Skip to content

feat: no more special UID, only GID 0 #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dotconfig404 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: no more special UID, only GID 0 #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
86a2bff
feat: no more special UID, only GID 0
dotconfig404 Aug 14, 2026
862d01e
Merge branch 'main' into feat/gid0-arbitrary-uid
anthonysomerset Aug 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions Containerfile.alpine
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,6 @@
# renovate: datasource=rubygems depName=rugged
ARG RUBYGEM_RUGGED=1.9.0

ARG OPENVOX_USER_UID=64604
ARG OPENVOX_USER_GID=64604

# renovate: datasource=custom.voxpupuli-artifacts depName=openvox-server
ARG OPENVOXSERVER_VERSION=8.15.1

Expand All @@ -82,7 +79,7 @@
org.label-schema.version="$OPENVOXSERVER_VERSION" \
org.label-schema.name="OpenVox Server"

ENV AUTOSIGN=true \

Check warning on line 82 in Containerfile.alpine

View workflow job for this annotation

GitHub Actions / Scan alpine / arm64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 82 in Containerfile.alpine

View workflow job for this annotation

GitHub Actions / Scan alpine / amd64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 82 in Containerfile.alpine

View workflow job for this annotation

GitHub Actions / Build alpine / amd64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 82 in Containerfile.alpine

View workflow job for this annotation

GitHub Actions / Build alpine / arm64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
CA_ALLOW_SUBJECT_ALT_NAMES=false \
CA_ENABLED=true \
CA_TTL=157680000 \
Expand All @@ -102,8 +99,6 @@
OPENVOX_REPORTS="puppetdb" \
OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
OPENVOX_STORECONFIGS=true \
OPENVOX_USER_UID=${OPENVOX_USER_UID} \
OPENVOX_USER_GID=${OPENVOX_USER_GID} \
OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
Expand Down Expand Up @@ -136,7 +131,7 @@

RUN /prep_release_container.sh

USER puppet:0
USER 64604:0

# Create a CDS archive in a stage for faster class loading.
FROM app AS cds
Expand Down
7 changes: 1 addition & 6 deletions Containerfile.ubuntu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,9 +76,6 @@
# renovate: datasource=rubygems depName=rugged
ARG RUBYGEM_RUGGED=1.9.0

ARG OPENVOX_USER_UID=64604
ARG OPENVOX_USER_GID=64604

# renovate: datasource=custom.voxpupuli-artifacts depName=openvox-server
ARG OPENVOXSERVER_VERSION=8.15.1

Expand All @@ -91,7 +88,7 @@
org.label-schema.version="$OPENVOXSERVER_VERSION" \
org.label-schema.name="OpenVox Server"

ENV AUTOSIGN=true \

Check warning on line 91 in Containerfile.ubuntu

View workflow job for this annotation

GitHub Actions / Scan ubuntu / arm64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 91 in Containerfile.ubuntu

View workflow job for this annotation

GitHub Actions / Scan ubuntu / amd64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 91 in Containerfile.ubuntu

View workflow job for this annotation

GitHub Actions / Build ubuntu / amd64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 91 in Containerfile.ubuntu

View workflow job for this annotation

GitHub Actions / Build ubuntu / arm64 CI container

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INTERMEDIATE_CA_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
CA_ALLOW_SUBJECT_ALT_NAMES=false \
CA_ENABLED=true \
CA_TTL=157680000 \
Expand All @@ -111,8 +108,6 @@
OPENVOX_REPORTS="puppetdb" \
OPENVOX_STORECONFIGS_BACKEND="puppetdb" \
OPENVOX_STORECONFIGS=true \
OPENVOX_USER_UID=${OPENVOX_USER_UID} \
OPENVOX_USER_GID=${OPENVOX_USER_GID} \
OPENVOXDB_SERVER_URLS=https://openvoxdb:8081 \
OPENVOXSERVER_ENABLE_ENV_CACHE_DEL_API=true \
OPENVOXSERVER_ENVIRONMENT_TIMEOUT=unlimited \
Expand Down Expand Up @@ -145,7 +140,7 @@

RUN /prep_release_container.sh

USER puppet:0
USER 64604:0

# Create a CDS archive in a stage for faster class loading.
FROM app AS cds
Expand Down
13 changes: 8 additions & 5 deletions MIGRATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
# Migrations

## V8.12.0 -> V8.13.0
## Coming from a fixed UID release

Check failure on line 3 in MIGRATION.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Trailing spaces 

MIGRATION.md:3:35 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.40.0/doc/md009.md

UID is changed from 1001 on alpine and 999 on ubuntu to 64604.
If you already deployed the containers with mounted volumes, you HAVE to change the ownership of these volumes and the files underneath.
The container runs with **group 0** and works under **any UID**. File access is granted exclusively through group 0, and the UID of files on mounted volumes does not matter. There is no `puppet` service account in the image anymore.

Check failure on line 5 in MIGRATION.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Line length 

MIGRATION.md:5:211 MD013/line-length Line length [Expected: 210; Actual: 233] https://github.com/DavidAnson/markdownlint/blob/v0.40.0/doc/md013.md

Check failure on line 5 in MIGRATION.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Trailing spaces 

MIGRATION.md:5:233 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.40.0/doc/md009.md

For existing volumes, run once:

```bash
chown -R 64604:0 /path/to/ca_mountpoint
chown -R 64604:0 /path/to/ssl_mountpoint
chgrp -R 0 [PATH TO THE VOLUME]
chmod -R g+rwX [PATH TO THE VOLUME]
```

On Kubernetes/OpenShift using `fsGroup: 0` in the pod securityContext can be used to achieve the same.
12 changes: 8 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,16 +183,20 @@ services:

#### Rootless Podman

When using rootless Podman, the OpenVox Server process runs directly as the non-root `puppet` user (UID 64604) with the root group (GID 0).
This can lead to permission issues with bind mount volumes, which you may want to use for the OpenVox SSL and CA directories. For example:
The container runs with the root group (GID 0) and works under any UID. Access to mounted volumes is granted through group 0 only, the UID of the files does not matter. Prepare bind mounts once using:

```shell
chgrp -R 0 <dir> && chmod -R g+rwX <dir>
```

For example for the OpenVox SSL and CA directories:

```shell
-v ./openvoxserver-ssl:/etc/puppetlabs/puppet/ssl
-v ./openvoxserver-ca:/etc/puppetlabs/puppetserver/ca
```

By default the container will attempt to correct permissions. For a large number of files it may spend a long time at "Adjusting mounted CA directory ownership". This is normal.
If this still runs into permissions issues please check selinux and related security layers. You can relabel the host directory using the `:Z` flag:
If you still run into permission issues please check selinux and related security layers. You can relabel the host directory using the `:Z` flag:

```shell
-v ./openvoxserver-ca:/etc/puppetlabs/puppetserver/ca:Z
Expand Down
11 changes: 0 additions & 11 deletions openvoxserver/files/container-entrypoint.d/87-ca-permissions.sh
View file
Open in desktop

This file was deleted.

31 changes: 8 additions & 23 deletions openvoxserver/prep_release_container.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,28 +76,14 @@ else
rm -rf /var/lib/apt/lists/*
fi

# Create puppet user and group, and set permissions on necessary directories
# Used for rootless execution of the container and to match permissions expected by Puppet Server
if command -v addgroup >/dev/null 2>&1 && command -v apk >/dev/null 2>&1; then
addgroup -g "${OPENVOX_USER_GID}" puppet
adduser -G puppet -u "${OPENVOX_USER_UID}" -h /opt/puppetlabs/server/data/puppetserver -H -D -s /sbin/nologin puppet
else
groupadd --gid "${OPENVOX_USER_GID}" puppet
useradd \
--gid puppet \
--home-dir /opt/puppetlabs/server/data/puppetserver \
--no-create-home \
--shell /usr/sbin/nologin \
--uid "${OPENVOX_USER_UID}" \
puppet
fi

chown -R puppet:puppet /etc/puppetlabs/code
chown -R puppet:puppet /etc/puppetlabs/puppet
chown -R puppet:puppet /etc/puppetlabs/puppetserver
chown -R puppet:puppet /opt/puppetlabs/server/data/puppetserver
chown -R puppet:puppet /var/log/puppetlabs/puppetserver
chown -R puppet:puppet /var/run/puppetlabs/puppetserver
# The container runs as UID 64604 by default, but any UID works. Everything the
# server needs to write is root-owned with group 0 mirroring the owner permissions
chown -R 0:0 /etc/puppetlabs/code
chown -R 0:0 /etc/puppetlabs/puppet
chown -R 0:0 /etc/puppetlabs/puppetserver
chown -R 0:0 /opt/puppetlabs/server/data/puppetserver
chown -R 0:0 /var/log/puppetlabs/puppetserver
chown -R 0:0 /var/run/puppetlabs/puppetserver

chmod 0700 /opt/puppetlabs/server/data/puppetserver/jars
chmod 0700 /opt/puppetlabs/server/data/puppetserver/yaml
Expand Down Expand Up @@ -168,7 +154,6 @@ for d in /etc/puppetlabs /var/log/puppetlabs /var/run/puppetlabs /opt/puppetlabs
chmod -R g=u "$d"
find "$d" -type d -exec chmod g+s {} +
done
chown puppet /run/openvox

# the foreground starting script has this check before running the server:
# [ "$EUID" = "$(id -u ${USER})" ]
Expand Down
Loading