Docker on RHEL 8 creating files and folder with 027 permission

user_344669 0
Viewed 120

I am running nginxinc/nginx-unprivileged:stable-alpine docker image on RHEL 8.8 server. when docker container starts its creating directory and file with umask 0027.

But my docker 20.10.17 daemon running with Umask of 0022. my server default umask is 0027 this I can't change due to security requirements.

# systemd-analyze dump |egrep -i 'docker|umask'
 ReferencedBy: docker.service (destination-file)
        UMask: 0022

Here is inside container file system permission on RHEL 8 server.

 # ls -l
total 76
drwxr-x---    1 root     root          4096 Jun 16 21:57 app
drwxr-x---    1 root     root          4096 Jun 16 21:57 bin
drwxr-x---    5 root     root           360 Jun 17 20:18 dev
drwxr-x---    1 root     root          4096 Jun 16 21:57 docker-entrypoint.d
-rwxr-x---    1 root     root          1202 Jun 16 21:57 docker-entrypoint.sh
drwxr-x---    1 root     root          4096 Jun 17 20:18 etc
drwxr-x---    2 root     root          4096 Jun 16 21:57 home
drwxrwxrwt    1 root     root          4096 Jun 16 21:57 tmp
drwxr-x---    1 root     root          4096 Jun 16 21:57 usr
drwxr-x---    1 root     root          4096 Jun 16 21:57 var

Here is inside container file system permission on windows machine with same docker iamge.

ls -l 
drwxr-xr-x    2 root     root          4096 May 23 16:51 bin
drwxr-xr-x    5 root     root           360 Jun 17 18:39 dev
drwxr-xr-x    1 root     root          4096 Jun 16 10:36 docker-entrypoint.d
-rwxr-xr-x    1 root     root          1202 Jun 16 10:36 docker-entrypoint.sh
drwxr-xr-x    1 root     root          4096 Jun 17 18:39 etc
drwxr-xr-x    2 root     root          4096 May 23 16:51 home 
drwxr-xr-x    1 root     root          4096 May 23 16:51 usr
drwxr-xr-x    1 root     root          4096 May 23 16:51 var

How can I make docker container file system created with umask of 0022?

Thanks

dockerfile docker-compose docker containers unix
1 Answers

when docker container starts

That means you need to build your own image, based on nginxinc/nginx-unprivileged:stable-alpine, with a new entry point like:

#!/bin/sh
# entrypoint.sh
umask 022
# ... other first-time setup ...
exec "$@"

See "Change umask in docker containers" for more details, but the idea remains the same.

VonC_63090
Related