Running in OpenShift kubernetes

[ikke-t]

I thought I share my experience for the next one since I saw the effort creating environment on OpenShift kubernetes. Difference to provided docker compose is that there are additional system requirements for security:

• nothing is run as root, but randomized uid, guid is root
• no low ports available (<1000)
• single process, so no normal cron available

I also took some time to try go around the requirements to get the provided container image working, but run into trouble after trouble, so I just write summary of an easier way.

I did not set mariadb in here as I use existing one. Also I don't need http reverse proxy, as I use kube ingress.

My kube is microshift on raspberry pi4, kube v1.33.5

Building the container

** UPDATE 2026-1-12: This is not needed. Skip forward and read the instructions for using the provided debian image. **

First I used s2i image to build myself Red Hat maintained php apache image including LB with the following Containerfile. Benefit is it has all the permissions and such preconfigured. It is also quite customizeable via environment parameters. For prod this should be done as two step build to get tiny runtime container. I don't need such for now.

More info about the image

FROM registry.access.redhat.com/ubi10/php-83:latest

# Add application sources to a directory that the assemble script expects them
# and set permissions so that the container runs without root access
USER 0
ADD app /tmp/src

# ENV DOCUMENTROOT=/public

# Install the dependencies
RUN /usr/libexec/s2i/assemble

RUN mkdir -p tpl tpl_c uploads && \
  chown -R apache tpl tpl_c uploads && \
  chmod -R g+rwx tpl tpl_c uploads

# Set the default command for the resulting image
CMD /usr/libexec/s2i/run

After cloning the git repo to app directory, I build the container using podman, docker would work too:

podman build -f Containerfile -t librebooking-app:0.3

Create kube objects for the following

Use kubectl create -f for the following yaml files

Configuration

Take the config-dist.php and copy it into below file. Follow LB instructions for options.

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: librebooking
  name: librebooking
  namespace: librebooking
data:
  config: |
    <?php
    return [
        'settings' => [

            ##########################
            # Application configuration
            ##########################

            # The public name of the application
            # ... copy this from config-dist.php

Storage

This saves uploads. For some reason favicon and logo are stored elsewhere. Until I figure out where I loose the logo at restart. Ideas welcome 😁.

---
apiVersion: v1
kind: List
metadata: {}
items:
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    annotations:
    name: images
    namespace: librebooking
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 100Mi
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    annotations:
    name: reservation
    namespace: librebooking
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 100Mi

Service

Here you can define the load-balancing options.

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: librebooking
  name: librebooking
  namespace: librebooking
spec:
  ports:
  - name: http
    nodePort: 32253
    port: 8080
  selector:
    app: librebooking
  sessionAffinity: ClientIP
  type: LoadBalancer

Route

I use the OpenShift default ingress router.

---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: librebooking
  namespace: librebooking
spec:
  host: librebooking.apps.pimetal.mynet
  port:
    targetPort: 8080
  to:
    kind: Service
    name: librebooking
    weight: 100
  wildcardPolicy: None

Deployment

Here I launch the container. It maps the config.php from the above config map.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "24"
  name: librebooking
  namespace: librebooking
spec:
  replicas: 1
  selector:
    matchLabels:
      app: librebooking
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        app: librebooking
    spec:
      containers:
      - env:
        - name: TZ
          value: Europe/Helsinki
        image: localhost/librebooking-app:0.3
        imagePullPolicy: IfNotPresent
        name: librebooking-app
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /opt/app-root/src/config/config.php
          name: config
          subPath: config
        - mountPath: /opt/app-root/src/Web/uploads/images
          name: images
        - mountPath: /opt/app-root/src/Web/uploads/reservation
          name: reservation
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      terminationGracePeriodSeconds: 30
      volumes:
      - configMap:
          defaultMode: 420
          name: librebooking
        name: config
      - name: images
        persistentVolumeClaim:
          claimName: images
      - name: reservation
        persistentVolumeClaim:
          claimName: reservation

ToDo

• Cron container
• Two stage build
• Where are the logo and favicon stored?

As this is just a playground until I know if we will use LB, I didn't do the above.

[colisee]

Hi @ikke-t, very interesting contribution!

Question:

Did you check with the latest docker container? There is only 1 job running (either LB or cron, depending on how you run the container). When running LB, it is no longer running as root.

Comment:

When looking at the Dockerfile and entrypoint, I have the feeling that there are many things that are not done in the example you gave, but I could be wrong...

[ikke-t]

Thanks, I gave a try for the provided container. I can try it later again at some point. Like said, I'd need to override the apache port, and change some file permissions to get it work with random uid. Perhaps it would be easier if I do it now once I have familiarized more with LB.

And yes, this method doesn't do any of the initialization bits the LB provided container does. The s2i tool builds the php stuff, and when not in build phase, it just runs it. Its a generic tooling to build and run any generic php app.

[ikke-t]

Now that I am back at the laptop, I gave another shot for the provided debian image. With some extra settings it works now. I did these modifications to configs:

• Go around the fact no random uid works in image by forcing uid/gid to 33 (www-data)
• Go from low ports to high port, as no user can create low ports (80/http -> 8080/http)

It seems to work fine. I wish the container image would get changed to not need these workarounds. It would require changing the port to 8080, and making the directories librebooking needs to write owned by group root, and to allow group to write there:

RUN chgrp -R root <each dir here>
RUN chmod -R g+rwx <each dir here>

The apache change is in the following ports.conf file.

So all of the above applies, but replace deployment with the below one, and add the following ServiceAccount with rolebinding.

ServiceAccount

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: librebooking
  namespace: librebooking

RoleBinding

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-to-scc-anyuid
  namespace: librebooking
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:anyuid
subjects:
- kind: ServiceAccount
  name: librebooking
  namespace: librebooking

Change apache port

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: librebooking
  name: ports
  namespace: librebooking
data:
  ports.conf: |
    Listen 8080
  000-default.conf: |
    <VirtualHost *:8080>
            ServerAdmin webmaster@localhost
            DocumentRoot /var/www/html
            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined
    </VirtualHost>

Deployment for the debian image

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
  name: librebooking-debian
  namespace: librebooking
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: librebooking
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        app: librebooking
    spec:
      containers:
      - image: docker.io/librebooking/librebooking:4.0.0
        imagePullPolicy: IfNotPresent
        name: librebooking-app
        ports:
        - containerPort: 8080
          protocol: TCP
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /config
          name: config
          subPath: config
        - mountPath: /var/www/html/Web/uploads/images
          name: images
        - mountPath: /var/www/html/config/Web/uploads/reservation
          name: reservation
        - mountPath: /etc/apache2/ports.conf
          name: ports
          subPath: ports.conf
        - mountPath: /etc/apache2/sites-enabled/000-default.conf
          name: site
          subPath: 000-default.conf
        - mountPath: /var/www/html/config/config.dist.php
          name: librebooking
          subPath: config
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        runAsGroup: 33
        runAsUser: 33
      serviceAccount: librebooking
      serviceAccountName: librebooking
      terminationGracePeriodSeconds: 30
      volumes:
      - name: config
        persistentVolumeClaim:
          claimName: config
      - name: images
        persistentVolumeClaim:
          claimName: images
      - name: reservation
        persistentVolumeClaim:
          claimName: reservation
      - configMap:
          defaultMode: 420
          name: ports
        name: ports
      - configMap:
          defaultMode: 420
          name: ports
        name: site
      - configMap:
          defaultMode: 420
          name: librebooking
        name: librebooking

That's it, now it runs. If the Dockerfile changes for permission and ports get done one day, you don't need to do the ports ConfigMap, SA, RoleBinding parts. But it works with this no problem, for production I'd fix the Dockerfile for those in name of security so that it's harder to get to memory pages as each container runs in different uid.

If I was running production, I'd also probably add supercronic cron which works better with kube.

Anyhow, thanks for the Docker image, it's excellent to have it!

[ikke-t]

I'll now close this discussion as the LB container got enhanced to work without port and permissiom tricks. There is simplified setup available at container docs: https://github.com/LibreBooking/docker/tree/master/.examples/kubernetes