Skip to content

Commit

Permalink
Get rid of tomcat user for ease of use
Browse files Browse the repository at this point in the history
  • Loading branch information
@yosifkit
yosifkit committed Nov 26, 2014
1 parent e826a7e commit 6f1c628
Show file tree
Hide file tree
Showing 6 changed files with 6 additions and 30 deletions.
6 changes: 1 addition & 5 deletions 6-jre7/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:7-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down
6 changes: 1 addition & 5 deletions 6-jre8/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:8-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down
6 changes: 1 addition & 5 deletions 7-jre7/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:7-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down
6 changes: 1 addition & 5 deletions 7-jre8/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:8-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down
6 changes: 1 addition & 5 deletions 8-jre7/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:7-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down
6 changes: 1 addition & 5 deletions 8-jre8/Dockerfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
FROM java:8-jre

# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
RUN groupadd -r tomcat && useradd -r --create-home -g tomcat tomcat

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME" && chown tomcat:tomcat "$CATALINA_HOME"
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME
USER tomcat

# see https://www.apache.org/dist/tomcat/tomcat-8/KEYS
RUN gpg --keyserver pgp.mit.edu --recv-keys \
Expand Down

3 comments on commit 6f1c628

@schlomo
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

http://www.projectatomic.io/docs/docker-image-author-guidance/ says that one should run services as a user with the USER xxx statement.

This change removes the tomcat user so that Tomcat runs as root. Do you have some documentation why this is a good idea and why this does not compromise the security of the host.

Without Docker, the best practice for Tomcat is most definitively to not run as root but as a service user.

@md5
Copy link
Contributor

@md5 md5 commented on 6f1c628 Aug 13, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@schlomo See the discussion in #3

Also, it may be better to raise a new issue for this instead of commenting on this commit.

FWIW, I think it would be better for the daemon to not run as root, but my personal preference would be do to that via libtcnative. See #7 for some discussion of adding libtcnative to the image.

(Corrected to say the image should not run as root if possible)

@md5
Copy link
Contributor

@md5 md5 commented on 6f1c628 Aug 13, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, it looks like #14 could be a reasonable place to discuss this.

Please sign in to comment.