diff options
| author | Michal Rostecki <mrostecki@mirantis.com> | 2015-11-13 08:28:29 +0100 |
|---|---|---|
| committer | Michal Rostecki <michal.rostecki@gmail.com> | 2016-05-06 10:23:49 +0200 |
| commit | a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20 (patch) | |
| tree | f550a9e033a6f6110b5a58d4ed1f26e10c18ea06 /docker | |
| parent | bde5e732d5c67ef56874a0d85ab5293ba6ce0679 (diff) | |
| download | kolla-a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20.tar.gz kolla-a5c1aa0b81db71fb2e293ad45c8dc920d07b8a20.zip | |
Run HAProxy in a chroot jail
It's impossible to drop root for the HAProxy container.
But HAProxy provides a possibility to use a chroot jail.
When attaching to the HAProxy container, we see that
the root directory is changed:
$ sudo docker exec -ti haproxy bash
(haproxy)[root@operator /]# ls -di /
259 /
Co-Authored-By: Vikram Hosakote <vhosakot@cisco.com>
Closes-Bug: #1552289
Change-Id: I9d55e9b741b8560cac53dc8b837a24a3029a4dc0
Diffstat (limited to 'docker')
| -rw-r--r-- | docker/haproxy/Dockerfile.j2 | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/docker/haproxy/Dockerfile.j2 b/docker/haproxy/Dockerfile.j2 index d21969629..3d2527772 100644 --- a/docker/haproxy/Dockerfile.j2 +++ b/docker/haproxy/Dockerfile.j2 @@ -15,6 +15,10 @@ RUN apt-get install -y --no-install-recommends \ {% endif %} +RUN usermod -a -G kolla haproxy \ + && mkdir -p /var/lib/kolla/haproxy \ + && chown -R haproxy: /var/lib /run + COPY ensure_latest_config.sh /usr/local/bin/kolla_ensure_haproxy_latest_config RUN chmod 755 /usr/local/bin/kolla_ensure_haproxy_latest_config |