{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Bruker i Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Kopylov<\/a><\/noindex>, v\u00e5r tekniske direkt\u00f8r, elsker \u00e5 aktivt bruke og promotere Docker. I den nye artikkelen forklarer han hvordan man lager brukere i Docker. Riktig h\u00e5ndtering av dem, hvorfor man ikke b\u00f8r la brukere ha root-rettigheter, og hvordan man l\u00f8ser problemet med uoverensstemmelse i Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

Alle prosesser i containeren vil kj\u00f8re som bruker root, med mindre det spesifikt angis. Dette virker veldig praktisk, siden denne brukeren ikke har noen begrensninger. Derfor er det upraktisk \u00e5 jobbe som root med hensyn til sikkerhet. Mens ingen p\u00e5 den lokale datamaskinen normalt bruker root-rettigheter, kj\u00f8rer mange prosesser som root i containere.<\/p>\n

<\/p>\n

Det finnes alltid feil som lar ondsinnede akt\u00f8rer ta seg ut av containeren og inn p\u00e5 vertsmaskinen. Gitt det verste, m\u00e5 vi s\u00f8rge for at prosessene kj\u00f8rer inne i containeren som en bruker som ikke har noen rettigheter p\u00e5 vertsmaskinen.<\/p>\n

<\/p>\n

Oppretting av bruker<\/h2>\n

<\/p>\n

Oprettelse av brukere i containeren er ikke annerledes enn i Linux-distribusjoner. Men for forskjellige basisbilder kan kommandoene variere.<\/p>\n

<\/p>\n

For distribusjoner basert p\u00e5 debian, m\u00e5 du legge til i Dockerfile:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
For alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Kj\u00f8ring av prosesser som bruker<\/h2>\n
<\/p>\n
For \u00e5 kj\u00f8re alle p\u00e5f\u00f8lgende prosesser som bruker med UID 2000, gj\u00f8r:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
For \u00e5 kj\u00f8re alle p\u00e5f\u00f8lgende prosesser som bruker node, gj\u00f8r:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Mer informasjon finner du i dokumentasjonen<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montering av volumer<\/h2>\n
<\/p>\n
N\u00e5r du monterer volumer inn i containeren, s\u00f8rg for at brukeren har tilgang til \u00e5 lese og (eller) skrive filer. For dette m\u00e5 UID (GID) for brukeren i containeren og brukeren utenfor containeren, som har de n\u00f8dvendige tilgangsrettighetene til filen, samsvare. Brukernavnene har ingen betydning.<\/p>\n
<\/p>\n
Ofte har brukeren p\u00e5 en Linux-datamaskin UID og GID lik 1000. Disse identifikatorene tildeles den f\u00f8rste brukeren p\u00e5 datamaskinen.<\/p>\n
<\/p>\n
Det er enkelt \u00e5 finne ut dine identifikatorer:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Du vil f\u00e5 omfattende informasjon om din bruker.
\nErstatt 2000 i eksemplene med din egen identifikator, s\u00e5 vil alt v\u00e6re i orden.<\/p>\n
<\/p>\n
Tildeling av bruker UID og GID<\/h2>\n
<\/p>\n
Hvis brukeren ble opprettet tidligere, men det er n\u00f8dvendig \u00e5 endre identifikatorene, kan dette gj\u00f8res slik:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Hvis du bruker en grunnleggende Alpine-bilde, m\u00e5 du installere pakken shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Overf\u00f8ring av bruker-ID inn i containeren ved bygging av bildet<\/h2>\n
<\/p>\n
Hvis din ID og identifikatorene til alle som jobber med prosjektet samsvarer, er det tilstrekkelig \u00e5 angi denne identifikatoren i Dockerfile. Men ofte stemmer ikke brukernes identifikatorer overens.<\/p>\n
<\/p>\n
Hvordan oppn\u00e5 \u00f8nsket er ikke \u00e5penbart med en gang. For meg var dette det vanskeligste i prosessen med \u00e5 l\u00e6re Docker. Mange Docker-brukere tenker ikke over at det finnes forskjellige livsfaser for et bilde. Bildet bygges f\u00f8rst, og for dette brukes Dockerfile. N\u00e5r containeren startes fra bildet, brukes ikke Dockerfile lenger.<\/p>\n
<\/p>\n
Opprettelse av brukere b\u00f8r skje under bygging av bildet. Det samme gjelder for identifikasjonen av brukeren som prosesser kj\u00f8res under. Det betyr at vi p\u00e5 en eller annen m\u00e5te m\u00e5 overf\u00f8re UID (GID) inn i containeren.<\/p>\n
<\/p>\n
For \u00e5 bruke eksterne variabler i Dockerfile tjener direktivene ENV<\/a><\/noindex> og\u00a0ARG<\/a><\/noindex>. Detaljert sammenligning av direktiver here<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Du kan sende argumenter gjennom docker-compose slik:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. For \u00e5 mestre alle detaljene ved Docker er det ikke nok \u00e5 lese dokumentasjonen eller artikler. Du m\u00e5 praktisere mye, du m\u00e5 kjenne p\u00e5 Docker.<\/p>\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bruker i Docker | ProHoster","description":"Andrey Kopylov, v\u00e5r tekniske direkt\u00f8r, elsker, bruker aktivt og fremmer Docker.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}