goharbor/harbor

Run/Install Harbor as non-root user

Open

#17,494 建立於 2022年9月2日

在 GitHub 查看
 (38 留言) (0 反應) (2 負責人)Go (28,490 star) (5,235 fork)batch import
help wantednever-stalesecurity

描述

Hi all,

We are using Harbor v2.5.0 in Docker Container on a Linux Virtual Machine. During some tests, we noticed that those Containers have to run as root users. If we were trying to start them as non-root users, we had the following issue:

[Step 4]: starting Harbor ... Traceback (most recent call last): File "bin/docker-compose", line 6, 
in <module> File "compose/cli/main.py", line 71, in main File "compose/cli/main.py", line 124,
in perform_command File "compose/cli/command.py", line 42, 
in project_from_options File "compose/cli/command.py", line 115, 
in get_project File "compose/config/config.py", line 402, in load File "compose/config/config.py", 
line 502, in load_services File "compose/config/config.py", 
line 481, in build_services File "compose/config/config.py", 
line 481, in <listcomp> File "compose/config/config.py", 
line 473, in build_service File "compose/config/config.py", 
line 846, in finalize_service File "compose/config/config.py",
line 658, in resolve_environment File "compose/config/environment.py", 
line 35, in env_vars_from_file File "/code/.tox/py36/lib/python3.6/codecs.py", 
line 897, in open PermissionError: 
[Errno 13] Permission denied: '/opt/harbor/v2.5.0/common/config/registryctl/env' [21216] Failed to execute script docker-compose

Are there any plans to change this in the future to increase security?

Thank you in advance!

Alexander Barth (alexander.barth@mercedes-benz.com) on behalf of Mercedes-Benz Tech Innovation GmbH, Provider Information

貢獻者指南

技術棧
dockergo
領域
securitydevops
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
4
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
active
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Docker basicsHarbor deploymentLinux file permissions
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
20
研究方向
The issue requests running Harbor containers as non root users. The error trace indicates a PermissionError when the container tries to read '/opt/harbor/v2.5.0/common/config/registryctl/env'. Investigate the Docker Compose configuration and the Harbor startup scripts to understand how user permissions are currently handled. Review existing comments in issue #17494 for proposed solutions. Consider modifying the Dockerfiles or adding a non root user directive in docker compose.yml, and test with appropriate volume permissions.