{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Usu\u00e1rio no Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Kopylov<\/a><\/noindex>, nosso diretor t\u00e9cnico, adora, usa ativamente e promove o Docker. Em um novo artigo, ele explica como criar usu\u00e1rios no Docker. A maneira correta de trabalhar com eles, por que os usu\u00e1rios n\u00e3o devem ser deixados com permiss\u00f5es de root e como resolver o problema de incompatibilidade de indicadores no Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

Todos os processos no cont\u00eainer rodar\u00e3o sob o usu\u00e1rio root, a menos que especificado de forma especial. Isso parece muito conveniente, pois esse usu\u00e1rio n\u00e3o tem restri\u00e7\u00f5es. \u00c9 por isso que operar como root \u00e9 incorreto do ponto de vista da seguran\u00e7a. Se ningu\u00e9m no computador local opera sob permiss\u00f5es de root, muitos iniciam processos como root em cont\u00eaineres.<\/p>\n

<\/p>\n

Sempre existem bugs que podem permitir que um malware escape do cont\u00eainer e acesse o computador host. Presumindo o pior, devemos garantir que os processos dentro do cont\u00eainer sejam executados por um usu\u00e1rio que n\u00e3o tenha permiss\u00f5es na m\u00e1quina host.<\/p>\n

<\/p>\n

Criando usu\u00e1rio<\/h2>\n

<\/p>\n

A cria\u00e7\u00e3o de um usu\u00e1rio em um cont\u00eainer n\u00e3o \u00e9 diferente do seu cria\u00e7\u00e3o em distribui\u00e7\u00f5es Linux. No entanto, os comandos podem variar para diferentes imagens base.<\/p>\n

<\/p>\n

Para distribui\u00e7\u00f5es baseadas em debian, \u00e9 necess\u00e1rio adicionar ao Dockerfile:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
Para alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Executando processos como usu\u00e1rio<\/h2>\n
<\/p>\n
Para executar todos os processos subsequentes como usu\u00e1rio com UID 2000, execute:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
Para executar todos os processos subsequentes como usu\u00e1rio node, execute:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Saiba mais em documenta\u00e7\u00e3o<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montagem de volumes<\/h2>\n
<\/p>\n
Ao montar volumes dentro do cont\u00eainer, assegure que o usu\u00e1rio tenha permiss\u00e3o para ler e (ou) escrever arquivos. Para isso, o UID (GID) do usu\u00e1rio no cont\u00eainer e o usu\u00e1rio fora do cont\u00eainer, que tem as permiss\u00f5es apropriadas para acessar o arquivo, devem corresponder. Os nomes de usu\u00e1rio n\u00e3o t\u00eam import\u00e2ncia.<\/p>\n
<\/p>\n
Frequentemente, em um computador Linux, o usu\u00e1rio tem UID e GID iguais a 1000. Esses identificadores s\u00e3o atribu\u00eddos ao primeiro usu\u00e1rio do computador.<\/p>\n
<\/p>\n
Para descobrir seus identificadores, \u00e9 simples:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Voc\u00ea receber\u00e1 informa\u00e7\u00f5es detalhadas sobre seu usu\u00e1rio.
\nSubstitua 2000 pelos seus identificadores e tudo ficar\u00e1 bem.<\/p>\n
<\/p>\n
Atribui\u00e7\u00e3o de UID e GID ao usu\u00e1rio<\/h2>\n
<\/p>\n
Se o usu\u00e1rio foi criado anteriormente, mas \u00e9 necess\u00e1rio alterar os identificadores, isso pode ser feito assim:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Se voc\u00ea estiver usando uma imagem base alpine, \u00e9 necess\u00e1rio instalar o pacote shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Transmiss\u00e3o do identificador do usu\u00e1rio para dentro do cont\u00eainer ao construir a imagem<\/h2>\n
<\/p>\n
Se seu identificador e os identificadores de todas as pessoas que trabalham no projeto coincidem, basta especificar esse identificador no Dockerfile. No entanto, muitas vezes os identificadores dos usu\u00e1rios n\u00e3o coincidem.<\/p>\n
<\/p>\n
Como realizar isso n\u00e3o \u00e9 imediatamente claro. Para mim, foi a parte mais dif\u00edcil no processo de aprender Docker. Muitos usu\u00e1rios do Docker n\u00e3o percebem que existem diferentes fases na vida da imagem. Primeiro, a imagem \u00e9 constru\u00edda para isso usa-se o Dockerfile. Ao iniciar um cont\u00eainer a partir da imagem, o Dockerfile j\u00e1 n\u00e3o \u00e9 mais utilizado.<\/p>\n
<\/p>\n
A cria\u00e7\u00e3o de usu\u00e1rios deve ocorrer ao construir a imagem. O mesmo se aplica \u00e0 defini\u00e7\u00e3o do usu\u00e1rio sob o qual os processos s\u00e3o executados. Isso significa que de alguma forma devemos passar o UID (GID) para dentro do cont\u00eainer.<\/p>\n
<\/p>\n
As diretivas para usar vari\u00e1veis externas no Dockerfile s\u00e3o ENV<\/a><\/noindex> e\u00a0ARG<\/a><\/noindex>. Compara\u00e7\u00e3o detalhada das diretivas aqui<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Passar argumentos atrav\u00e9s do docker-compose pode ser feito assim:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Para aprender todos os segredos do Docker, n\u00e3o basta ler a documenta\u00e7\u00e3o ou artigos. \u00c9 necess\u00e1rio praticar muito, \u00e9 preciso sentir o Docker.<\/p>\n
Fonte: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Usu\u00e1rio no Docker | ProHoster","description":"Andrei Kopylov, nosso diretor t\u00e9cnico, ama, usa ativamente e propaga o Docker.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}