goharbor/harbor

Run/Install Harbor as non-root user

Open

#17,494 创建于 2022年9月2日

在 GitHub 查看
 (38 评论) (0 反应) (2 负责人)Go (28,490 star) (5,235 fork)batch import
help wantednever-stalesecurity

描述

Hi all,

We are using Harbor v2.5.0 in Docker Container on a Linux Virtual Machine. During some tests, we noticed that those Containers have to run as root users. If we were trying to start them as non-root users, we had the following issue:

[Step 4]: starting Harbor ... Traceback (most recent call last): File "bin/docker-compose", line 6, 
in <module> File "compose/cli/main.py", line 71, in main File "compose/cli/main.py", line 124,
in perform_command File "compose/cli/command.py", line 42, 
in project_from_options File "compose/cli/command.py", line 115, 
in get_project File "compose/config/config.py", line 402, in load File "compose/config/config.py", 
line 502, in load_services File "compose/config/config.py", 
line 481, in build_services File "compose/config/config.py", 
line 481, in <listcomp> File "compose/config/config.py", 
line 473, in build_service File "compose/config/config.py", 
line 846, in finalize_service File "compose/config/config.py",
line 658, in resolve_environment File "compose/config/environment.py", 
line 35, in env_vars_from_file File "/code/.tox/py36/lib/python3.6/codecs.py", 
line 897, in open PermissionError: 
[Errno 13] Permission denied: '/opt/harbor/v2.5.0/common/config/registryctl/env' [21216] Failed to execute script docker-compose

Are there any plans to change this in the future to increase security?

Thank you in advance!

Alexander Barth (alexander.barth@mercedes-benz.com) on behalf of Mercedes-Benz Tech Innovation GmbH, Provider Information

贡献者指南

技术栈
dockergo
领域
securitydevops
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
4
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-2 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
active
清晰度议题是否清楚说明期望改动、验收标准和下一步。
mostly clear
前置要求
Docker basicsHarbor deploymentLinux file permissions
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
20
研究方向
The issue requests running Harbor containers as non root users. The error trace indicates a PermissionError when the container tries to read '/opt/harbor/v2.5.0/common/config/registryctl/env'. Investigate the Docker Compose configuration and the Harbor startup scripts to understand how user permissions are currently handled. Review existing comments in issue #17494 for proposed solutions. Consider modifying the Dockerfiles or adding a non root user directive in docker compose.yml, and test with appropriate volume permissions.