Running NGINX Unpriviliged SSL

[myradon]

Somehow I can't get this docker container working with SSL certificates. In container CLI I can list according PEM-files with UID:GID 1000:1000. So mounting folder is working. permissions of mounted certificates And HTML-directory are the same.

Docker Container CLI output;

root@www:/# ls -la /usr/share/nginx/html/
total 21516
drwxr-xr-x 6 1000 1000 9 Jan 19 18:28 .
drwxr-xr-x 1 root root 4096 Jan 19 18:30 ..
drwxr-xr-x 2 1000 1000 5 Jul 7 2021 css
drwxr-xr-x 3 1000 1000 57 Jul 7 2021 img
-rw-r--r-- 1 1000 1000 154812 Jan 19 18:28 index.html
drwxr-xr-x 4 1000 1000 21 Jul 7 2021 js
drwxr-xr-x 4 1000 1000 4 Jul 7 2021 webfonts
root@www:/# ls -la /usr/share/nginx/ssl/
total 28
drwxrwx--- 2 1000 1000 4096 May 17 2023 .
drwxr-xr-x 1 root root 4096 Jan 19 18:30 ..
-rw-r----- 1 1000 1000 2171 Jan 5 22:21 ca.pem
-rw-r----- 1 1000 1000 2610 Jan 5 22:21 cert.pem
-rw-r----- 1 1000 1000 4781 Jan 5 22:21 fullchain.pem
-rw-r----- 1 1000 1000 3243 Jan 5 22:21 key.pem
root@www:/#

As you can see shared parent permissions;

root@www:/# namei -mov /usr/share/nginx/html/
f: /usr/share/nginx/html/
drwxr-xr-x root root /
drwxr-xr-x root root usr
drwxr-xr-x root root share
drwxr-xr-x root root nginx
drwxr-xr-x 1000 1000 html
root@www:/# namei -mov /usr/share/nginx/ssl/
f: /usr/share/nginx/ssl/
drwxr-xr-x root root /
drwxr-xr-x root root usr
drwxr-xr-x root root share
drwxr-xr-x root root nginx
drwxrwx--- 1000 1000 ssl
root@www:/#

Host CLI output;

ls -la /home/data/htdocs/www.domain.net/dist/dev
total 21513
drwxr-xr-x 6 raymond raymond 9 Jan 19 18:28 .
drwxrwxr-x 4 raymond raymond 4 Dec 26 2020 ..
drwxr-xr-x 2 raymond raymond 5 Jul 7 2021 css
drwxr-xr-x 3 raymond raymond 57 Jul 7 2021 img
-rw-r--r-- 1 raymond raymond 154812 Jan 19 18:28 index.html
drwxr-xr-x 4 raymond raymond 21 Jul 7 2021 js
drwxr-xr-x 4 raymond raymond 4 Jul 7 2021 webfonts
ls -la /srv/certificates/www.domain.net
drwxrwx--- 2 raymond raymond 4096 May 17 2023 .
drwxrwx--- 13 raymond raymond 4096 Oct 11 21:50 ..
-rw-r----- 1 raymond raymond 2171 Jan 5 22:21 ca.pem
-rw-r----- 1 raymond raymond 2610 Jan 5 22:21 cert.pem
-rw-r----- 1 raymond raymond 4781 Jan 5 22:21 fullchain.pem
-rw-r----- 1 raymond raymond 3243 Jan 5 22:21 key.pem

Logs keep throwing these errors no matter what I try;

2024/01/19 18:31:18 [warn] 1#1: the "listen ... http2" directive is deprecated, use the "http2" directive instead in /etc/nginx/conf.d/www.domain.net-https.conf:2
nginx: [warn] the "listen ... http2" directive is deprecated, use the "http2" directive instead in /etc/nginx/conf.d/www.domain.net-https.conf:2
2024/01/19 18:31:18 [emerg] 1#1: cannot load certificate "/usr/share/nginx/ssl/fullchain.pem": BIO_new_file() failed (SSL: error:8000000D:system library::Permission denied:calling fopen(/usr/share/nginx/ssl/fullchain.pem, r) error:10080002:BIO routines::system lib)
nginx: [emerg] cannot load certificate "/usr/share/nginx/ssl/fullchain.pem": BIO_new_file() failed (SSL: error:8000000D:system library::Permission denied:calling fopen(/usr/share/nginx/ssl/fullchain.pem, r) error:10080002:BIO routines::system lib)

Ignore the warning for now. I don't get why it states a permission problem while permissions of both root folder and ssl folder are the same. I would expect when permissions are not okay container can't serve HTML-root as well. That's not the case. What's going on?

[alessfg]

Did you explicitly change ownership of the SSL directory to the nginx user? Looks like the owner is still root. Your structure should look something like:

$ namei -mov /var/cache/nginx
f: /var/cache/nginx
drwxr-xr-x root  root /
drwxr-xr-x root  root var
drwxr-xr-x root  root cache
drwxrwxr-x nginx root nginx

You might want to extend the Docker image and do something similar to https://github.com/nginxinc/docker-nginx-unprivileged/blob/main/mainline/debian/Dockerfile#L112-L121 to ensure the directories you are trying to use are usable by the non-root nginx user.

[myradon]

As you can see both mounted volumes (path/nginx/html and path/nginx/ssl) have uid:gid 1000:1000. Path/nginx directory has root:root. It most likely is being set by docker container because it doesn't reflect host permissions. I haven't set any users for docker container. Documentation states it is not needed anymore. Without SSL unprivilged container runs for about 2 years without any problems. No nginx user set in host.

to ensure the directories you are trying to use are usable by the non-root nginx user.

Do you mean within docker container mounted volumes owner should be nginx:root? My setup set it to 1000:1000.

Docker config;

docker run -itd -p 8080:8080 -p 8443:8443
-v /home/data/htdocs/www.domain.net/dist/dev:/usr/share/nginx/html:ro
-v /srv/docker/nginx/conf:/etc/nginx
-v /srv/certificates/www.domain.net:/usr/share/nginx/ssl:ro
-v /etc/localtime:/etc/localtime:ro
-e TZ=Europe/Amsterdam
--name=nginx
--hostname=www
--net=macvlan133
--dns=192.168.133.1
--dns-search=domain.net
--ip=192.168.133.130
--restart=always nginxinc/nginx-unprivileged

[alessfg]

The user directive in NGINX is not explicitly set, but it is actually set to the default value behind the scenes, nobody. Then again, that directive only specifies the user running the worker process, not the master process. That master process is being run by the non-root nginx user created in the Dockerfile. The issue here is that the nginx user in the running container cannot read the certs.

I know some environments will assign an arbitrary UID that replaces the default value (e.g. OpenShift), so maybe that's related to your issue? It could also be an issue with the certs and not the directory, in which case this thread seems like it might be able to help https://serverfault.com/a/1115048.

[myradon]

I cannot execute "ps aux | grep nginx" within container because command ps is unknown (as is top and htop). So I don't know how to verify. I use docker by the way.

I've been playing with permissions. When setting all certificates to 444 on host and directory to 555 nginx container starts. Does it mean I need to create user 'nginx' in host?

[alessfg]

Right, what I meant with environments was host environments. Some Docker implementation details do change depending on where you are running Docker from.

There are a few threads out there that you might want to check such as this one https://stackoverflow.com/questions/69596606/ssl-certificate-fails-to-load-with-nginx-in-docker -- like I said, you probably need to change the permissions of the SSL certs. Looks like extending the Docker image, copying the certs, and doing something similar to what I shared in my initial reply is the way to go. Mounting a volume is going to cause a permissions mismatch for just about anything that's not read-only (on this image).