{"id":31915,"date":"2019-10-31T21:43:56","date_gmt":"2019-10-31T18:43:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polzovatel-v-docker\/"},"modified":"2019-10-31T21:43:56","modified_gmt":"2019-10-31T18:43:56","slug":"polzovatel-v-docker","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/polzovatel-v-docker","title":{"rendered":"Anv\u00e4ndare i Docker","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/aak74\/posts\/\">Andrej Kopylov<\/a><\/noindex>, v\u00e5r tekniska direkt\u00f6r, \u00e4lskar, anv\u00e4nder aktivt och fr\u00e4mjar Docker. I den nya artikeln ber\u00e4ttar han hur man skapar anv\u00e4ndare i Docker. R\u00e4tt hantering av dem, varf\u00f6r anv\u00e4ndare inte ska l\u00e4mnas med root-rettigheter och hur man l\u00f6ser problemet med avvikande indikatorer i Dockerfile.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Alla processer i containern kommer att k\u00f6ras som anv\u00e4ndaren root, om det inte anges p\u00e5 s\u00e4rskilt s\u00e4tt. Detta verkar v\u00e4ldigt bekv\u00e4mt, eftersom denna anv\u00e4ndare inte har n\u00e5gra begr\u00e4nsningar. D\u00e4rf\u00f6r \u00e4r det fel att arbeta som root ur s\u00e4kerhetssynpunkt. Om ingen p\u00e5 den lokala datorn vid sina sinnens fulla bruk arbetar med root-rettigheter, s\u00e5 k\u00f6r m\u00e5nga processer som root i containrar.<\/p>\n<p><\/p>\n<p>Det finns alltid buggar som g\u00f6r att skadlig kod kan l\u00e4mna containern och komma \u00e5t v\u00e4rddatorn. Givet det v\u00e4rsta, b\u00f6r vi s\u00e4kerst\u00e4lla att processer k\u00f6rs inuti containern av en anv\u00e4ndare som inte har n\u00e5gra r\u00e4ttigheter p\u00e5 v\u00e4rddatorn.<\/p>\n<p><\/p>\n<h2>Skapa anv\u00e4ndare<\/h2>\n<p><\/p>\n<p>Att skapa en anv\u00e4ndare i containern skiljer sig inte fr\u00e5n att skapa en i Linux-distributioner. Men kommandona kan variera f\u00f6r olika grundbilder.<\/p>\n<p><\/p>\n<p>F\u00f6r distributioner baserade p\u00e5 debian i Dockerfile m\u00e5ste man l\u00e4gga till:<\/p>\n<pre><code class=\"nginx\">RUN groupadd --gid 2000 node \n  &amp;&amp; useradd --uid 2000 --gid node --shell \/bin\/bash --create-home node<\/code><\/pre>\n<p><\/p>\n<p>F\u00f6r alpine:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">RUN addgroup -g 2000 node \n    &amp;&amp; adduser -u 2000 -G node -s \/bin\/sh -D node\n<\/code><\/pre>\n<p><\/p>\n<h2>K\u00f6r processer som anv\u00e4ndare<\/h2>\n<p><\/p>\n<p>F\u00f6r att k\u00f6ra alla efterf\u00f6ljande processer som anv\u00e4ndare med UID 2000, utf\u00f6r:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">USER 2000<\/code><\/pre>\n<p><\/p>\n<p>F\u00f6r att k\u00f6ra alla efterf\u00f6ljande processer som anv\u00e4ndaren node, utf\u00f6r:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">USER node<\/code><\/pre>\n<p><\/p>\n<p>Mer information finns i <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.docker.com\/engine\/reference\/builder\/#user\">dokumentationen<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2>Montering av volymer<\/h2>\n<p><\/p>\n<p>N\u00e4r du monterar volymer inuti containern, se till att anv\u00e4ndaren kan l\u00e4sa och (eller) skriva filer. F\u00f6r detta m\u00e5ste UID (GID) f\u00f6r anv\u00e4ndaren i containern och anv\u00e4ndaren utanf\u00f6r containern, som har motsvarande tillg\u00e5ngsr\u00e4ttigheter till filen, matcha. Anv\u00e4ndarnamn spelar ingen roll.<\/p>\n<p><\/p>\n<p>Ofta har en anv\u00e4ndare p\u00e5 en Linux-dator UID och GID motsvarande 1000. Dessa identifierare tilldelas den f\u00f6rsta anv\u00e4ndaren p\u00e5 datorn.<\/p>\n<p><\/p>\n<p>Det \u00e4r l\u00e4tt att ta reda p\u00e5 sina identifierare:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">id<\/code><\/pre>\n<p><\/p>\n<p>Du kommer att f\u00e5 utf\u00f6rlig information om din anv\u00e4ndare.<br \/>\nByt ut 2000 i exemplen mot din egen identifierare s\u00e5 blir allt bra.<\/p>\n<p><\/p>\n<h2>Tilldela anv\u00e4ndaren UID och GID<\/h2>\n<p><\/p>\n<p>Om anv\u00e4ndaren skapades tidigare men identifierarna beh\u00f6ver \u00e4ndras kan detta g\u00f6ras s\u00e5 h\u00e4r:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">RUN usermod -u 1000 node \n  &amp;&amp; groupmod -g 1000 node\n<\/code><\/pre>\n<p><\/p>\n<p>Om du anv\u00e4nder en grundl\u00e4ggande alpine-image m\u00e5ste du installera paketet shadow:<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">RUN apk add --no-cache shadow<\/code><\/pre>\n<p><\/p>\n<h2>\u00d6verf\u00f6ring av anv\u00e4ndaridentifierare in i containern vid byggandet av imagen<\/h2>\n<p><\/p>\n<p>Om din identifierare och identifierarna f\u00f6r alla som arbetar med projektet \u00f6verensst\u00e4mmer, r\u00e4cker det med att ange denna identifierare i Dockerfile. Men ofta \u00f6verensst\u00e4mmer inte anv\u00e4ndarnas identifierare.<\/p>\n<p><\/p>\n<p>Hur man \u00e5stadkommer det \u00f6nskade \u00e4r inte alltid sj\u00e4lvklart. F\u00f6r mig var detta det sv\u00e5raste i inl\u00e4rningen av docker. M\u00e5nga docker-anv\u00e4ndare t\u00e4nker inte p\u00e5 att det finns olika livscykelsteg f\u00f6r en image. F\u00f6rst byggs imagen, vilket g\u00f6rs med Dockerfile. N\u00e4r container k\u00f6rs fr\u00e5n imagen anv\u00e4nds Dockerfile inte l\u00e4ngre.<\/p>\n<p><\/p>\n<p>Skapandet av anv\u00e4ndare b\u00f6r ske vid byggandet av imagen. Detta g\u00e4ller ocks\u00e5 definitionen av anv\u00e4ndaren under vilken processerna k\u00f6rs. Det betyder att vi p\u00e5 n\u00e5got s\u00e4tt m\u00e5ste \u00f6verf\u00f6ra UID (GID) in i containern.<\/p>\n<p><\/p>\n<p>F\u00f6r att anv\u00e4nda externa variabler i Dockerfile anv\u00e4nds direktiven <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.docker.com\/engine\/reference\/builder\/#env\">ENV<\/a><\/noindex> och\u00a0<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.docker.com\/engine\/reference\/builder\/#arg\">ARG<\/a><\/noindex>. En detaljerad j\u00e4mf\u00f6relse av direktiv <noindex><a rel=\"nofollow\" href=\"https:\/\/vsupalov.com\/docker-arg-env-variable-guide\/\">). Ett typiskt exempel p\u00e5 anv\u00e4ndning:<\/a><\/noindex>.<\/p>\n<p><\/p>\n<p>Dockerfile<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">ARG UID=1000\nARG GID=1000\nENV UID=${UID}\nENV GID=${GID}\nRUN usermod -u $UID node \n  &amp;&amp; groupmod -g $GID node\n<\/code><\/pre>\n<p><\/p>\n<p>F\u00f6r att \u00f6verf\u00f6ra argument via docker-compose kan du g\u00f6ra s\u00e5 h\u00e4r:<\/p>\n<p><\/p>\n<p>docker-compose<\/p>\n<p><\/p>\n<pre><code class=\"nginx\">build:\n  context: .\/src\/backend\n  args:\n    UID: 1000\n    GID: 1000\n<\/code><\/pre>\n<p><\/p>\n<p>P.S. F\u00f6r att bem\u00e4stra alla finheter av docker r\u00e4cker det inte att bara l\u00e4sa dokumentationen eller artiklar. Du m\u00e5ste praktisera mycket, du beh\u00f6ver k\u00e4nna p\u00e5 docker.<\/p>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448480\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u00a0\u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u00a0Docker. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u043d\u0438\u043c\u0438, \u043f\u043e\u0447\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\u00a0\u043d\u0435\u043b\u044c\u0437\u044f \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u00a0root \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438, \u043a\u0430\u043a \u0440\u0435\u0448\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0432\u00a0Dockerfile. \u0412\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432\u00a0\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0435 \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437-\u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0435\u0441\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0435\u0433\u043e \u043d\u0435\u00a0\u0443\u043a\u0430\u0437\u0430\u0442\u044c. \u042d\u0442\u043e \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u0443\u0434\u043e\u0431\u043d\u043e, \u0432\u0435\u0434\u044c \u0443\u00a0\u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31915","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/polzovatel-v-docker\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/polzovatel-v-docker\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:43:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:43:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anv\u00e4ndare i Docker | ProHoster","description":"Andrey Kopylov, v\u00e5r tekniska direkt\u00f6r, \u00e4lskar, anv\u00e4nder aktivt och f\u00f6respr\u00e5kar Docker.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/polzovatel-v-docker","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 Docker | ProHoster","og:description":"\u0410\u043d\u0434\u0440\u0435\u0439 \u041a\u043e\u043f\u044b\u043b\u043e\u0432, \u043d\u0430\u0448 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440, \u043b\u044e\u0431\u0438\u0442, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438 \u043f\u0440\u043e\u043f\u0430\u0433\u0430\u043d\u0434\u0438\u0440\u0443\u0435\u0442 Docker.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/polzovatel-v-docker","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:56+00:00","article:modified_time":"2019-10-31T18:43:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31915","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:25:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:08:10","updated":"2026-01-21 08:25:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=31915"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31915\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=31915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=31915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=31915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}