{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Kasutaja Dockeris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Kopylov<\/a><\/noindex>, meie tehnilise direktori, kes armastab, kasutab aktiivselt ja propageerib Dockerit. Uues artiklis r\u00e4\u00e4gib ta, kuidas luua kasutajaid Dockeris. \u00d5ige t\u00f6\u00f6 nende kallal, miks ei tohi kasutajaid j\u00e4tta root \u00f5igustega ja kuidas lahendada Dockerfile'i indikaatorite mittesobivuse probleem.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00f5ik konteineris t\u00f6\u00f6tavad protsessid t\u00f6\u00f6tavadroot kasutaja alt, kui seda ei m\u00e4\u00e4rata eraldi. See tundub v\u00e4ga mugav, kuna sellel kasutajal ei ole mingeid piiranguid. Just seet\u00f5ttu on vale t\u00f6\u00f6tada root \u00f5igustes turvalisuse seisukohalt. Kui lokaal arvutis ei tohi keegi m\u00f5istuse juures t\u00f6\u00f6tada root \u00f5igustes, siis paljud k\u00e4ivitavad protsesse 'root' all konteinerites.<\/p>\n

<\/p>\n

Alati on olemas vead, mis lubavad pahatahtlikul v\u00e4lja p\u00e4\u00e4seda konteinerist ja j\u00f5uda host-arvutisse. Eeldades halvimat, peame tagama, et protsessid k\u00e4ivituvad konteineris kasutaja alt, kellel puuduvad \u00f5igused host-arvutis.<\/p>\n

<\/p>\n

Kasutaja loomine<\/h2>\n

<\/p>\n

Kasutaja loomine konteineris ei erine tema loomisest Linuxi distributsioonides. Kuid erinevate aluseks olevate piltide puhul v\u00f5ivad k\u00e4sud erineda.<\/p>\n

<\/p>\n

Debian p\u00f5hinevate distributsioonide jaoks tuleb Dockerfile'i lisada:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
Alpine jaoks:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Protsesside k\u00e4ivitamine kasutaja alt<\/h2>\n
<\/p>\n
Tehke j\u00e4rgmist, et k\u00f5ik edasised protsessid t\u00f6\u00f6taksid kasutaja UID 2000 alt:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
Tehke j\u00e4rgmist, et k\u00f5ik edasised protsessid t\u00f6\u00f6taksid kasutaja node alt:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Rohkem infot dokumentatsioon<\/a><\/noindex>.<\/p>\n
<\/p>\n
Hoidlate mountimine<\/h2>\n
<\/p>\n
Hoidlate mountimisel konteinerisse veenduge, et kasutajal oleks v\u00f5imalik faile lugeda ja (v\u00f5i) kirjutada. Selle saavutamiseks peavad konteineri kasutaja UID (GID) ja konteinerist v\u00e4ljaspool oleva kasutaja UID (GID), kellel on vastavad juurdep\u00e4\u00e4su\u00f5igused, olema vastavuses. Kasutajanimed ei oma sel juhul t\u00e4htsust.<\/p>\n
<\/p>\n
Tihti on Linuxi arvutis kasutajal UID ja GID v\u00f5rdsed 1000. Need identifikaatorid antakse esimeselle arvuti kasutajale.<\/p>\n
<\/p>\n
Oma identifikaatorite leidmine on lihtne:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Saate p\u00f5hjalikku teavet oma kasutaja kohta.
\nAsendage 2000 n\u00e4idetes oma identifikaatoriga ja k\u00f5ik on korras.<\/p>\n
<\/p>\n
Kasutajale UID ja GID m\u00e4\u00e4ramine<\/h2>\n
<\/p>\n
Kui kasutaja on varem loodud, kuid ID-sid on vaja muuta, saab seda teha j\u00e4rgmiselt:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Kui kasutate aluseks olevat alpine pilti, siis tuleb installida shadow paket:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Kasutaja ID edastamine konteinerisse pildi ehitamise ajal<\/h2>\n
<\/p>\n
Kui teie ID ja k\u00f5igi teiste projektiga t\u00f6\u00f6tavate inimeste ID-d kattuvad, piisab, kui m\u00e4rkida see ID Dockerfile'i. Kuid sageli ei l\u00e4he kasutajate ID-d kokku.<\/p>\n
<\/p>\n
Kuidas soovitud tulemus saavutada, ei ole kohe selge. See oli mulle k\u00f5ige raskem osa Docker'i \u00f5ppimise protsessis. Paljud Docker'i kasutajad ei m\u00f5tle sellele, et piltide eluts\u00fckli jooksul on erinevad etapid. Alguses kogutakse pilti, selleks kasutatakse Dockerfile'i. Kogu konteineri k\u00e4ivitamisel Dockerfile'i ei kasutata.<\/p>\n
<\/p>\n
Kasutajate loomine peab toimuma pildi ehitamise ajal. See kehtib ka kasutaja m\u00e4\u00e4ramisel, kelle alt protsessid k\u00e4ivitatakse. See t\u00e4hendab, et peame mingil viisil edastama UID (GID) konteinerisse.<\/p>\n
<\/p>\n
ZDockerfile'is v\u00e4liste muutujaid kasutatakse k\u00e4skude kaudu ENV<\/a><\/noindex> ja\u00a0ARG<\/a><\/noindex>. \u00dcksikasjalik v\u00f5rdlus k\u00e4skudest siit<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Argumentide edastamine docker-compose'i kaudu on v\u00f5imalik j\u00e4rgmiselt:<\/p>\n
<\/p>\n
version: '1'\n    services:\n        simplesample-sonar:\n            image: sonarqube:lts\n            ports:\n                - 9001:9000\n                - 9092:9092\n            network_mode: bridge<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Docker'i k\u00f5ikide saladuste omandamiseks ei piisa pelgalt dokumentatsiooni v\u00f5i artiklite lugemisest. Tuleb palju harjutada, tuleb tunnetada Docker'it.<\/p>\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kasutaja Docker'is | ProHoster","description":"Andrei Kopylov, meie tehniline direktor, armastab, kasutab aktiivselt ja propageerib Docker'it.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}