Skip to content

Add conditional root check to datanode entrypoint #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
monrax wants to merge 1 commit into
base: 7.2
Choose a base branch
from
Open

Add conditional root check to datanode entrypoint #306

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 40 additions & 15 deletions docker/datanode/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,12 @@ check_env "GDN_GROUP"
check_env "GRAYLOG_DATANODE_PASSWORD_SECRET"
check_env "GRAYLOG_DATANODE_MONGODB_URI"

# If not running as root, GDN_RUN_AS_NONROOT must be explicitly set to 'true'
if [ "$(id -u)" != "0" ] && [ "$GDN_RUN_AS_NONROOT" != "true" ]; then
echo >&2 "ERROR: Container is not running as root but GDN_RUN_AS_NONROOT is not set to 'true'"
exit 1
fi

# Default Graylog settings
export GRAYLOG_DATANODE_BIN_DIR="${GDN_APP_ROOT}/bin"
export GRAYLOG_DATANODE_DATA_DIR="${GRAYLOG_DATANODE_DATA_DIR:-$GDN_DATA_ROOT}"
Expand Down Expand Up @@ -72,18 +78,37 @@ export DATANODE_JVM_OPTIONS_FILE="${DATANODE_JVM_OPTIONS_FILE:-"$GDN_JVM_OPTIONS
export DATANODE_LOG4J_CONFIG_FILE="${DATANODE_LOG4J_CONFIG_FILE:-"$GDN_LOG4J_CONFIG_FILE"}"
export JAVA_OPTS="$JAVA_OPTS"

# Create required OpenSearch directories
install -d -o "$GDN_USER" -g "$GDN_GROUP" -m 0700 \
"$GRAYLOG_DATANODE_OPENSEARCH_CONFIG_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_DATA_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_LOGS_LOCATION"

# Make sure the data node can write to the data dir
chown -R "$GDN_USER":"$GDN_GROUP" "$GRAYLOG_DATANODE_DATA_DIR"

# Starting the data node with dropped privileges
exec setpriv --reuid="$GDN_USER" --regid="$GDN_GROUP" --init-groups \
"${GRAYLOG_DATANODE_BIN_DIR}/graylog-datanode" \
datanode \
-f "$GDN_CONFIG_FILE" \
-ff "$GDN_FEATURE_FLAG_FILE"
# Only perform privilege operations if running as root
if [ "$(id -u)" = "0" ]; then
# Create required OpenSearch directories with root privileges
install -d -o "$GDN_USER" -g "$GDN_GROUP" -m 0700 \
"$GRAYLOG_DATANODE_OPENSEARCH_CONFIG_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_DATA_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_LOGS_LOCATION"

# Make sure the data node can write to the data dir
chown -R "$GDN_USER":"$GDN_GROUP" "$GRAYLOG_DATANODE_DATA_DIR"

# Starting the data node with dropped privileges
exec setpriv --reuid="$GDN_USER" --regid="$GDN_GROUP" --init-groups \
"${GRAYLOG_DATANODE_BIN_DIR}/graylog-datanode" \
datanode \
-f "$GDN_CONFIG_FILE" \
-ff "$GDN_FEATURE_FLAG_FILE"
else
# Non-root execution: create directories and set permissions
# (user can chmod directories it owns)
mkdir -p "$GRAYLOG_DATANODE_OPENSEARCH_CONFIG_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_DATA_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_LOGS_LOCATION"

chmod 0700 "$GRAYLOG_DATANODE_OPENSEARCH_CONFIG_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_DATA_LOCATION" \
"$GRAYLOG_DATANODE_OPENSEARCH_LOGS_LOCATION"

# If not running as root, execute the datanode directly
exec "${GRAYLOG_DATANODE_BIN_DIR}/graylog-datanode" \
datanode \
-f "$GDN_CONFIG_FILE" \
-ff "$GDN_FEATURE_FLAG_FILE"
fi