{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Bruger i Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anders Kopylov<\/a><\/noindex>, vores tekniske direkt\u00f8r, elsker at bruge og promovere Docker aktivt. I denne artikel forklarer han, hvordan man opretter brugere i Docker. Korrekt h\u00e5ndtering af dem, hvorfor brugere ikke b\u00f8r have root-rettigheder, og hvordan man l\u00f8ser problemet med, at indikatorer ikke stemmer overens i Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

Alle processer i containeren vil k\u00f8re som root-bruger, medmindre det er angivet anderledes. Det virker meget praktisk, da denne bruger ikke har nogen begr\u00e6nsninger. Derfor er det forkert at arbejde som root ud fra et sikkerhedsm\u00e6ssigt synspunkt. Hvis ingen p\u00e5 din lokale computer opererer med root-rettigheder i deres rette sind, s\u00e5 k\u00f8rer mange stadig processer som root i containere.<\/p>\n

<\/p>\n

Der er altid bugs, der lader ondsindede programmer undslippe fra containeren og komme ind p\u00e5 v\u00e6rtscomputeren. For at forudse det v\u00e6rste skal vi sikre os, at processerne indeni containeren k\u00f8res af en bruger, der ikke har nogen rettigheder p\u00e5 v\u00e6rtsmaskinen.<\/p>\n

<\/p>\n

Oprettelse af bruger<\/h2>\n

<\/p>\n

Oprettelse af en bruger i containeren er ikke anderledes end at oprette en i Linux-distributioner. Men for forskellige baserede billeder kan kommandoerne variere.<\/p>\n

<\/p>\n

For distributioner baseret p\u00e5 debian i Dockerfile skal du tilf\u00f8je:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
For alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
K\u00f8rsel af processer som bruger<\/h2>\n
<\/p>\n
For at k\u00f8re alle efterf\u00f8lgende processer som bruger med UID 2000, skal du k\u00f8re:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
For at k\u00f8re alle efterf\u00f8lgende processer som bruger node, skal du k\u00f8re:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
L\u00e6s mere i dokumentationen<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montering af volumener<\/h2>\n
<\/p>\n
N\u00e5r du monterer volumener ind i containeren, skal du sikre, at brugeren har mulighed for at l\u00e6se og (eller) skrive filer. For dette skal UID (GID) for brugeren i containeren og brugeren uden for containeren, som har de relevante adgangsrettigheder til filen, v\u00e6re de samme. Brugernavne har ingen betydning i denne sammenh\u00e6ng.<\/p>\n
<\/p>\n
Ofte har en bruger p\u00e5 en Linux-computer UID og GID, der er lig med 1000. Disse identifikatorer tildeles den f\u00f8rste bruger p\u00e5 computeren.<\/p>\n
<\/p>\n
Det er nemt at finde dine identifikatorer:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Du f\u00e5r omfattende information om din bruger.
\nErstat 2000 fra eksemplerne med din egen identifikator, s\u00e5 er alt i orden.<\/p>\n
<\/p>\n
Tildel UID og GID til brugeren<\/h2>\n
<\/p>\n
Hvis brugeren er oprettet tidligere, men det er n\u00f8dvendigt at \u00e6ndre identifikatorer, kan dette g\u00f8res s\u00e5dan:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Hvis du bruger den grundl\u00e6ggende alpine-billede, skal du installere pakken shadow:<\/p>\n
<\/p>\n
RUN apk add \u2014no-cache shadow<\/code><\/pre>\n
<\/p>\n
Overf\u00f8rsel af bruger-ID ind i containeren ved bygning af billedet<\/h2>\n
<\/p>\n
Hvis dit ID og ID'erne for alle de personer, der arbejder p\u00e5 projektet, er ens, er det tilstr\u00e6kkeligt at angive dette ID i Dockerfile. Men ofte stemmer bruger-ID'er ikke overens.<\/p>\n
<\/p>\n
Hvordan man opn\u00e5r det \u00f8nskede er ikke straks klart. For mig var dette det mest udfordrende i l\u00e6ringsprocessen om Docker. Mange Docker-brugere t\u00e6nker ikke over, at der er forskellige livsfaser for billedet. F\u00f8rst bygges billedet, og til dette bruges Dockerfile. N\u00e5r du starter en container fra billedet, bruges Dockerfile ikke l\u00e6ngere.<\/p>\n
<\/p>\n
Oprettelse af brugere skal finde sted under bygningen af billedet. Det samme g\u00e6lder for definitionen af den bruger, som processerne k\u00f8res under. Det betyder, at vi p\u00e5 en eller anden m\u00e5de skal overf\u00f8re UID (GID) ind i containeren.<\/p>\n
<\/p>\n
Direktiverne bruges til at anvende eksterne variabler i Dockerfile ENV<\/a><\/noindex> og\u00a0ARG<\/a><\/noindex>. Detaljeret sammenligning af direktiver her<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Du kan overf\u00f8re argumenter gennem docker-compose p\u00e5 f\u00f8lgende m\u00e5de:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Det er ikke nok at l\u00e6se dokumentation eller artikler for at mestre alle nuancer af Docker. Man skal \u00f8ve sig meget, man skal f\u00f8le Docker.<\/p>\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bruger i Docker | ProHoster","description":"Andrey Kopylov, vores tekniske direkt\u00f8r, elsker, bruger aktivt og promenerer Docker.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}