Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Feature request: Run synapse in Docker as non-root #13190

Closed
haslersn opened this issue Jul 5, 2022 · 3 comments
Closed

Feature request: Run synapse in Docker as non-root #13190

haslersn opened this issue Jul 5, 2022 · 3 comments
Labels
P4 (OBSOLETE: use S- labels.) Okay backlog: will not schedule, will accept patches T-Enhancement New features, changes in functionality, improvements in performance, or user-facing enhancements.

Comments

@haslersn
Copy link
Contributor

haslersn commented Jul 5, 2022

It would be nice if the official Docker image would run synapse as non-root. This is a good idea for security and sometimes even required by cluster policies.
@DMRobertson DMRobertson added T-Enhancement New features, changes in functionality, improvements in performance, or user-facing enhancements. P4 (OBSOLETE: use S- labels.) Okay backlog: will not schedule, will accept patches labels Jul 5, 2022
@haslersn
Copy link
Contributor Author

haslersn commented Jul 5, 2022 •
edited
Loading

After looking at docker/start.py, it seems that it drops privileges by switching to UID 991. Is there a reason not to configure the Dockerfile to simply start as UID 991, instead of starting as root? Did somebody already try to docker run synapse with --user 991? Does this work, or will it cause permission problems?

@richvdh
Copy link
Member

richvdh commented Jul 5, 2022

yup, running docker with --user 991 should work fine.

@richvdh richvdh closed this as completed Jul 5, 2022
@richvdh
Copy link
Member

richvdh commented Jul 5, 2022

(or for that matter, any other user id)

@alirezaalavi87 alirezaalavi87 mentioned this issue Sep 9, 2023
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
P4 (OBSOLETE: use S- labels.) Okay backlog: will not schedule, will accept patches T-Enhancement New features, changes in functionality, improvements in performance, or user-facing enhancements.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@richvdh @DMRobertson @haslersn