Git Product home page Git Product logo

Comments (3)

goofball222 avatar goofball222 commented on May 10, 2024

Added BIND_PRIV environment variable. Set it to "true" to set the privileges on the container Java binary to allow it to bind to ports <1024 when running as a non-UID=0 user.

from unifi.

goofball222 avatar goofball222 commented on May 10, 2024

Reopening, reported as not completely solved by initial changes by Docker hub user gravita - https://hub.docker.com/r/gravita/. AUFS on older kernels may not support the necessary xattrs flags for setcap. This is a common Docker storage overlay driver.

[2017-09-22 12:26:36,782] Script version 0.4.6 startup.
[2017-09-22 12:26:36,786] Setting params/variables/paths.
[2017-09-22 12:26:36,792] Validating system.properties setup for container.
[2017-09-22 12:26:36,796] Existing '/usr/lib/unifi/data/system.properties' found. Setting its container-mode options to 'true'.
[2017-09-22 12:26:36,828] SSL certificate file unchanged. Continuing with UniFi startup.
[2017-09-22 12:26:36,832] To force retry the SSL import process: delete '/usr/lib/unifi/cert/unificert.sha256' and restart the container.
[2017-09-22 12:26:36,841] Entrypoint running with UID=0.
[2017-09-22 12:26:36,857] UID/GID for unifi are unchanged: UID=999, GID=999
[2017-09-22 12:26:36,861] Ensuring file permissions are correct before dropping privs - 'chown -R unifi:unifi /usr/lib/unifi'.
[2017-09-22 12:26:36,946] Support binding ports <1024 'setcap 'cap_net_bind_service=+ep' /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java'.
Failed to set capabilities on file `/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java' (Invalid argument)
The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file
$> docker info
Containers: 11
Images: 301
Storage Driver: aufs
 Root Dir: /volume1/@docker/aufs
 Backing Filesystem: extfs
 Dirs: 323
 Dirperm1 Supported: true
Execution Driver: native-0.2
Kernel Version: 3.10.35
Operating System: <unknown>
CPUs: 4
Total Memory: 3.859 GiB
Registry: [https://index.docker.io/v1/]
WARNING: No memory limit support
WARNING: No swap limit support
$> docker version
Client version: 1.6.2
Client API version: 1.18
Go version (client): go1.4.2
Git commit (client): a263667
OS/Arch (client): linux/amd64
Server version: 1.6.2
Server API version: 1.18
Go version (server): go1.4.2
Git commit (server): a263667
OS/Arch (server): linux/amd64

Docker AUFS 'setcap' xattrs problems reported by others:
moby/moby#1070
and moby/moby#5650


Workaround: Allow running as UID=0 (root). Enable via an ENV variable, default to false and require user to explicitly set. Downside: reduces overall security of running container and internal software if enabled.

from unifi.

goofball222 avatar goofball222 commented on May 10, 2024

Additional change adding support for running as UID=0 to work around AUFS missing xattrs on older kernel+aufs versions.

from unifi.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.