{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Utilizator \u00een Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andrei Kopylov<\/a><\/noindex>, directorul nostru tehnic, iube\u0219te, folose\u0219te activ \u0219i promoveaz\u0103 Docker. \u00cen noul s\u0103u articol, el explic\u0103 cum s\u0103 crea\u021bi utilizatori \u00een Docker. Lucrul corect cu ace\u0219tia, de ce utilizatorii nu ar trebui s\u0103 aib\u0103 drepturi root \u0219i cum se poate rezolva problema necorespunderii indicatorilor \u00een Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

Toate procesele din container vor rula sub utilizatorul root, dac\u0103 nu este specificat altfel. Acest lucru pare foarte convenabil, deoarece acest utilizator nu are restric\u021bii. De aceea, a lucra sub root nu este corect din punct de vedere al securit\u0103\u021bii. Dac\u0103 nimeni nu lucreaz\u0103 cu drepturi root pe computerul local, mul\u021bi lanseaz\u0103 procese sub root \u00een containere.<\/p>\n

<\/p>\n

\u00centotdeauna exist\u0103 bug-uri care permit malware-ului s\u0103 ias\u0103 din container \u0219i s\u0103 ajung\u0103 pe computerul gazd\u0103. Presupun\u00e2nd ce este mai r\u0103u, trebuie s\u0103 ne asigur\u0103m c\u0103 procesele din container sunt ruleaz\u0103 de utilizatorul care nu are drepturi pe ma\u0219ina gazd\u0103.<\/p>\n

<\/p>\n

Crearea utilizatorului<\/h2>\n

<\/p>\n

Crearea utilizatorilor \u00een container nu difer\u0103 de crearea acestora \u00een distribu\u021biile Linux. Totu\u0219i, pentru diferite imagini de baz\u0103, comenzile pot varia.<\/p>\n

<\/p>\n

Pentru distribu\u021biile bazate pe debian, \u00een Dockerfile trebuie s\u0103 ad\u0103uga\u021bi:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
Pentru alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Rularea proceselor de utilizator<\/h2>\n
<\/p>\n
Pentru a rula toate procesele ulterioare de utilizator cu UID 2000, executa\u021bi:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
Pentru a rula toate procesele ulterioare de utilizator node, executa\u021bi:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
Mai multe informa\u021bii \u00een documentation<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montarea volumelor<\/h2>\n
<\/p>\n
Atunci c\u00e2nd monta\u021bi volume \u00een container, asigura\u021bi-v\u0103 c\u0103 utilizatorul are permisiunea de a citi \u0219i\/sau scrie fi\u0219iere. Pentru aceasta, UID (GID) utilizatorului din container \u0219i utilizatorului din afara containerului, care are drepturile corespunz\u0103toare de acces la fi\u0219ier, trebuie s\u0103 corespund\u0103. Numele utilizatorilor nu au relevan\u021b\u0103 \u00een acest caz.<\/p>\n
<\/p>\n
Adesea, pe un computer Linux, utilizatorul are UID \u0219i GID egale cu 1000. Aceste identificatoare sunt atribuite primului utilizator al computerului.<\/p>\n
<\/p>\n
Este simplu s\u0103 \u00ee\u021bi afli identificatoarele:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Ve\u021bi primi informa\u021bii detaliate despre utilizatorul dvs.
\n\u00cenlocui\u021bi 2000 din exemple cu identificatorul dvs. \u0219i totul va fi \u00een ordine.<\/p>\n
<\/p>\n
Atribuirea utilizatorului UID \u0219i GID<\/h2>\n
<\/p>\n
Dac\u0103 utilizatorul a fost creat mai devreme, dar este necesar\u0103 schimbarea identificatorilor, aceasta se poate face astfel:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
Dac\u0103 folosi\u021bi imaginea de baz\u0103 alpine, trebuie s\u0103 instala\u021bi pachetul shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Transmiterea identificatorului utilizatorului \u00een container \u00een timpul construirii imaginii<\/h2>\n
<\/p>\n
Dac\u0103 identificatorul dumneavoastr\u0103 \u0219i identificatorii tuturor persoanelor care lucreaz\u0103 la proiect coincid, este suficient s\u0103 specifica\u021bi acest identificator \u00een Dockerfile. Totu\u0219i, adesea identificatorii utilizatorilor nu coincid.<\/p>\n
<\/p>\n
Cum s\u0103 realiza\u021bi ceea ce dori\u021bi nu este \u00eentotdeauna evident. Pentru mine, acesta a fost cel mai greu aspect \u00een procesul de \u00eenv\u0103\u021bare a docker-ului. Mul\u021bi utilizatori de docker nu se g\u00e2ndesc la faptul c\u0103 exist\u0103 diferite etape \u00een via\u021ba unei imagini. Mai \u00eent\u00e2i, imaginea este construit\u0103; pentru aceasta se folose\u0219te Dockerfile. La lansarea containerului din imagine, Dockerfile nu mai este utilizat.<\/p>\n
<\/p>\n
Crearea utilizatorilor trebuie s\u0103 aib\u0103 loc \u00een timpul construirii imaginii. Aceasta se refer\u0103 \u0219i la definirea utilizatorului sub care ruleaz\u0103 procesele. Asta \u00eenseamn\u0103 c\u0103 trebuie s\u0103 transmitem cumva \u00een interiorul containerului UID (GID).<\/p>\n
<\/p>\n
Pentru a utiliza variabile externe \u00een Dockerfile, se folosesc directivele ENV<\/a><\/noindex> \u0219i\u00a0ARG<\/a><\/noindex>. Compararea detaliat\u0103 a directivelor aici<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
Transmite\u021bi argumentele prin docker-compose astfel:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. Pentru a \u00eenv\u0103\u021ba toate subtilit\u0103\u021bile docker-ului, nu este suficient s\u0103 citi\u021bi documenta\u021bia sau articolele. Este nevoie de mult\u0103 practic\u0103, trebuie s\u0103 sim\u021bi\u021bi docker.<\/p>\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Utilizator \u00een Docker | ProHoster","description":"Andrei Kopylov, directorul nostru tehnic, \u00eei place, \u00eel folose\u0219te activ \u0219i \u00eel promoveaz\u0103 pe Docker.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}