Docker Alpine、Celery（worker 和 beat）在使用非 root 用户时因 PermissionError 失败

Question

我正在尝试运行使用 docker-compose 在 Docker Alpine 上使用 Celery（worker + beat）的 Flask 应用程序。

我希望运行在我的 Docker 容器中使用非根用户 celery。
Flask 应用程序正在正常运行，但我的芹菜容器因以下错误而失败：

 File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 543, in maybe_drop_privileges
    _setuid(uid, gid)
  File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 564, in _setuid
    initgroups(uid, gid)
  File "/usr/lib/python3.6/site-packages/celery/platforms.py", line 507, in initgroups
    return os.initgroups(username, gid)
PermissionError: [Errno 1] Operation not permitted

我的Docker文件：我试图添加 RUN chown celery:celery /etc/group 认为这是问题所在，但它仍然失败

FROM alpine:3.8

RUN apk update && \
    apk add build-base python3 python3-dev libffi-dev libressl-dev && \
    cd /usr/bin && \
    ln -sf python3 python && \
    ln -sf pip3 pip && \
    pip install --upgrade pip

COPY requirements.txt .
RUN pip install -r requirements.txt

RUN addgroup celery
RUN adduser celery -G celery -s /bin/sh -D

RUN mkdir -p /var/log/celery/ && chown celery:celery /var/log/celery/
RUN mkdir -p /var/run/celery/ && chown celery:celery /var/run/celery/
RUN chown celery:celery /etc/group  # added to try fixing the issue

USER celery

ENV FLASK_APP=flask_app
WORKDIR app/
COPY flask_app flask_app

我的docker-撰写：

(...)
celeryworker:
    build: .
    command: celery -A flask_app.tasks worker --loglevel=INFO --uid=celery --pidfile=/tmp/celeryworker-shhh.pid

celerybeat:
    build: .
    command: celery -A flask_app.tasks beat --loglevel=INFO --uid=celery --pidfile=/tmp/celerybeat-shhh.pid

Answer 1

如果您想使用 --uid 或 --gid 参数，您必须是 root 用户。尝试删除这些参数。

Answer 2

你应该这样做

RUN mkdir -p /var/log/celery/ /var/run/celery/
RUN useradd -G root celery && \
    chgrp -Rf root /var/log/celery/ /var/run/celery/ && \
    chmod -Rf g+w /var/log/celery/ /var/run/celery/c && \
    chmod g+w /etc/passwd

...
RUN chmod a+x /start.sh
USER celery
ENTRYPOINT ["/start.sh"]

您应该先创建用户 celery。然后，将此用户添加到组 root 中。之后，您需要为该文件夹设置写权限，您需要放置日志和 /etc/passwd。您还需要一个脚本来将您的用户添加到 /etc/passwd

#!/bin/bash
#
if [ `id -u` -ge 10000 ]; then
    echo "celery:x:`id -u`:`id -g`:,,,:/home/web:/bin/bash" >> /etc/passwd
fi

Answer 3

@Shashank V 和@Kine 的两个答案都非常相关且很有帮助，但之后仍然存在一些问题。

经过一些研究，我终于让它可以使用以下配置

Dockerfile

FROM alpine:3.11.0

RUN apk update && \
    apk add build-base python3 python3-dev libffi-dev libressl-dev && \
    ln -sf /usr/bin/python3 /usr/bin/python && \
    ln -sf /usr/bin/pip3 usr/bin/pip && \
    pip install --upgrade pip

RUN mkdir -p /var/log/celery/ /var/run/celery/
RUN addgroup app && \
    adduser --disabled-password --gecos "" --ingroup app --no-create-home app && \
    chown app:app /var/run/celery/ && \
    chown app:app /var/log/celery/

USER app

ENV PATH="/home/app/.local/bin:${PATH}"
WORKDIR app/

COPY requirements.txt .
RUN pip install --user -r requirements.txt\

COPY flask_app flask_app

ENV FLASK_APP=flask_app

docker-撰写

 (...)
 celeryworker:
   build: .
   command: >
     celery -A shhh.tasks worker
     --loglevel=INFO
     --logfile=/var/log/celery/celeryworker-shhh.log
     --pidfile=/var/run/celery/celeryworker-shhh.pid

 celerybeat:
   build: .
   command: >
     celery -A shhh.tasks beat
     --loglevel=INFO
     --logfile=/var/log/celery/celerybeat-shhh.log
     --pidfile=/var/run/celery/celerybeat-shhh.pid
     --schedule=/var/run/celery/celerybeat-schedule  # specify schedule db in a loc where app has read/write access

Docker Alpine、Celery（worker 和 beat）在使用非 root 用户时因 PermissionError 失败

Docker Alpine, Celery (worker and beat) fail with PermissionError when using non-root user

docker

dockerfile

celery

alpine