Answers to: Axon.ivy Engine 8 could not start on OpenShift with DeploymentConfig

Comment by Alex Suter on Alex Suter's answer

Alex Suter — Fri, 19 Jun 2020 02:40:59 -0400

Yes, this is anyway a good approach! So you can take as base image whatever you want to take!

Comment by vinh_ on Alex Suter's answer

vinh_ — Fri, 19 Jun 2020 02:11:55 -0400

Thanks Alex, this is what I'm doing right now, I may build the image from scratch base on official Axon.ivy Engine Dockerfile to reduce the image size (you know the files are duplicated only for changing permission).

Comment by Alex Suter on Alex Suter's answer

Alex Suter — Fri, 19 Jun 2020 02:09:48 -0400

Thank you for this link, in the doc is stated

RUN chgrp -R 0 /some/directory && \
    chmod -R g+rwX /some/directory

This seems only to be necessary for OpenShift environment but not for docker and for Kubernetes environment. So we won't apply this to our image. You need to create your own image which is based on the official Axon.ivy Engine image. Then you can apply these changes to the directories.

Comment by vinh_ on Alex Suter's answer

vinh_ — Fri, 19 Jun 2020 02:03:49 -0400

the root group is what OpenShift recommend in its image creation guideline, you could find reference in the URL bellow:

https://access.redhat.com/documentation/en-us/openshift_container_platform/3.11/html/creating_images/creating-images-guidelines

The default behavior of OpenShift is always creating Arbitrary User ID to prevent container escape and privilege escalation.

Comment by Alex Suter on Alex Suter's answer

Alex Suter — Fri, 19 Jun 2020 01:58:07 -0400

This is in my opinion definitively no option! This is a security risk. Especially for the Debian package. If you have any docs about what is common practice, we will apply this to the image, but I think you may not use OpenShift the right way?

Comment by vinh_ on Alex Suter's answer

vinh_ — Fri, 19 Jun 2020 01:52:40 -0400

I found the cause, OpenShift use Arbitrary User with un-predictable UID, this user has group root, I could fix this issue by using chown to ivy:root and chmod to 775 the following directories:

/usr/lib/axonivy-engine-8
/var/lib/axonivy-engine-8
/var/log/axonivy-engine-8
/var/cache/axonivy-engine-8
/etc/axonivy-engine-8

I think the better fix could go in Debian package and Dockerfile by set the owner to ivy:root and permission to 775 for all Ivy related directories.

Answer by Alex Suter

Alex Suter — Fri, 19 Jun 2020 01:42:10 -0400

We are creating a user and a group called ivy with id 1000, which seems best practice. Running a container in priviledge mode or changing folders for root access is not recommended at all.

I'm not familiar with OpenShift, do you have any docs about users and group in OpenShift?