{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Kasutaja Dockeris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Kopylov<\/a><\/noindex>, meie tehnilise direktori, kes armastab, kasutab aktiivselt ja propageerib Dockerit. Uues artiklis r\u00e4\u00e4gib ta, kuidas luua kasutajaid Dockeris. \u00d5ige t\u00f6\u00f6 nende k\u00e4sitlemisel, miks ei tohi kasutajaid j\u00e4tta root \u00f5igustega ja kuidas lahendada Dockerfile'i indikaatorite mitte\u00fchtivuse probleem.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00f5ik protsessid konteineris t\u00f6\u00f6tavad root kasutajana, kui seda ei m\u00e4\u00e4rata eraldi. See v\u00f5ib tunduda v\u00e4ga mugav, sest sellel kasutajal ei ole mingeid piiranguid. Just sel p\u00f5hjusel ei ole root all t\u00f6\u00f6tamine \u00f5igesti turvalisuse aspektist. Kui kohalikul arvutil ei t\u00f6\u00f6ta keegi m\u00f5istlikult root \u00f5igustega, siis paljud k\u00e4ivitavad protsesse rootina konteinerites.<\/p>\n

<\/p>\n

Alati on vigu, mis v\u00f5imaldavad pahavarel v\u00e4lja p\u00e4\u00e4seda konteinerist ja j\u00f5uda hosti arvutisse. Eeldades halvimat, peame tagama, et protsessid k\u00e4ivitatakse konteineris kasutaja alt, kellel ei ole mingeid \u00f5igusi hostmasinal.<\/p>\n

<\/p>\n

Kasutaja loomine<\/h2>\n

<\/p>\n

Kasutaja loomine konteineris ei erine Linuxi distributsioonides kasutamise osas. Siiski v\u00f5ivad erinevate baasbildide korral k\u00e4sud erineda.<\/p>\n

<\/p>\n

Debianil p\u00f5hinevates distributsioonides tuleb Dockerfile'ile lisada:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
Alpine jaoks:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Protsesside k\u00e4itamine kasutaja alt<\/h2>\n
<\/p>\n
K\u00f5igi j\u00e4rgneva protsessi k\u00e4itamiseks kasutaja alt, kellel on UID 2000, k\u00e4ivitage:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
K\u00f5igi j\u00e4rgneva protsessi k\u00e4itamiseks kasutaja node alt k\u00e4ivitage:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Rohkem teavet leiate dokumentatsioonis<\/a><\/noindex>.<\/p>\n
<\/p>\n
Mahutite \u00fchendamine<\/h2>\n
<\/p>\n
Mahutite \u00fchendamisel veenduge, et kasutajal oleks v\u00f5imalik faile lugeda ja (v\u00f5i) kirjutada. Selleks peavad konteineri ja konteinerist v\u00e4ljaspool oleva kasutaja, kellel on vastavad \u00f5igused faili juurde p\u00e4\u00e4seda, UID (GID) vastama. Kasutajanimi pole oluline.<\/p>\n
<\/p>\n
Tihti on Linuxi arvutis kasutaja UID ja GID v\u00f5rdsed 1000-ga. Need identifikaatorid antakse esimesele kasutajale arvutis.<\/p>\n
<\/p>\n
Oma identifikaatorite v\u00e4ljaselgitamine on lihtne:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Te saad t\u00e4ielikku teavet oma kasutaja kohta.
\nAsenda 2000 n\u00e4idet oma ID-ga ja k\u00f5ik on korras.<\/p>\n
<\/p>\n
Kasutaja UID ja GID m\u00e4\u00e4ramine<\/h2>\n
<\/p>\n
Kui kasutaja on varem loodud, kuid ID-sid on vaja muuta, saad seda teha j\u00e4rgmiselt:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Kui kasutad baaspilti alpine, tuleb installida pakett shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Kasutaja ID edastamine konteinerisse pilti ehitades<\/h2>\n
<\/p>\n
Kui sinu ID ja k\u00f5ikide teiste, kes projektiga t\u00f6\u00f6tavad, ID-d on \u00fchtsed, piisab, kui m\u00e4\u00e4rata see ID Dockerfile'is. Kuid sageli ID-d ei kattu.<\/p>\n
<\/p>\n
Kuidas soovitud saavutada, ei ole kohe selge. See oli minu jaoks k\u00f5ige keerulisem osa dockeriga tutvumisel. Paljud docker kasutajad ei m\u00f5tle sellele, et pildil on erinevad eluts\u00fcklid. Esiteks kogutakse pilt, kasutades selleks Dockerfile'i. Kaugelt konteineri k\u00e4ivitamisel Dockerfile'i enam ei kasutata.<\/p>\n
<\/p>\n
Kasutajate loomine peab toimuma image'i loomise k\u00e4igus. See kehtib ka selle kohta, millise kasutaja alt protsesse k\u00e4ivitatakse. See t\u00e4hendab, et me peame mingil viisil edastama konteinerisse UID (GID).<\/p>\n
<\/p>\n
Dockerfile'is kasutatakse v\u00e4liste muutujate jaoks direktiive ENV<\/a><\/noindex> ja\u00a0ARG<\/a><\/noindex>. \u00dcksikasjalik v\u00f5rdlus direktiivide siin<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Argumente saab docker-compose kaudu edastada nii:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Docker'i k\u00f5igi n\u00fcansside omandamiseks ei piisa lihtsalt dokumentatsiooni v\u00f5i artiklite lugemisest. Tuleb palju praktiseerida, tuleb tunda docker'it.<\/p>\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kasutaja Dockeris | ProHoster","description":"Andrei Kopylov, meie tehniline direktor, armastab Dockerit, kasutab seda aktiivselt ja propageerib seda. Uues artiklis r\u00e4\u00e4gib ta, kuidas Dockeris kasutajaid luua. Kuidas nendega \u00f5igesti t\u00f6\u00f6tada, miks ei tohiks kasutajaid j\u00e4tta root \u00f5igustega ning kuidas lahendada Dockerfile'i indikaatorite mitte\u00fchtivuse probleem. K\u00f5ik konteineri protsessid t\u00f6\u00f6tavad root kasutaja alt, kui seda ei m\u00e4\u00e4rata erilisel viisil. See n\u00e4ib olevat v\u00e4ga mugav, kuna sellel kasutajal on","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441 root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}