Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Container started under system-wide user uid=100 (systemd-network) #39

Open
mrkeuz opened this issue Jul 21, 2022 · 0 comments
Open

Container started under system-wide user uid=100 (systemd-network) #39

mrkeuz opened this issue Jul 21, 2022 · 0 comments

Comments

@mrkeuz
Copy link

mrkeuz commented Jul 21, 2022

Hi, thanks for good project! Just works! 🚀🚀🚀

I have some issue/proposal.

Now I'm configuring tor-socks-proxy container for 24/7 on home server. So have couple thoughts.

Issue

By your receipt my container started as uid=100. In my case it is systemd-network user. Despite in Dockerfile user is tor. Probably, It is because specific user mapping during build. Although my system tor user have strictly defined UID.

Anyway intersection with system-wide uid=100 (systemd-network) it is bad security practice. I think.

Proposal

I propose change receipts and add some defined but numeric UID. Using numeric uid let us isolate container from other system even host system user is not exists.

For example my receipt for fix it (uid=9155), reduced:

FROM alpine:3.16

...

COPY --chown=9155:9155 torrc /etc/tor/
RUN chown 9155:9155 /var/lib/tor

...

USER 9155
EXPOSE 8853/udp 9150/tcp

CMD ["/usr/bin/tor", "-f", "/etc/tor/torrc"]

Compose:

---
version: "3.8"

services:
  tor-socks-proxy:
    container_name: tor-socks-proxy
    build: .
    user: "9155:9155"
    ports:
      - "0.0.0.0:9153:8853/udp"
      - "0.0.0.0:9153:8853/tcp"
      - "0.0.0.0:9155:9150/tcp"
    restart: always

What you think about this?

Env:

Ubuntu 20.04
Docker version 20.10.17

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant