Change for running as a non-root user (#276)
* Enable running container as mqm * Fix merge problem * Don't force root usage * RHEL image runs as mqm instead of root * Build on host with SELinux enabled * Enable building on node in an OpenShift cluster * Enable running container as mqm * Fix merge problem * Don't force root usage * Merge lastest changes from master * RHEL image runs as mqm instead of root * Fix merge issues * Test changes for non-root * Make timeout properly, and more non-root test fixes * Run tests with fewer/no capabilities * Correct usage docs for non-root * Add security docs * Add temporary debug output * Remove debug code * Fixes for termination-log * Allow init container to run as root * Fixes for CentOS build * Fixes for RHEL build * Logging improvements * Fix Dockerfile RHEL/CentOS build * Fix bash error * Make all builds specify UID * Use redist client for Go SDK * Inspect image before running tests * New test for init container * Log container runtime in runmqdevserver * Add extra capabilities if using a RHEL image
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
© Copyright IBM Corporation 2018
|
||||
© Copyright IBM Corporation 2018, 2019
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
@@ -44,7 +44,7 @@ type Logger struct {
|
||||
pid string
|
||||
serverName string
|
||||
host string
|
||||
user *user.User
|
||||
userName string
|
||||
}
|
||||
|
||||
// NewLogger creates a new logger
|
||||
@@ -53,9 +53,13 @@ func NewLogger(writer io.Writer, debug bool, json bool, serverName string) (*Log
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// This can fail because the container's running as a random UID which
|
||||
// is not known by the OS. We don't want this to break the logging
|
||||
// entirely, so just use a blank user name.
|
||||
user, err := user.Current()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
userName := ""
|
||||
if err == nil {
|
||||
userName = user.Username
|
||||
}
|
||||
return &Logger{
|
||||
mutex: sync.Mutex{},
|
||||
@@ -66,7 +70,7 @@ func NewLogger(writer io.Writer, debug bool, json bool, serverName string) (*Log
|
||||
pid: strconv.Itoa(os.Getpid()),
|
||||
serverName: serverName,
|
||||
host: hostname,
|
||||
user: user,
|
||||
userName: userName,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -93,7 +97,7 @@ func (l *Logger) log(level string, msg string) {
|
||||
"ibm_serverName": l.serverName,
|
||||
"ibm_processName": l.processName,
|
||||
"ibm_processId": l.pid,
|
||||
"ibm_userName": l.user.Username,
|
||||
"ibm_userName": l.userName,
|
||||
"type": "mq_containerlog",
|
||||
}
|
||||
s, err := l.format(entry)
|
||||
|
||||
Reference in New Issue
Block a user