{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Korisnik u Dockeru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrej Kopylov<\/a><\/noindex>, na\u0161 tehni\u010dki direktor, aktivno koristi i promovira Docker. U novom \u010dlanku obja\u0161njava kako stvoriti korisnike u Dockeru. Ispravna upotreba korisnika, za\u0161to ih ne treba ostavljati s root pravima i kako rije\u0161iti problem nesukladnosti indikatora u Dockerfile-u.<\/p>\n

<\/a><\/noindex><\/p>\n

Svi procesi unutar kontejnera radit \u0107e pod korisnikom root, osim ako se posebno ne odredi. To se \u010dini vrlo prakti\u010dnim, jer taj korisnik nema nikakva ograni\u010denja. Zbog toga je nepravilno raditi pod rootom s aspekta sigurnosti. Ako na lokalnom ra\u010dunalu nitko razuman ne radi s root pravima, mnogi pokre\u0107u procese pod rootom unutar kontejnera.<\/p>\n

<\/p>\n

Uvijek postoje gre\u0161ke koje omogu\u0107uju malicioznim programima da pobjegnu iz kontejnera i u\u0111u na doma\u0107i ra\u010dunalni sustav. Pretpostavljaju\u0107i najgore, moramo osigurati da se procesi unutar kontejnera pokre\u0107u s korisnikom koji nema nikakva prava na doma\u0107em ra\u010dunalu.<\/p>\n

<\/p>\n

Kreiranje korisnika<\/h2>\n

<\/p>\n

Stvaranje korisnika unutar kontejnera ne razlikuje se od njegovog stvaranja u linux distribucijama. Me\u0111utim, za razli\u010dite osnovne slike, komande se mogu razlikovati.<\/p>\n

<\/p>\n

Za distribucije temeljene na debian-u u Dockerfile-u potrebno je dodati:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
Za alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Pokretanje procesa pod korisnikom<\/h2>\n
<\/p>\n
Za pokretanje svih sljede\u0107ih procesa pod korisnikom s UID 2000, izvr\u0161ite:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
Za pokretanje svih sljede\u0107ih procesa pod korisnikom node, izvr\u0161ite:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Vi\u0161e u dokumentaciju<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montiranje volumena<\/h2>\n
<\/p>\n
Pri montiranju volumena unutar kontejnera osigurajte korisniku mogu\u0107nost \u010ditanja i (ili) pisanja datoteka. Za to, UID (GID) korisnika u kontejneru i korisnika izvan kontejnera, koji ima odgovaraju\u0107a prava pristupa datoteci, moraju odgovarati. Pri tome imena korisnika nisu bitna.<\/p>\n
<\/p>\n
\u010cesto je na linux ra\u010dunalu korisniku UID i GID jednako 1000. Ove identifikatore dodjeljuje prvi korisnik ra\u010dunala.<\/p>\n
<\/p>\n
Saznati svoje identifikatore je jednostavno:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Dobit \u0107ete iscrpne informacije o svom korisniku.
\nZamijenite 2000 iz primjera s vlastitim identifikatorom i bit \u0107e sve u redu.<\/p>\n
<\/p>\n
Dodjeljivanje korisniku UID i GID<\/h2>\n
<\/p>\n
Ako je korisnik ve\u0107 stvoren, ali je potrebno promijeniti identifikatore, to se mo\u017ee u\u010diniti na sljede\u0107i na\u010din:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Ako koristite osnovnu sliku alpine, potrebno je instalirati paket shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Prijenos korisni\u010dkog identifikatora unutar kontejnera prilikom izrade slike<\/h2>\n
<\/p>\n
Ako se va\u0161 identifikator i identifikatori svih osoba koje rade na projektu poklapaju, tada je dovoljno navesti taj identifikator u Dockerfileu. Me\u0111utim, \u010desto identifikatori korisnika ne odgovaraju.<\/p>\n
<\/p>\n
Nije odmah jasno kako ostvariti \u017eeljeno. To mi je bilo najte\u017ee u procesu u\u010denja dockera. Mnogi korisnici dockera ne razmi\u0161ljaju o tome da postoje razli\u010dite faze \u017eivota slike. Prvo se slika sastavlja, za to se koristi Dockerfile. Kada pokrenete kontejner iz slike, Dockerfile se vi\u0161e ne koristi.<\/p>\n
<\/p>\n
Stvaranje korisnika treba se odvijati prilikom izrade slike. Isto se odnosi i na odre\u0111ivanje korisnika pod kojim se procesi pokre\u0107u. To zna\u010di da na neki na\u010din moramo predati unutra kontejnera UID (GID).<\/p>\n
<\/p>\n
Za kori\u0161tenje vanjskih varijabli u Dockerfileu slu\u017ee direktive ENV<\/a><\/noindex> i\u00a0ARG<\/a><\/noindex>. Detaljna usporedba direktiva ovdje<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Argumente se putem docker-compose mo\u017ee prenijeti na sljede\u0107i na\u010din:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Da biste savladali sve tajne dockera, nije dovoljno \u010ditati dokumentaciju ili \u010dlanke. Potrebno je puno vje\u017ebati, potrebno je osjetiti docker.<\/p>\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Korisnik u Dockeru | ProHoster","description":"Andrej Kopylov, na\u0161 tehni\u010dki direktor, voli, aktivno koristi i promi\u010de Docker.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}