{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"P\u00ebrdorues n\u00eb Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Andi Kopilov<\/a><\/noindex>, drejtori yn\u00eb teknik, e do, e p\u00ebrdor aktivisht dhe e promovon Docker. N\u00eb artikullin e ri ai tregon se si t\u00eb krijohen p\u00ebrdorues n\u00eb Docker. Puna e sakt\u00eb me ta, pse p\u00ebrdoruesit nuk duhet t\u00eb lihen me t\u00eb drejta root dhe si t\u00eb zgjidhet problemi i mosp\u00ebrputhjes s\u00eb treguesve n\u00eb Dockerfile.<\/p>\n

<\/a><\/noindex><\/p>\n

T\u00eb gjitha proceset n\u00eb kontejner do t\u00eb punojn\u00eb si p\u00ebrdorues root, n\u00ebse nuk e specifikoni at\u00eb n\u00eb m\u00ebnyr\u00eb speciale. Kjo duket shum\u00eb e p\u00ebrshtatshme, pasi ky p\u00ebrdorues nuk ka asnj\u00eb kufizim. Prandaj, t\u00eb punosh si root \u00ebsht\u00eb gabim nga pik\u00ebpamja e siguris\u00eb. N\u00ebse askush n\u00eb komputerin lokal nuk punon me t\u00eb drejtat root, shum\u00eb njer\u00ebz ekzekutojn\u00eb procese n\u00ebn root n\u00eb kontejner\u00eb.<\/p>\n

<\/p>\n

Gjithmon\u00eb ka bugs q\u00eb lejojn\u00eb nj\u00eb malware t\u00eb dal\u00eb nga kontejneri dhe t\u00eb hyj\u00eb n\u00eb kompjuterin e hostit. Duke supozuar m\u00eb t\u00eb keqen, ne duhet t\u00eb sigurojm\u00eb q\u00eb proceset brenda kontejnerit t\u00eb ekzekutohen nga nj\u00eb p\u00ebrdorues q\u00eb nuk ka asnj\u00eb t\u00eb drejt\u00eb n\u00eb makin\u00ebn e hostit.<\/p>\n

<\/p>\n

Krijimi i p\u00ebrdoruesit<\/h2>\n

<\/p>\n

Krijimi i p\u00ebrdoruesit n\u00eb nj\u00eb kontejner nuk ndryshon nga krijimi i tij n\u00eb shp\u00ebrndarjet Linux. Megjithat\u00eb, p\u00ebr imazhe t\u00eb ndryshme baz\u00eb, komandat mund t\u00eb ndryshojn\u00eb.<\/p>\n

<\/p>\n

P\u00ebr shp\u00ebrndarjet e bazuara n\u00eb debian, n\u00eb Dockerfile duhet t\u00eb shtoni:<\/p>\n

RUN groupadd --gid 2000 node \n  && useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n
<\/p>\n
P\u00ebr alpine:<\/p>\n
<\/p>\n
RUN addgroup -g 2000 node \n    && adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n
<\/p>\n
Ekzekutimi i proceseve nga p\u00ebrdoruesi<\/h2>\n
<\/p>\n
P\u00ebr t\u00eb ekzekutuar t\u00eb gjitha proceset e m\u00ebpasshme nga p\u00ebrdoruesi me UID 2000, ekzekutoni:<\/p>\n
<\/p>\n
USER 2000<\/code><\/pre>\n
<\/p>\n
P\u00ebr t\u00eb ekzekutuar t\u00eb gjitha proceset e m\u00ebpasshme nga p\u00ebrdoruesi node, ekzekutoni:<\/p>\n
<\/p>\n
USER node<\/code><\/pre>\n
<\/p>\n
M\u00eb shum\u00eb n\u00eb dokumentacion<\/a><\/noindex>.<\/p>\n
<\/p>\n
Montimi i volum\u00ebve<\/h2>\n
<\/p>\n
Kur montoni volumet brenda kontejnerit, sigurohuni q\u00eb p\u00ebrdoruesit t'i jepet mund\u00ebsia t\u00eb lexoj dhe (ose) t\u00eb shkruaj n\u00eb skedar\u00ebt. P\u00ebr k\u00ebt\u00eb, UID (GID) i p\u00ebrdoruesit n\u00eb kontejner dhe i p\u00ebrdoruesit jasht\u00eb kontejnerit, i cili ka t\u00eb drejta p\u00ebrkat\u00ebse p\u00ebr qasje n\u00eb skedar, duhet t\u00eb p\u00ebrputhen. Emrat e p\u00ebrdoruesve nuk kan\u00eb r\u00ebnd\u00ebsi.<\/p>\n
<\/p>\n
Shpesh, n\u00eb nj\u00eb kompjuter Linux, UID dhe GID i p\u00ebrdoruesit jan\u00eb t\u00eb barabarta me 1000. K\u00ebto identifikuesi i jepet p\u00ebrdoruesit t\u00eb par\u00eb t\u00eb kompjuterit.<\/p>\n
<\/p>\n
T\u00eb dish identifikuesit e tu \u00ebsht\u00eb e leht\u00eb:<\/p>\n
<\/p>\n
id<\/code><\/pre>\n
<\/p>\n
Do t\u00eb keni informacion t\u00eb plot\u00eb rreth p\u00ebrdoruesit tuaj.
\nZ\u00ebvend\u00ebsoni 2000 nga shembujt me ID-n\u00eb tuaj dhe gjith\u00e7ka do t\u00eb jet\u00eb n\u00eb rregull.<\/p>\n
<\/p>\n
Caktimi i UID dhe GID p\u00ebr p\u00ebrdoruesin<\/h2>\n
<\/p>\n
N\u00ebse p\u00ebrdoruesi \u00ebsht\u00eb krijuar m\u00eb par\u00eb, por ju nevojitet t\u00eb ndryshoni identifikuesit, mund ta b\u00ebni k\u00ebshtu:<\/p>\n
<\/p>\n
RUN usermod -u 1000 node \n  && groupmod -g 1000 node\n<\/code><\/pre>\n
<\/p>\n
N\u00ebse p\u00ebrdorni imazhin baz\u00eb alpine, duhet t\u00eb instaloni paket\u00ebn shadow:<\/p>\n
<\/p>\n
RUN apk add --no-cache shadow<\/code><\/pre>\n
<\/p>\n
Kalimi i identifikuesit t\u00eb p\u00ebrdoruesit brenda kontejnerit gjat\u00eb nd\u00ebrtimit t\u00eb imazhit<\/h2>\n
<\/p>\n
N\u00ebse identifikuesi juaj dhe identifikuesit e t\u00eb gjith\u00eb personave q\u00eb punojn\u00eb n\u00eb projekt p\u00ebrputhen, mjafton t\u00eb tregoni k\u00ebt\u00eb identifikues n\u00eb Dockerfile. Megjithat\u00eb, shpesh identifikuesit e p\u00ebrdoruesve nuk p\u00ebrputhen.<\/p>\n
<\/p>\n
Si t\u00eb realizoni at\u00eb q\u00eb d\u00ebshironi nuk \u00ebsht\u00eb menj\u00ebher\u00eb e qart\u00eb. P\u00ebr mua, kjo ishte m\u00eb e v\u00ebshtira n\u00eb procesin e m\u00ebsimit t\u00eb docker. Shum\u00eb p\u00ebrdorues t\u00eb docker nuk mendojn\u00eb p\u00ebr faktin se ka faza t\u00eb ndryshme t\u00eb jet\u00ebs s\u00eb imazhit. Fillimisht, imazhi nd\u00ebrtohet dhe p\u00ebr k\u00ebt\u00eb p\u00ebrdoren Dockerfile. Kur konteineri ndizet nga imazhi, Dockerfile nuk p\u00ebrdoret m\u00eb.<\/p>\n
<\/p>\n
Krijimi i p\u00ebrdoruesve duhet t\u00eb ndodhi gjat\u00eb nd\u00ebrtimit t\u00eb imazhit. Kjo vlen gjithashtu p\u00ebr p\u00ebrcaktimin e p\u00ebrdoruesit, nga i cili nisin proceset. K\u00ebshtu q\u00eb, ne n\u00eb nj\u00eb far\u00eb m\u00ebnyre duhet t\u00eb kalojm\u00eb brenda kontenierit UID (GID).<\/p>\n
<\/p>\n
P\u00ebr t\u00eb p\u00ebrdorur variablat e jasht\u00ebm n\u00eb Dockerfile sh\u00ebrbejn\u00eb direktivat ENV<\/a><\/noindex> dhe\u00a0ARG<\/a><\/noindex>. Krahasim t\u00eb detajuar t\u00eb direktivave k\u00ebtu<\/a><\/noindex>.<\/p>\n
<\/p>\n
Dockerfile<\/p>\n
<\/p>\n
ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  && groupmod -g $GID node\n<\/code><\/pre>\n
<\/p>\n
T\u00eb kalojm\u00eb argumentet p\u00ebrmes docker-compose mund t\u00eb b\u00ebhet k\u00ebshtu:<\/p>\n
<\/p>\n
docker-compose<\/p>\n
<\/p>\n
build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n
<\/p>\n
P.S. P\u00ebr t\u00eb zot\u00ebruar t\u00eb gjitha mjesht\u00ebrin\u00eb e docker-it, nuk mjafton t\u00eb lexosh dokumentacionin ose artikujt. Duhet t\u00eb praktikosh shum\u00eb, duhet t\u00eb ndjesh docker-in.<\/p>\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrdoruesi n\u00eb Docker | ProHoster","description":"Andrej Kopylov, drejtorin ton\u00eb teknik, e dashuron, e p\u00ebrdor aktivisht dhe e propagandon Docker-in. N\u00eb artikullin e ri ai tregon se si t\u00eb krijosh p\u00ebrdorues n\u00eb Docker. Puna e duhur me ta, pse p\u00ebrdoruesit nuk duhet t\u00eb lihen me t\u00eb drejtat e root-it dhe si t\u00eb zgjidh\u00ebsh problemin e mos p\u00ebrputhjes s\u00eb indikator\u00ebve n\u00eb Dockerfile. T\u00eb gjitha proceset n\u00eb kontenier do t\u00eb funksionojn\u00eb n\u00ebn p\u00ebrdoruesin root, n\u00ebse nuk e sh\u00ebnjohet n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Kjo duket shum\u00eb e p\u00ebrshtatshme, sepse ky p\u00ebrdorues.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441 root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}