues
-
source:reader type:enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
stephrobert/blog-roadmap#115 ·
-
Python Volcengine provider returns failures instead of raising themPossibly taken @Ricardo-M-L claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
agent-infra/sandbox#248 ·
-
chore priority:low size:S
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
celo-org/celopedia-skills#98 ·
Maintainers usually reply within 1 day
-
Git for Windows shouldn't be locked on their `.windows.1` versionsPossibly taken A pull request linked to this issue is open or already merged. Opengit windows
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
jenkins-infra/packer-images#3179 ·
Maintainers usually reply within 1 day
-
ready-for-pr
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
kunchenguid/firstmate#7679 · 1 comment ·
Maintainers usually reply within 1 day